Strategic Assessment

Keywords: Counterintelligence, counter-subversion, ISA (Israel Security Agency), strategic surprise, weak signals, Israel, Palestinians, predictable surprise, diffused surprise.

Introduction

For more than three decades following Israel’s conquest of Judea, Samaria, and Gaza in 1967, tensions in those areas did not affect the relationship between Jews and Arabs within the rest of Israel; not even during the first Intifada in 1987. In contrast, the timing of the Second Intifada in October 2000 was not only unexpected, but the rapid and intense escalation directly affected relations within the Green Line. )Ben Ari, 2020; Lavi, 2010). The riots quickly crossed the 1967 border and Israel was surprised by the active solidarity of Israeli Arabs with the Palestinians in the territories (Intelligence Heritage Center, 2005). Lasting more than a week, Israel experienced the most severe rioting by Israeli Arabs since the establishment of the State in 1948. It had been a strategic surprise (Zaken, 2021; State Comptroller of Israel, 2022) for the government, the Israel Defense Forces (IDF), and especially for the ISA (Israel Security Agency, also known as Shabak), which found it difficult to restore calm and return to the status quo ante (Barnea, 2022). After order had been restored, the general assessment in Israel was that it was a one-time event (Feldman 2001).

More than two decades passed until the next outbreak of major internal Arab Israeli riots in Israel. In May 2021, a sequence of violent incidents by Israeli Arabs took place in several cities. In Jerusalem, the riots erupted amid unrest that had intensified during the month of Ramadan and resulted in Muslim clashes with police on the Temple Mount (Ben Menachem, 2022). Hamas, the Palestinian Islamic Resistance Movement in Gaza, then sent an ultimatum demanding that Israel evacuate its forces from the Temple Mount and Sheikh Jarrah, a neighborhood in East Jerusalem. When the ultimatum expired on May 9, which was Jerusalem Day, Hamas launched a barrage of rockets from the Gaza Strip toward the Jerusalem area and other cities. In response, Israel launched Operation Guardian Walls and attacked Hamas targets in Gaza. Beginning on the night of May 10, the riots spread from Jerusalem to several cities in Israel, primarily mixed cities, including Acre, Lod, Jaffa, and Ramle, where Jews and Muslims had been living side by side. It took ten days for quiet to be restored. In a similar reaction to events of the Second Intifada when the riots quickly crossed the Green Line into Israel, the Israel Security Agency (ISA) and the Israeli security establishment were once again taken by surprise.

This article has three core sections: the first presents a discussion of Israel’s internal security challenges, an examination of the strategic surprises related to internal security, and a study of the counterintelligence aspects relevant to the case under discussion (Barnea, 2020). The second section discusses the obstacles to assessing the moods and feelings of the Israeli Arab minority towards the State of Israel and their intentions of changing the internal political status quo. The last section examines the available intelligence before the mass demonstrations in May 2021 and what could have been done to curb them in the early stages.

One important methodological note is that the May 2021 riots will be studied using two alternative theoretical approaches. First, they will be examined as a possible diffused surprise (Barnea, 2019), a spontaneous phenomenon that gradually develops and surprises the intelligence establishment and government when it occurs. Alternatively, we will also consider the May events as a predictable surprise (Watkin and Bazerman, 2003) due to the “weak signals” that accumulated but seem to have been ignored. Examining May 2021 as two different kinds of surprises is a critical innovation of this paper. The paper further discusses the challenge of detecting “weak signals” (Ansoff, 1975; Schoemaker and Day, 2009; Wohlstetter, 1962) and interpreting them as early as possible to prevent an unexpected attack. We argue that the ISA should reconsider its early warning systems regarding the possibility of broad, extreme political subversion that may be associated with terrorism in a complex security situation. Special capabilities must be developed to better understand the ebb and flow of latent sentiments that are rooted in both deep frustration and alienation of significant parts of the Arab population in Israel.

It is important to note that this paper addresses events up to and including August 2023, which is before Hamas breached the Israeli border and massacred and kidnapped Israeli citizens and others on October 7, 2023. Nevertheless, the subject of intelligence organizations’ difficulty in dealing with strategic surprises is chillingly relevant to what happened two and a half years after the events analyzed in this article.

Israel’s Internal Security Challenges

The Arab minority in Israel numbers around two million people, which is about 20 percent of the total population of the country. Most (83%) are Sunni Muslims, and they are spread throughout Israel, mainly in the north of the country, in the south, and also on its eastern side. Several Jewish cities in Israel can be called “mixed cities,” including Jerusalem, Jaffa, Haifa, Acre, Ramle, Lod, Maalot Tarshiha, and Nof Hagalil since they have a significant percentage of Arab residents. A few examples: Arabs make up 30% of the 81,000 residents in Lod, 33% of the 60,000 residents in Jaffa (Avgar et al., 2021) and 33% of the 50,000 residents in Acre. The Arabs in these mixed cities suffer from poor housing conditions, low socioeconomic status, and housing policy discrimination (Shmaryahu-Yaron, 2022).

