Organized crime in southern Israel is increasingly becoming a potential national security threat, as weapons smuggling, illicit financing, drone technology and suspected terrorist activity begin to overlap. What were once largely separate criminal and security concerns are now creating an infrastructure that could enable terrorist attacks against military installations and strategic facilities.
Recent developments in the Negev point to a troubling convergence of these threats. Weapons smuggled across the Egyptian border, drones used to transport illegal cargo and the arrest of Israeli citizens suspected of terrorism-related activity should not necessarily be viewed as isolated incidents. Together, they reveal how criminal money could finance terrorism, illegal weapons could reach ideologically motivated attackers and technology developed for smuggling could eventually be used to attack critical infrastructure.
The danger is not new. What has changed is the sophistication of the capabilities now available to criminal and potentially terrorist networks.
On Thursday, the Shin Bet security agency announced that five young Bedouin residents of Segev Shalom, a town near Beersheba, had been arrested in May and June on suspicion of planning to establish a local armed group inspired by Palestinian terrorist battalions operating in the West Bank.
According to the agency, the suspects intended to carry out terrorist attacks, with one allegedly designated to serve as the group's explosives specialist and prepare explosive devices.
The alleged plot reflects an attempt to adopt a decentralized model of terrorism in which small, locally organized cells operate without necessarily receiving instructions from a central command structure.
Such groups do not need tanks or large military formations. Access to illegal firearms, explosives, vehicles and operational expertise can be sufficient to carry out deadly attacks.
This is where organized crime and terrorism begin to intersect.
Weapons, explosives, vehicles, money and technical knowledge can move between criminal organizations and individuals pursuing ideological objectives. The infrastructure that supports one activity can also serve the other.
The concern extends well beyond a single alleged plot.
According to the Shin Bet, 72 residents of the Negev and southern Israel have been arrested since the beginning of the year on suspicion of security-related activity threatening the state. Of those, 67 are Israeli citizens, and indictments have been filed against approximately 50.
In July, a Bedouin resident of Segev Shalom was arrested on suspicion of planning an attack at a nightclub in Beersheba while maintaining contact with Islamic State members.
Another case illustrates how weapons circulating in the criminal underworld can reach terrorists and be used in deadly attacks.
On Thursday, nearly two years after the October 2024 terrorist attack at Beersheba's central bus station that killed Border Police officer Shira Chaya Suslik, indictments were filed against three Negev residents accused of helping purchase the handgun and ammunition supplied to the attacker.
According to the indictment, the defendants were aware of the attacker's extremist ideology and knew the weapon might be used to carry out a terrorist attack.
Investigators also uncovered suspicions that some of the defendants were involved in additional weapons trafficking with other individuals in the Negev.
In that case, a weapon obtained through criminal channels ultimately reached a terrorist and was used in an attack that killed an Israeli security officer.
It is essential, however, to avoid sweeping generalizations. Israel's Bedouin community is not a community of terrorists, and the overwhelming majority of its members have no connection to these activities.
Precisely because of this distinction, law enforcement and security operations must be focused, determined and directed at the specific individuals and networks linking organized crime, smuggling, terrorist financing and security threats.
The danger is growing
The broader picture emerging in southern Israel includes drones crossing the Egyptian border with firearms and advanced weapons, large sums of illicit money, organized criminal activity and suspected attempts to connect criminal networks with terrorism.
For years, much of the organized crime in the Negev was treated primarily as a financial and law enforcement problem.
But money generated through drug smuggling, extortion and protection rackets can also be used to purchase weapons, explosives and other equipment.
Criminal profits can therefore become a potential source of terrorist financing.
The movement of money presents another challenge. Informal transfer networks and cryptocurrencies can enable funds to change hands rapidly, sometimes within minutes, while making it more difficult for authorities to trace their origins.
These financial channels could allow criminal and terrorist networks to conceal transactions and finance purchases that threaten not only the personal safety of Negev residents but Israel's national security.
