A StandWithUs UK Deep Dive

“The manner and timing are like something from a movie, it’s shocking”:
Hezbollah Pager Surprise Attack

On Wednesday 17th September, the Middle East was the setting for another dramatic element of the wars against Israel. In the afternoon, thousands of small explosions were setoff across Lebanon and parts of Syria. Within the hour, thousands of Hezbollah operatives were reported to have suffered severe injuries. The explosions were all of their issued pagers detonating at the exact same time. At the time of this post, there are reported to be over 4000 Hezbollah terrorists injured from the simultaneous attack, with 11 killed. Read analysis of this dramatic event, how it could have been done, and why now?

In a nutshell:

On September 17th, a series of simultaneous explosions hit Hezbollah operatives in Lebanon and Syria. The detonations originated from their communication pagers, causing thousands of injuries. Since Hamas’ October 7th attack on Israel, Hezbollah switched to pagers for encrypted communications, safer than mobile phones. Security experts believe Israel, possibly through Mossad, may have infiltrated the devices or launched a cyberattack to cause the explosions. The attack was a significant blow to Hezbollah’s operational capabilities, and analysts suggest it was part of Israel’s broader strategy against the group. Iran reportedly helped supply the communication devices, but the exact method of sabotage remains unclear. Reports suggest that Israel had planned this for some time but was forced to execute the operation early due to suspicions growing amongst Hezbollah operatives. However, it is important to note that as of now Israel has not claimed responsibility for this attack, or even made any reference to it in any statements.

Use of pagers amongst terror groups

Since Hamas attacked Israel on October 7, they have switched to using simpler and more encrypted means, including “beepers” like the ones that exploded across Lebanon on 17th September. Pagers are considered to be safer communication options for terror groups such as Hamas and Hezbollah, as they are harder to detect due to no GPS, making them difficult to track like mobile phones.

Hezbollah leaders have used pagers (“beepers”) for years, but the use of these mobile electronic devices expanded after the Hamas attack on October 7th when Hassan Nasrallah, the organisation’s leader, warned his operatives that Israeli intelligence had penetrated their mobile phone network, according to security experts. As a result, thousands of Hezbollah operatives — not just fighters — switched to anew wireless pager system, according to Amer Al-Sabaileh, a regional security expert and lecturer at a university in Amman. He added that his information is based on numerous connections in political and security circles in Lebanon.

A freeze frame from a CCTV video of a pager belonging to a Hezbollah operative exploding

It is unclear at this time how these devices were distributed (although Reuters reported in July that there had been a call amongst Hezbollah leaders for all operatives to use pagers) but a large number of pagers exploded simultaneously on Tuesday in Lebanon, injuring thousands, according to Lebanese health authorities. According to three sources who spoke to The New York Times, the devices were programmed in such a way that they would beep for several seconds before the explosion.

Since the advent of mobile phones and smartphones, pagers had fallen out of use, but some people still kept them for fast and private communication. Hezbollah has been aware of the possibility of its communication systems being compromised for years, added Al-Sabaileh, and forbade operatives from using mobile phones whilst traveling in the southern part of the country near the border with Israel.

Iranian involvement

Iran, whose government provides Hezbollah with weapons, technology, and other forms of military assistance, was instrumental in the decision to switch to this communication system and in supplying the technology, according to experts. They added that they do not know exactly how the devices were distributed to Hezbollah operatives or how they were hacked, but a significant element of the new pager system is that it does not use the satellite network that is the basis for most common cell phone systems, making it harder to track them electronically.

David Wood, a senior analyst at the International Crisis Group research institute, described the pager system as a closed and limited network. He said that in the short term, Hezbollah would likely switch to other communication methods, perhaps one that does not involve electronic devices. “It will definitely complicate coordination and make it more dangerous. It is undoubtedly a severe blow to Hezbollah’s operational capabilities,” he said.

