The IDF's Use of Data Technologies in Intelligence Processing

Executive Summary

The Israel Defense Forces (the 'IDF') continuously develops new tools and technologies in order to improve its processes and capabilities. As part of such efforts, the IDF utilizes modern technologies, such as big data processing. The same is done by militaries, and indeed any organization, worldwide.

The effort to constantly develop and improve processes extends to the IDF's intelligence processing capabilities. The IDF constantly seeks to improve intelligence gathering and analysis to make military activity more precise and effective.

Two tools used by the IDF have recently received significant media attention; ‘Habsora’ (‘the gospel’ in Hebrew) and ‘Lavender’. Media reports – relying on unidentified sources – have claimed that (a) these are systems that employ artificial intelligence to autonomously select targets for attack, and (b) they are used to attack targets inconsistently with international law. Both claims are completely false.

Rather, these are merely tools that help intelligence analysts cross-reference existing intelligence sources comprehensively and effectively. Their purpose is to focus the intelligence analyst on information that is likely to be relevant to his or her ongoing research. The identification of targets for attack is always done by the analyst, who is subject to clear and defined procedures while doing so (see Section A below for more detail on these procedures). Further, the target identification process is but one part of a broader targeting process, and intelligence officers who identify targets are not the ones who also decide to attack those targets. This broader targeting process is comprised of officers from different professions and results in a decision by an operational commander, which is subject to the rules of international law (see Section B below for more detail on the targeting process). The aforementioned tools serve the analyst as an aid in the intelligence distillation process; they cannot constitute the sole basis for identifying a target, let alone select or generate targets on their own (see Section C below for more detail on the tools themselves).  

In direct contradiction to what has been claimed in the media, these data analysis tools do not replace the intelligence analyst. Indeed, they help to facilitate accessibility to relevant information by the intelligence analyst, and result in intelligence analysis being more informed and precise, and less prone to errors. The IDF’s approach to these tools is an example of how to use modern data technologies in a responsible manner.

Section A: Regulation of Intelligence Processes in the IDF

The IDF's regulation concerning the use of intelligence to identify targets for attack require that all targets meet the international law definition for a lawful target. The primary source of this regulation is a robust standard operating procedure (SOP) of the IDF Intelligence Directorate. This SOP binds all intelligence officers in the IDF, is reviewed and updated as needed, and is an integral part of the training and education of relevant IDF personnel. IDF intelligence personnel are familiar with, and are required to operate according to, this SOP.

In accordance with international law, the SOP defines ‘military objectives’ eligible for attack as objects that by their nature, location, purpose or use make an effective contribution to military action, and persons identified as members of an organized armed group (like Hamas’s military wing) or who directly participate in hostilities.

The SOP and other related instructions provide clear requirements on when and how to designate an object or person as a target in accordance with these legal definitions. The basic premise of the SOP is that this identification process must always be done by a human intelligence analyst, who is trained and authorized to carry out such work. Another requirement is that a target identified by an intelligence analyst is subject to approval by an authorized intelligence officer. All tools and aids developed, acquired or utilized by the IDF as part of this process – including technological tools – are in furtherance of these regulations and subject to these requirements.

The IDF's intelligence regulations in force do not permit for any technologies to make target identification determinations in place of humans. These regulations also clearly require that targets proposed for attack accord with the relevant definitions under international law.

Section B: Target Identification as Part of an Entire Targeting Process

Target identification is only but one part of a wider targeting process, that results in a decision by an operational commander. The full targeting process includes assessments from different professionals, and is subject to additional IDF procedures concerning targeting actions. As part of this process, intelligence and other information regarding the target are presented to the relevant professionals for their analysis and input. The decision whether to attack is made by the commander after considering this information and input, as well as operational, policy, humanitarian, and legal considerations. A commander's discretion to approve an attack is always subject to the constraints of international law as well as to additional restrictions set out in binding IDF regulations and orders.

Once a target is approved for attack, IDF targeting procedures dictate the steps required in the targeting process before carrying out the attack. These include the obligations to apply feasible precautionary measures and conduct a proportionality assessment. In each attack, IDF procedures require conducting an individual assessment of the anticipated military advantage and the incidental damage expected to civilians and civilian objects. Such assessments are to be made in relation to each specific strike, and not categorically. The assessment of the collateral damage expected from a strike is done in view of all reasonably available information, in order to achieve the most accurate assessment possible.