Tensions between Jews and Arabs in Israel can be ascribed to two primary reasons. The first is Arab resentment dating back to Israel’s War of Independence in 1948, when the majority of Palestinian Arabs were permanently displaced. The second reason is Israeli Arab identification with the approximately 5 million Arabs in the Palestinian Authority, who live in Gaza (from which Israel withdrew its forces in 2005) and Judea and Samaria, which has been under Israeli military occupation since 1967. In recent years, the Arab minority in Israel has expanded its political influence, mainly by increasing its representation in the Knesset. But the Jewish nation-state law (The Jewish Nation-State Law, 2018; Wootkliff, 2018), which declares that Israel is the nation-state of the Jewish people and anchors the Jewish identity of the state in its formal constitutional structure, has dramatically increased Arab feelings of alienation. The internal strategic threat to the State of Israel raises the question of whether Israel’s concept of national security is still appropriate for complex situations in which Israel is attacked simultaneously from outside and inside, as happened in the May 2021 riots.

A few remarks regarding Israel’s historical concept of national security are critical to understanding the background to the current tension between Jews and Israeli Arabs. In August 1953, David Ben-Gurion, then Prime Minister and Defense Minister, withdrew from politics and devoted his time to studying Israel’s security needs. He wrote, “This examination requires one to forget what one knows, to drop one’s prejudices and to see everything anew” (Ziv-Av, 2023). The result was an 18-page document brought before the government, which to this day, constitutes the basic outline of Israel’s security concept. Among its tenets are taking the war to enemy territory, maintaining the IDF as a popular army (the bulk of its forces consists of reserves), and taking the initiative immediately at the beginning of a war (Harkabi, 1999). This security concept was created in order to deal with the threat, in 1953, of an attack by an Arab coalition on several fronts; it was necessary, at the time, to find the proper response to remove this threat (Bar-Joseph, 2000). It should be noted that Ben-Gurion’s security conception was not limited to the military domain but also addressed security issues in internal areas of Israeli life, such as society, economy, science and technology (Shelach, 2015).

To Ben-Gurion’s “security triad” of deterrence, early warning, and decisive victory, a fourth component, defense, was added by the Meridor Committee in 2006. Prime Minister Ariel Sharon appointed this committee, headed by Member of Knesset Dan Meridor, to revise Israel’s security paradigm. However, the Meridor report does not reference Israel’s internal security challenges and in a 2017 review of the Committee’s report, a decade after its submission, the authors noted that while a significant portion of the principles of national security remained relevant, there was a vital need for an updated and relevant national security analysis to be formulated as soon as possible (Meridor and Eldadi, 2019).

The important point here is that Israel’s national security conception does not include any internal situations, such as civil war. Barbara Walter, an American political scientist and professor, whose study covers a number of countries, believes that a civil war today will not resemble America of the 1860s, Russia in the 1920s, or Spain in the 1930s. She identifies crucial risk factors, including democratic backsliding, factionalization, and the politics of resentment. According to Walter, a civil war will begin with sporadic acts of violence and terror accelerated by social media. It will develop stealthily and leave the government wondering how it could have been so blind (Walter, 2022). The challenge, then, lies in detecting threats early and stopping them as soon as possible. It is important to note that Walter’s analysis does not consider using the theory of weak signals, which may provide intelligence agencies an early warning of possible civil riots.

In Israel, as in other Western democracies, a state intelligence service is responsible for counterintelligence, namely the Israel Securities Authority (ISA), also known as the Shin Bet or General Security Service. In the early 1950s, the ISA was responsible for counterintelligence operations: counterterrorism, counterespionage, and countersubversion. This was given formal legal validation with the passing of the General Security Service (ISA) Law in 2002, in which clauses 7 (a) and (b) state: “The Service shall be in charge of the protection of State security and the order and institutions of the democratic regime against threats of terrorism, sabotage, subversion, espionage and disclosure of State secrets” (General Security Service Law, 2002). A comparative analysis of counterintelligence organizations in other Western democracies shows that the ISA’s fields of responsibility are the broadest. (Barnea, 2017).