Mojtaba Amani, Iran’s ambassador to Lebanon, was injured when a pager exploded

Impact of the attack

Al-Sabaileh said the explosions are a severe psychological blow to Hezbollah because they illustrate Israel’s ability to strike not only its fighters, but everyone associated with the organisation as they go about their daily routine. Al-Sabaileh added that the organisation would likely see this as a starting point for Israeli escalation of the conflict. “The way they were attacked, and the timing are like something from a movie — causing devices to explode simultaneously everywhere is shocking.”

Researchers and sources familiar with the matter who spoke with Haaretz explained that the widespread attack, which injured thousands of people, could have been carried out by overheating the batteries of the communication devices, through malicious software, or by embedding explosives in the devices before they were delivered to Hezbollah operatives. Either way, the attack requires complex and delicate intelligence work even before execution.

Remains of a pager that exploded

How could this have been done?

The series of explosions of Hezbollah communication devices that caused deaths and thousands of injuries in Lebanon is the result of a complex operation that required deep penetration into the organisation’s communication system, regardless of who carried it out. According to security and technology researchers and sources familiar with the matter who spoke to Haaretz and requested anonymity, there are two possibilities that could explain the series of explosions.

The first possibility is that similar to the assassination of Hamas Commander Yahya Ayyash in January 1996, the entities behind the attack managed to infiltrate the supply chain of the communication company that provided the devices to Hezbollah and planted small explosive charges in thousands of the devices. Another possibility presented by the experts is that it was a cyberattack that caused the devices batteries to overheat, leading to explosions. “This was purely a cyberbreach,” one of the researchers who spoke with Haaretz assessed, saying, “All you need is to initiate a malicious software update, and then just hit ‘Enter’.” The researcher explained that, in terms of energy, a fully charged lithium battery weighing 50 grams is equivalent to a seven-gram TNT explosion in terms of the heat it generates. “If you cause a short circuit in a lithium battery, it heats up very quickly, within seconds,” he explained.

Other sources, however, estimated that a cyber breach alone could not cause the type of explosion seen in the various videos from the scenes in Lebanon. According to them, it is much more likely that those behind the attack managed to plant an explosive component in the devices during one of their production or supply stages. According to the sources, the explosives embedded in the communication devices could indeed be activated remotely.

To carry out the operation, whether through a breach of the supply chain or via a cyberbreach, the executing entity would have had to perform a series of complex intelligence activities to focus the attack on the correct targets. Among other things, they would have had to map the list of users of Hezbollah’s communication devices, identify weaknesses in the network, and design the attack accordingly.

According to various reports, the devices heated up before they exploded. Sky News in Arabic reported, citing its sources, that the Mossad planted explosives in the batteries of the devices, causing the explosion by raising their temperature. According to the report, the explosive material was PETN. Lebanese security sources cited by Al Jazeera added that the weight of the explosive material did not exceed 20 grams. Three Lebanese sources told Reuters this evening that the devices that exploded were of a new model, recently purchased by Hezbollah over the past few months. A Hezbollah source told The Wall Street Journal that one theory is that malicious software may have been installed on the devices.

Arabic media reported today that the Mossad made sure to booby-trap the devices that exploded in Lebanon before they reached Hezbollah operatives. Sky News in Arabic reported that the Mossad planted PETN explosives between the batteries of the devices, and the explosion was caused by raising the temperature of the batteries. According to a Lebanese security source cited by Al Jazeera, the weight of the explosive material did not exceed 20 grams.

The U.S. State Department announced that it does not know who is behind the communication device attack in Lebanon and that the U.S. has no connection to it. The department said that escalation between Israel and Lebanon would not help bring residents back to their homes and clarified that they suggest Iran not exploit the incident to worsen the security situation.

Front page of The Times, 18th September 2024

Why now?

According to reports from Al-Monitor quoted in a BBC article, the original plan was for Israel to follow up with devastating attacks while Hezbollah was still reeling. The pager attack, the reports say, was to be the opening salvo in a big escalation – as part of an offensive or perhaps an invasion of southern Lebanon. Two Hezbollah operatives had begun to work out the issue with the pagers, leading to Israeli agents eliminating one of them before deciding to detonate the devices early before the second could raise the alarm.

This deep dive has used information from articles and reports in Haaretz, The New York Times, and BBC News.