In the IDF, operational commanders are those who approve attacks – not intelligence analysts, and certainly not technological tools. Further, the IDF's targeting procedures do not permit carrying out strikes on a category basis, without conducting individual assessments per strike.

Section C: The use of 'Habsora' and 'Lavender' by Analysts

Intelligence used to identify objects or persons as military targets may come from a range of sources – including geospatial intelligence (such as satellite and aerial imagery), signals intelligence (such as communications interceptions), human sources, multi-sensor platforms (such as aerial assets and ground-based sensors), enemy military documents and open-source information.

The amount and detail of such information may be vast, especially when considering adversaries such as Hamas, which maintains tens of thousands of militants and holds numerous military assets which it tries to embed and conceal within the civilian environment – in a manner often requiring a significant intelligence effort before determining that a person or an object is indeed a valid target. Israel is also facing additional militant organizations in Gaza, including Islamic Jihad, which maintains separate capabilities and manpower. As such, in order to fight effectively against these groups, the IDF must collect, manage, and review large amounts of data.

As a result, the IDF is required to process large amounts of intelligence in an effective manner. To do so, intelligence analysts may use different processes and tools, including technological tools, that help to compile and fuse different layers of intelligence in a comprehensive and more efficient manner than manually doing so. The use of these tools is based upon existing intelligence sources that have previously been gathered, assessed, and categorized by intelligence analysts. Their ultimate purpose is to focus the analyst on information that is likely to be relevant to his or her ongoing research.

One such tool is the 'Habsora'. As previously published by the IDF, this system was first utilized in an operational setting in 2021 during a previous operation against Hamas and other terrorist organizations in Gaza. It functions as a technical tool that fuses large amounts of data from across disparate datasets, and suggests to the intelligence analyst to focus his or her research on certain physical objects with greater potential of a military affiliation with the enemy. After considering the suggestions by the system and independently examining their basis and validity, in light of the sources the suggestion is based on, as well as additional information (to the extent additional sources are relevant) – the analyst can determine whether the object in question can be identified as a military objective in accordance with the aforementioned SOPs. Under these SOPs, a suggestion from 'Habsora' cannot be solely relied upon to identify a target without being thoroughly explored by the intelligence analyst, and approved by an authorized intelligence officer.

‘Lavender’ is a general-purpose database that organizes and cross-references layers of several existing intelligence sources. It serves as a technical tool to help efficiently organize and connect data points relating to operatives in terror organizations in the Gaza Strip. This database is regularly updated and its data verified. Contrary to claims that appeared in certain reports, this is not a list of confirmed military operatives eligible to attack. Its use complements existing processes for identifying enemy militants and distinguishing them from civilians during military operations. In other words, the inclusion of a person in the database cannot be solely relied upon to identify him as a military operative that can be attacked.

The use of these tools does not change the obligatory principles and rules in the Intelligence Directorate's SOP and related instructions. They do not generate orders for attacks. They do not generate new intelligence that could not otherwise be accessed by an intelligence analyst. They do not constitute the sole basis for determining targets eligible to attack – regardless of how accurate they are.

On the contrary, these tools improve the quality of the intelligence process outcome. They facilitate the accessibility of the analyst to relevant information, and help the analyst be more informed of the most up-to-date and relevant intelligence sources, making the analyses more precise. They reduce the risk of errors that may occur in intelligence analyses.

Both tools help intelligence analysts review and analyze existing information. They do not constitute the sole basis for determining targets eligible to attack, and they do not autonomously select targets for attack.

Conclusion

The IDF intends to continue using modern technology in a responsible and lawful manner, to provide both military and humanitarian benefits. As a modern, responsible, and professional organization, it is incumbent on the IDF to assess and utilize such technologies, in order to contend effectively and precisely with the contemporary threats that non-state armed groups pose. Doing so helps to both achieve the military aims more effectively and reduce the unintended harm and impact on civilians in the battlespace.