Drones have further transformed the threat.
In Britain, authorities have recently investigated a suspected Iranian-linked plot targeting RAF Fairford, an air base used by American forces, amid concerns about a possible drone attack.
The implications for Israel are clear. A drone can be used to smuggle weapons, conduct surveillance or attack strategic infrastructure.
Consider the challenge of defending Nevatim Air Base in southern Israel against an explosive-laden drone launched from somewhere in the surrounding Negev. Such a scenario would be difficult to prevent and could place sensitive military facilities, including aircraft hangars, at risk.
In the past, smuggling generally required a physical route, a vehicle and someone to carry the goods across the border. Drones have turned that border into a three-dimensional vulnerability.
The expertise developed by criminal organizations in operating commercial drones over long distances, delivering cargo and navigating electronic interference could eventually be used for military or terrorist purposes.
Someone capable of guiding a drone carrying illegal cargo into a yard in Segev Shalom could potentially employ similar skills against strategic infrastructure.
The transition from smuggling to attack does not necessarily require a technological breakthrough. In some cases, the only thing that changes is the objective.
That is what makes the growing overlap between organized crime and terrorism so dangerous.
Criminal organizations may already possess the logistics, financial resources, weapons and technical capabilities that terrorist groups would otherwise need to develop independently.
The gap between a criminal operation and a terrorist attack may ultimately come down to intent.
Israel needs a coordinated response
Confronting this threat requires an integrated security and law enforcement campaign in southern Israel, rather than a series of disconnected responses to individual incidents.
A permanent interagency task force should combine criminal intelligence, national security information and financial investigations into a single operational picture.
The Israel Police, Shin Bet, Israel Defense Forces, Israel Tax Authority and Israel Money Laundering and Terror Financing Prohibition Authority should work together through a coordinated framework.
Each institution has a distinct responsibility.
The Shin Bet should lead the national security assessment, while police investigate organized crime and criminal networks. The IDF must address border security and the protection of strategic military assets, while financial enforcement agencies follow illicit money flows and identify the mechanisms that allow criminal profits to reach dangerous actors.
The goal should not simply be to arrest individual smugglers or seize weapons after they have entered Israel. Authorities need to identify the networks that connect financing, transportation, weapons trafficking and suspected terrorist activity.
Cooperation with Egypt must also be strengthened.
If weapons are entering Israel from Egyptian territory, Israeli authorities cannot limit their response to intercepting shipments after they cross the border.
Egyptian and Israeli security agencies should intensify intelligence sharing, identify smuggling routes and the individuals operating them, and maintain sustained pressure on the infrastructure supporting cross-border trafficking.
The objective must be to dismantle the smuggling networks themselves, not merely confiscate individual shipments.
The greatest risk is becoming accustomed to the warnings
Perhaps the greatest danger is that Israel will gradually become accustomed to these developments.
Another security announcement, another weapons seizure, another arrest, another indictment. Each receives brief attention before the country moves on to the next crisis.
But when similar threats repeatedly emerge in the same geographical area, it is no longer reasonable to examine every incident in isolation.
A weapons smuggling operation, an illegal drone flight, a criminal financing network and an alleged terrorist cell may appear to be separate cases. They could also be different links in the same chain.
That does not mean every criminal organization is a terrorist organization or that every smuggler intends to carry out an attack. It means authorities must recognize that capabilities developed in the criminal world can be exploited for terrorism.
And the response must remain carefully targeted. The overwhelming majority of Bedouin citizens are not involved in terrorism or these criminal networks. Effective enforcement should protect their communities as well as the wider country by focusing on those responsible.
Israel cannot afford to wait for the next suspected terrorist battalion, the next deadly attack or the next drone approaching an air force base before connecting the warning signs.
The intelligence, criminal and financial information must be brought together now, before the relationship between smuggling, organized crime, terrorist financing and threats to strategic infrastructure develops into a fully operational terrorist network.