Pattern of Life

Inside Modatz, the secret Hamas unit that spent two years turning stolen camera feeds, hacked TikToks, and honeytrapped soldiers into a house-by-house map of Israeli life along the Gaza border.

During the attack on 7 October, the attackers bypassed a house on the edge of Mefalsim, a kibbutz near the Gaza border. Their notes said the family was away for the weekend. Details like this were the product of nearly two years of patient work by a Hamas intelligence unit called Modatz.

Since his days with al-Majd, Sinwar had understood the value of intelligence. After the 2021 war, he placed Ayman Nofal – a longtime comrade and close associate of Deif – in charge of Hamas’s Military Intelligence Department, known to the Israelis as Modatz. Nofal was something of a hero in Gaza. In 2011 he had escaped from an Egyptian prison where he had spent the previous three years, returned to Gaza, and continued to rise through the ranks of Hamas – becoming a member of its General Military Command and head of its central command, responsible for the defense of Gaza City. It was Nofal who, as head of Hamas’s air command, pioneered the organization’s drone program. He was killed in an Israeli airstrike ten days after the 7 October attack. Three hundred other people died in the same strike – a cost in civilian lives that the Israelis deemed worth removing Nofal from play.

At Sinwar’s direction, Nofal expanded Modatz from several hundred to two thousand members and transformed it into an organization whose capabilities would stun the Israelis. Modatz was organized into five functional areas: observation, cyber, signals intelligence, open-source intelligence, and agent handling. The department’s expertise lay in accumulating vast numbers of seemingly trivial details, layering them into a written database, and correlating each new item with hundreds of others already logged. The result was a granular picture of the enemy’s pattern of life in the Gaza pocket.

A Modatz analyst might begin with an aerial photograph of Re’im Base from Google Earth. Gaza workers employed in Israel would then be tasked with reporting on the shoulder patches of soldiers seen patrolling the area. More information would be gleaned from TikTok posts shared by soldiers on the base. Multiple sources would be fused into a single intelligence picture, disseminated to Hamas units in the form of maps, aerial photographs, manuals, and operational orders.

Nofal sent operatives to Turkey and Lebanon where they met instructors from Iran’s Quds Force and Hizbollah, who provided training in surveillance, collection, and cyber operations. Modatz built server farms in the tunnel network using equipment purchased in Israel, where a large second-hand server market had been flourishing for years.

The cyber division scanned Israeli IP address ranges for the security cameras that monitored the perimeter fences, security facilities, and sensitive areas of kibbutzim near the Gaza border – precisely the areas of greatest interest to Hamas. Hamas hackers circumvented the cameras’ security mechanisms and took them over. After breaching them, Modatz personnel could view uninterrupted footage broadcasting directly from towns, roads, and homes within Israel.

Some techniques were less sophisticated but equally effective. Modatz operators ran honeytrap operations against IDF soldiers. An attractive profile would contact a soldier on social media, and as the relationship developed, the requests would escalate: the soldier might be asked to film himself, share details of his military role, or download a chat application that turned out to be malware. Modatz maintained a team dedicated to building malicious code into fake apps to enable phone intrusion.

One of Modatz’s most effective capabilities was visual collection. After the 2014 conflict, Hamas paved a road parallel to the border axis and built observation towers with direct lines of sight into Israeli territory. Its teams also set up posts on tall buildings in the strip, allowing them to see into kibbutzim and IDF checkpoints around the clock. Armed with powerful binoculars and cameras, they built a detailed operational picture: how many soldiers manned each outpost, when they were relieved, the size and frequency of patrols, how long it took the reaction force to arrive. By late 2021, UAVs had become a regular feature, hovering over the strip and providing oblique footage of the Israeli heartland.

Hamas’s signals intelligence capability was rudimentary but effective. Modatz regularly listened in on open IDF communications networks, especially in the training areas of the western Negev, just a few kilometers from the strip. Tze’elim Base, the largest IDF ground forces training center and the area where the ground operation for Gaza was subsequently rehearsed, was well within range. The technology at Hamas’s disposal was essentially frequency scanners – but since the IDF used unencrypted communications for training, these were effective enough.

