BEIRUT (Reuters) – Coded messages. Landline phones. Pagers. Following the killing of senior commanders in targeted Israeli airstrikes, the Iran-backed Lebanese militant group, Hezbollah, has been using some low-tech strategies to try to evade its foe's sophisticated surveillance technology, informed sources told Reuters.
It has also been using its own tech – drones – to study and attack Israel's intelligence gathering capabilities in what Hezbollah's leader, Sayyed Hassan Nasrallah, has described as a strategy of "blinding" Israel.
The sides have been trading fire since Hezbollah's Palestinian ally in the Gaza Strip, Hamas, went to war with Israel in October. While the fighting on Lebanon's southern border has remained relatively contained, stepped-up attacks in recent weeks have intensified concern it could spiral into a full-scale war.
Tens of thousands of people have fled both sides of the border. Israeli strikes have killed more than 330 Hezbollah fighters and around 90 civilians in Lebanon, according to Reuters tallies. Israel says attacks from Lebanon have killed 21 soldiers and 10 civilians.
Many of Hezbollah's casualties were killed while participating in the near-daily hostilities, including launching rockets and explosive drones into northern Israel.
Hezbollah has also confirmed the deaths of more than 20 operatives - including three top commanders, members of its elite Radwan special forces unit and intelligence operatives - in targeted strikes away from the frontlines.
Israel's military said it was responding to an unprovoked attack from Hezbollah, which began firing at Israeli targets the day after Hamas attacked Israel on Oct. 7. The Israel Defense Forces (IDF) said in a statement to Reuters that they were striking military targets and taking "feasible precautions in order to mitigate harm to civilians."
"The success of these efforts hinges on the IDF's ability to gather thorough and precise intelligence on Hezbollah's forces, its leaders, the organization's terrorist infrastructure, their whereabouts and operations," the statement said.
The IDF did not answer questions about its intelligence gathering and Hezbollah's countermeasures, citing "reasons of intelligence security".
As domestic pressure builds in Israel over Hezbollah's barrages, the IDF has highlighted its ability to hit the group's operatives across the border.
On a tour of Israel’s Northern Command, Defence Minister Yoav Gallant pointed to pictures of what he said were slain Hezbollah commanders and said 320 “terrorists” had been killed as of May 29, including senior operatives.
Electronic surveillance technology plays a vital role in these strikes. The IDF has said it has security cameras and remote sensing systems trained on areas where Hezbollah operates, and it regularly sends surveillance drones over the border to spy on its adversary.
Israel's electronic eavesdropping - including hacking into cell phones and computers - is also widely regarded as among the world's most sophisticated.
Hezbollah has learned from its losses and adapted its tactics in response, six sources familiar with the group’s operations told Reuters, speaking on condition of anonymity to discuss sensitive security matters.
Cell phones, which can be used to track a user's location, have been banned from the battlefield in favour of more old-fashioned communication means, including pagers and couriers who deliver verbal messages in person, two of the sources said.
Hezbollah has also been using a private, fixed-line telecommunications network dating back to the early 2000s, three sources said.
In case conversations are overheard, code words are used for weapons and meeting sites, according to another source familiar with the group's logistics. These are updated nearly daily and delivered to units via couriers, the source said.
"We're facing a battle in which information and technology are essential parts," said Qassem Kassir, a Lebanese analyst close to Hezbollah. "But when you face certain technological advances, you need to go back to the old methods - the phones, the in-person communications … whatever method allows you to circumvent the technology."
Hezbollah's media office said it had no comment on the sources' assertions.
LOW-TECH COUNTERMEASURES
Security experts say some low-tech countermeasures can be quite effective against high-tech spying. One of the ways that al Qaeda's late leader, Osama bin Laden, evaded capture for nearly a decade was by disconnecting from the internet and phone services, and using couriers instead.
"The simple act of using a VPN (virtual private network), or better yet, not using a cell phone at all, can make it much harder to find and fix a target," said Emily Harding, a former CIA analyst now at the Center for Strategic and International Studies think tank in Washington.
"But these countermeasures also make Hezbollah's leadership far less effective at communicating rapidly with their troops."
Hezbollah and Lebanese security officials believe Israel has also been tapping local informants as it zeroes in on targets. Lebanon's economic crisis and rivalries between political factions have created opportunities for Israeli recruiters, but not all informants realize who they are speaking with, three sources said.
On Nov. 22, a woman from south Lebanon received a call on her cell phone from a person claiming to be a local official, according to two sources with direct knowledge of the incident. Speaking in flawless Arabic, the caller asked whether the family was home, the sources said. No, the woman replied, explaining they had travelled to eastern Lebanon.
Minutes later, a missile slammed into the woman's home in the village of Beit Yahoun, killing five Hezbollah fighters including Abbas Raad, the son of a senior Hezbollah lawmaker and a Radwan member, the sources said.
