More than two years after the October 7 massacre, military censors have cleared for publication that the code used by Hamas terrorists to launch the attack was a sequence of emojis. According to assessments, the emoji string served as a signal for members of Hamas’ elite Nukhba force to equip themselves with Israeli SIM cards.
At 9 p.m. on Oct. 6, dozens of SIM cards were activated in the Gaza Strip, some of them Israeli. The Shin Bet security agency identified the activity and updated Military Intelligence via WhatsApp, which in turn notified the Southern Command. An initial discussion among intelligence officials began and continued until 11:30 p.m., during which it was noted that such activity occurs in Gaza every few weeks.
Additional indications later pointed to “movements” within Hamas. Military Intelligence provided a calming explanation at the time, suggesting Hamas feared an Israeli assassination the following week following a leak from a Cabinet meeting held days earlier. Another reassuring assessment was that the Nukhba force was maintaining routine activity.
About an hour later, further signs of unusual activity were received. The explanation given to decision-makers was that these were routine checks. Later, and for the first time that night, a localized irregularity was detected in Hamas’ rocket array. In retrospect, it became clear that commanders of initial Nukhba squads were already positioned in concealed locations near the border.
Three decisions were made: to ask the Air Force to shorten certain standby periods and increase Iron Dome readiness in the south; to recall some commanders from home but not battalion commanders who were on weekend leave; and to step up aerial surveillance toward morning using two unmanned aerial vehicles requested from the Air Force.
At 3 a.m., the Air Force received the requests and prepared to divert a surveillance and strike drone to Gaza by 6 a.m. At the request of Southern Command, the Air Force also moved an attack helicopter from a more distant standby location at Ramat David to Ramon Airbase, about 20 minutes from Gaza. Minutes later, senior Military Intelligence officials, including the head of the Research Division, were updated. The consensus was that the information did not justify issuing even the lowest-level alert but did warrant putting forces on heightened readiness and possibly reinforcing them slightly.
At that hour, a summary of the situation assessment was sent via distribution list to the operational phones of the military secretaries of the prime minister and defense minister. However, Benjamin Netanyahu and Yoav Gallant were not awakened. No one in the military verified that the assessment had been received and read.
At 4 a.m., the sole drone routinely operating over Gaza activated its camera for the first time that night at the request of Southern Command. No one in the military saw or heard the thousands of terrorists equipping themselves and preparing for a coordinated assault at 117 breach points along the border. Among the reasons cited: Unit 8200 had shut down its listening and monitoring capabilities against Hamas field operatives well before the war.
Minutes later, Southern Command chief Maj. Gen. Yaron Finkelman left his home in Yesud HaMa’ala in northern Israel to manage the situation from headquarters in Beersheba.
At 4:30 a.m., another call took place between IDF Chief of Staff Lt. Gen. Herzi Halevi and Finkelman regarding the warning signs that had not been deciphered. According to the investigation, Halevi said, “There are no certainties, anything is possible.” He raised potential scenarios such as a raid from the sea and instructed preparations for rapid response steps. In practice, however, no operational decision was made to raise the alert level. The head of the Operations Directorate, Maj. Gen. Oded Basyuk, was informed that the Shin Bet was deploying a Tequila team to the Gaza border area.