Modatz recruited collectors among the thousands of Palestinians who commuted to Israel for work, tasking them with reporting on IDF facilities and kibbutz security measures. Some were equipped with SIM cards and photography equipment. Hebrew-speaking analysts scoured Israeli media for useful information. The department published a weekly intelligence report with summarized translations of articles from the Israeli press that week – covering military matters such as the pace of equipping IDF brigades with defense systems and delays in building the fence on the Egyptian border, as well as domestic politics, recruitment data from schools, the public mood, and even a sexual harassment case involving a well-known rabbi.

Perhaps the single most valuable source of information about the IDF came from TikTok. Uploading videos from within army bases – and even from command posts along the Gaza Strip – had apparently become a trend the IDF had stopped trying to fight. Until 7 October, the Nahal Oz command post had an official TikTok account. It was not the only one.

Over eighteen months, Modatz developed a sophisticated understanding of how the Israeli military operated: command and control hubs, communications nodes, the location of specific units, and the time it would take for reinforcements to arrive. In the kibbutzim targeted for attack, Hamas amassed astonishingly detailed information. In Mefalsim, a Shin Bet officer told me, the attackers knew the names and locations of residents, the number of family members in each household, and, in more than one case, the schedules of specific individuals — the same kind of detail that led them to skip the house on the kibbutz’s edge.

“They knew everything,” Yarden Reskin, a member of Mefalsim’s volunteer security force, said. “They knew where are the gates, they knew where are the generators, they knew where is the armory, they knew basically how many of us on the security team… they had very, very good intel.”¹

By late 2022, Modatz had assembled a database for the planners with more than 17,000 images – satellite pictures, drone footage of Israeli cities and landscapes, and photographs gleaned from social media.

The training continued into 2023. Hamas was thought to have around 30,000 fighters in the Gaza Strip, but only a fraction – an estimated 3,000 at most – participated in the 7 October attack, and as many as half of these may have been hangers-on. From published accounts and footage of the training, it appears that exercises involved several hundred fighters at a time, perhaps up to a thousand at most. Only the core leadership was ever aware of the ultimate plan. Brigade commanders were given their own portion of it and no more. Hamas’s interest in involving Islamic Jihad and other factions had more to do with securing broad support within Gaza than with bolstering its own numbers.

In the months preceding the attack the plan was refined into four phases. Phase one would begin with a massive rocket barrage towards Israeli population centers as far away as Jerusalem – some 3,000 rockets set aside for the task, twice as many as had been fired during the entire five weeks of fighting in 2014. Simultaneously, Eagle Squadron would launch thirty motorized paragliders from a makeshift airstrip in Khan Yunis, carrying fighters across the border fence to secure terrain on the far side. A handful of single-passenger gliders would remain airborne to provide early warning of enemy counter-attack and to assist with command and control.

Phase two began once the glider-borne fighters were on the ground: breaching teams from Deif’s commando unit would blow holes in the border fence, allowing the initial assault force – mounted on motorcycles and four-wheel drives – to speed through.

To cross into Israeli territory, the assault force would have to pass through three barriers. The outermost was a simple barbed-wire fence without sensors. A road separated it from the second fence, which was fitted with sensors. Beyond that was a hundred-meter buffer zone with ground-mounted motion sensors, then a third fence, also fitted with sensors, its watchtowers spaced every two kilometers. The towers were unmanned but equipped with remote-control machine guns and high-visibility cameras connected to border security posts several kilometers away. Beneath the fence ran an underground slurry wall extending several meters into the ground and also mounted with sensors.

The breaching teams would not waste explosives on the outer fence. Instead, they would use bulldozers – pre-staged near the border the night before – to knock down sections. But first, something had to be done to blind the Israeli cameras. This was the drone unit’s job. For over a year they had practiced flying explosive-laden quadcopters into observation towers and security cameras along designated portions of the second fence, the operators positioned in towers on the Gaza side with a clear view of the target area.