Hezbollah believes Israel had tracked the fighters to the location and placed the call to confirm whether there were civilians present before launching the strike, they told Reuters without disclosing further details.
Israel's military said at the time that it struck a number of Hezbollah targets that day, including a "terrorist cell".
Within weeks, Hezbollah was publicly warning supporters via the affiliated Al-Nour radio station not to trust cold callers claiming to be local officials or aid workers, saying Israelis were impersonating them to identify houses being used by Hezbollah.
It was the first of a series of strikes targetting key Hezbollah operatives in Lebanon. Others killed include Wissam al-Tawil, Taleb Abdallah and Mohammed Nasser, commanders who played leading roles directing Hezbollah's operations in the south. Saleh al-Arouri, deputy head of Hamas, was also killed while attending a meeting in the capital, Beirut.
Hezbollah began suspecting that Israel was targeting its fighters by tracking their cell phones and monitoring video feeds from security cameras installed on buildings in border communities, two sources familiar with the group's thinking and a Lebanese intelligence official told Reuters.
On Dec. 28, Hezbollah urged southern residents in a statement distributed via its Telegram channel to disconnect any security cameras they own from the internet.
By early February, another directive had been issued to Hezbollah's fighters: no mobile phones anywhere near the battlefield.
"Today, if anyone is found with their phone on the front, he is kicked out of Hezbollah," said a senior Lebanese source familiar with the group’s operations.
Three other sources confirmed the order. Fighters began leaving their phones behind when they carried out operations, one told Reuters. Another, the Lebanese intelligence official, said Hezbollah would sometimes perform surprise checks on field units to see if members had phones on them.
Even in Beirut, senior Hezbollah politicians avoid bringing phones with them to meetings, two other sources said.
In a televised speech on Feb. 13, Nasrallah warned supporters that their phones were more dangerous than Israeli spies, saying they should break, bury or lock them in an iron box.
Hezbollah has also taken steps to secure its private telephone network following a suspected breach by Israel, according to a former Lebanese security official and two other sources familiar with Hezbollah's operations.
The vast network, allegedly financed by Iran, was set up around two decades ago with fibre optic cables extending from Hezbollah's strongholds in Beirut's southern suburbs to towns in south Lebanon and east into the Bekaa Valley, according to government officials at the time.
The sources declined to say when or how it had been penetrated. But they said Hezbollah telecommunications specialists were breaking it into smaller networks to limit the damage if it is breached again.
"We often change our landline networks and switch them up, so that we can outrun the hacking and infiltration," the senior source told Reuters.
DRONE SURVEILLANCE
The group has also been touting its ability to collect its own intelligence on enemy targets and attack Israel's surveillance installations using its arsenal of small, homemade, unmanned aerial vehicles (UAVs).
On June 18, Hezbollah published a nine-minute excerpt of what it said was video gathered by its surveillance aircraft over the Israeli city of Haifa, including military installations and port facilities. The Israeli Air Force said air defense systems had detected the drone, but a decision was made not to intercept it because it had no offensive capabilities, and doing so could endanger residents.
Another video released by Hezbollah included aerial pictures it said it had collected of a massive Israeli observation balloon known as Sky Dew on the day before it was hit in a May 15 drone attack.
Reuters could not verify the authenticity of the images. But IDF spokesperson Daniel Hagari said at the time that the airship, used to detect incoming rockets, was hit while on the ground at a military base in northern Israel. He said there were no casualties and no impact on the military’s "aerial situational awareness capability" in the area.
Hezbollah says it has also shot down or taken control of half a dozen Israeli surveillance drones, including Hermes 450, Hermes 900 and SkyLark UAVs. Hezbollah operatives disassemble the drones to study their components, according to two of the sources.
Israel has confirmed that five air force drones were downed by surface-to-air missiles while operating over Lebanon.
However, the IDF said Hezbollah's declarations "should be noted with reservation," saying the group aims to instil fear in Israelis.
Nicholas Blanford, a Beirut-based security consultant who has written a history of Hezbollah, said the group's "awareness and wariness" of security breaches was at an all-time high.
"Hezbollah has had to tighten up its security far more than it needed to do in earlier conflicts," he told Reuters.
Israel retains a technological advantage, however, Blanford said.
On the afternoon of July 3, a car driving through a Lebanese coastal village more than 20 km (12 miles) north of the Israeli border burst into flames, witnesses said.
The Israeli military said it had eliminated Nasser, who it said commanded a unit that is attacking Israel from southwestern Lebanon. His death came less than a month after the strike that killed Abdallah, who commanded operations in the central region of the southern border strip.
Hezbollah acknowledging both killings and in response launched some of its biggest barrages to date into northern Israel.