Phase three called for a thirty-man unit from the assault force to attack the IDF’s southern Gaza headquarters at Re’im and jam its communications, preventing personnel from contacting commanders or each other. Another team was directed to attack Ashkelon prison and free Palestinian prisoners. A third would strike the Zikim training base south of Ashkelon, with a fourth team of thirty Nukbah naval commandos landing at Zikim beach and converging on the base in support. Both teams attacking the base carried a follow-on mission of supporting the prison break.

Simultaneously, other teams would attack the kibbutzim at Be’eri, Kfar Aza, Nir Oz, Netiv Haasara, and Alumim. Their mission in phase four was to take hostages and bring them back to Gaza.

In early 2023, Sinwar, Deif, and Nofal briefed the Qassam Brigade commanders on the overall plan without specifying a date. They were sworn to secrecy. Not even their battalion commanders were to know the entire plan – only those portions for which they were directly responsible. Training continued throughout the summer, each commander rehearsing their part of the plan over and again.

Despite the overall effort at secrecy, there were some astonishing breaches of operational security. On 10 September 2023, Hamas’s joint committee published images on its Telegram channel of men in military uniforms carrying out surveillance of installations along the Gaza barrier. Fighters were filmed riding in the same type of white Toyota pickup trucks seen roaming through southern Israel the following month. The video showed gunmen raiding mock buildings, firing at dummy targets, storming a beach from a boat, and diving underwater.

Two days later, the fourth Strong Pillar exercise was staged. The Palestine Chronicle described scenes that now look familiar: Palestinian fighters destroying targets at sea with homemade rockets, assaulting hypothetical enemy positions, and moving armored vehicles, ambulances, and paramedic teams across mock terrain. By then, every tactic that would be deployed on 7 October had been rehearsed.

It was around this time that Sinwar and Deif settled on the date. Simchat Torah, the Jewish holiday celebrating the conclusion of the annual cycle of Torah readings, fell between sunset on 6 October and nightfall on 7 October 2023. On religious holidays, the IDF traditionally operated a liberal leave policy, allowing most soldiers to return home to celebrate with their families. It was also a Saturday – the traditional Jewish day of rest – meaning those who remained on base would be observing holiday routine. Sinwar and Deif shared this decision with no one.

On 4 October, they gave warning orders to Brigade commanders: be prepared to move with a few hours’ notice, but no date specified. The secrecy extended even to Hamas’s political leadership. Ismail Haniyeh and his deputy Saleh al-Arouri were informed that an attack was imminent but received no specific details or timing until a few hours before the assault, when Sinwar directed them to go into hiding.

At midnight on 6 October, Sinwar gave the order to attack. In the early hours, as a near-full moon slanted down toward the black sea, hundreds of fighters moved quietly into their attack positions close to the border.

A note on what follows: the passages describing Ismail El Masry and his comrades are semi-fictional. The broader events — the mobilization, the routes of attack, the timing, the units involved — are drawn from Hamas’s own captured attack plan, published reporting, and interviews with Shin Bet officers who investigated the assault. The details of El Masry’s own experience — his thoughts, his conversations, the texture of those hours — are my own reconstruction, informed by interviews with Palestinian relatives of Hamas members.

Among them was Ismail El Masry – the boy who had been pulled from the rubble of his family’s home in 2021. The previous summer, El Masry, now eighteen, had volunteered for the Nukbah and completed the demanding six-week selection course, graduating at the top of his intake. Now he was part of a ten-man team – a firqa – moving through the darkened streets toward their assembly area near the border fence. They were all armed with AK-47s and wore military-style chest rigs stocked with extra magazines over black T-shirts; some carried their rifles pointed downward, as they had been taught. El Masry’s weapon was slung across his back because he and six of his comrades were pushing motorcycles – lightweight Chinese models common in the strip.

Nervous but elated, he plodded after his team leader to the assembly area – a football field hidden from Israeli border cameras by an adjacent apartment block. The team came to a halt in its shadow and El Masry put the bike on its kickstand. He had fired his weapon just twice during training, aiming at cardboard targets crudely marked with the outlines of Israeli soldiers. Now he checked it for the hundredth time – pulling back the bolt far enough to see the brass rim of the round lodged in the chamber.

Excerpt from my forthcoming book, The War in Gaza — due out in early 2027.