While the General Security Service Law of 2002 mentions the ISA’s role in preventing subversion, this term is insufficiently defined. This leaves the door open to interpretation by the ISA itself, without authorization from any other body, to define individuals and organizations as “subversive.” The result has been the wide use of covert tools provided to the ISA to protect state security, including wiretapping (without judicial oversight) and relatively free access to communications data. Even though the ISA deals primarily with counterterrorism and counterespionage, the issue of defining subversion has been a topic of public debate due to the danger that the regime could exploit the ISA’s powers in a way that may jeopardize democratic values (Margalit, 2018).

A Close Look at Strategic Surprises and Counterintelligence

The Outbreak of the October 2000 Riots

While there had been warnings about the potentially explosive situation among Israeli Arabs some six months before the riots broke out, they did not prevent opposition leader Ariel Sharon from going up to the Temple Mount on September 28, 2000. This visit to the Muslim holy site, Al-Aqsa, was perceived by the Palestinians as a provocation and sparked the Second Intifada, which quickly erupted in Judea, Samaria, and Gaza and then spilled over the Green Line into Israel, with Israeli Arabs demonstrating and rioting all over the country (Barnea, 2022; Lavi, 2010). The initial situation became known as the “October 2000 Riots” and lasted for about a week, in which 13 Arab citizens and one Jewish citizen were killed (Or Commission, 2003). It constituted a strategic surprise for the government, which encountered great difficulties in restoring order. The Second Intifada that it sparked however, was concentrated in the occupied territories and lasted until 2005, during which time more than 1,000 Israelis were killed in Palestinian terrorist attacks (both inside and over the Green Line).

The ISA was unsuccessful in its attempts to prevent many terrorist attacks that were carried out, both inside Israel and in the territories, against settlers and IDF during the Second Intifada. Only after Operation “Defensive Shield” and the construction of the security barrier between Israel and Judea and Samaria was there a significant decline in terrorist attacks.

The government set up the Or Commission in November 2000 to investigate the October wave of protests and demonstrations by Israeli Arabs in solidarity with the Palestinians of Judea and Samaria, who had launched the Second Intifada. One of the Commission’s important findings was that the ISA had received warnings of possible widespread riots as early as May 2000, due to the radicalization of Israeli Arabs. However, the ISA did not share the warning with the Israeli security agencies. However, the head of the ISA’s northern district testified before the Commission that before the October 2000 riots had spread into Israel, the ISA had assessed that “the Arab sector was frustrated by its economic hardships and claimed it was deprived, ignored, and marginalized by the authorities, who were not doing enough, in Arab opinion, to solve the fundamental problems plaguing the Arab sector. In addition, according to the ISA assessment, the situation alienated the Arabs in certain circles, to the point of delegitimizing the State of Israel.” (Or Commission, 2003). The Or Commission revealed that on September 26, 2000, a document produced by the National Security Council (NSC), Israel’s central body for coordination in the field of national security, had a different interpretation based on information received from the ISA and had correctly predicted developments. The NSC document stated that:

The activities of Israeli Arabs could take on a similar but more violent character to previous activities during the difficult period of the “Intifada.” The intensity of the reaction depends on the situation that develops and may include violent demonstrations, roadblocks, and attacks on symbols of the state, such as police stations, post offices, and bank branches. Israel’s response to Palestinians’ activities [could lead] to a Palestinian counter-response, escalation, and widescale expansion of hostilities in the “territories” ... [and these] could intensify the nature/activity of Israeli Arabs. The more Palestinian casualties there are, the more resistance by Israeli Arabs will increase as more and more moderates are swept into taking part in violent demonstrations. (Or Commission, 2003)

This assessment was supported by a former senior executive in the ISA, who admitted that the riots had been a complete surprise: “We have arrested many Israeli Arabs without actual need, and it did not help” (Harel, 2022).

The Or Commission report discussed discrimination by state institutions toward Arabs in Israel, which had led to a sense of severe distress among them. “Arab citizens live in a reality where they are discriminated against as Arabs. Inequality has been documented in numerous government reports, including state comptroller reports and other official documents” (Or Commission, 2003). These included inequality in land allocation, discrimination in local government budgets for Arab communities, low employment rates in the civil service, frustration in the political sphere, and higher than national averages for poverty and unemployment. The Commission also noted the escalating messages heard from leaders of the Arab sector in Israel, which had contributed to the increase in tensions between Arabs and Jews and later led to the outbreak of the riots.

Following the outbreak of violence in October 2000, the Israel Police focused on defense and calming tensions. Still, they had difficulty in doing so because, as the Or Commission had noted, there had been no early warning by the ISA, which was responsible for preventing terrorism and political subversion. The police were not ready, and the level of violence, in at least parts of the country, primarily the north, was high, and it was difficult to restore calm and return to the status quo ante (Barnea, 2017).

The Commission pointed to the potential for civil uprising inside the Green Line due to developments within Israel and/or in the territories (Barnea, 2017). As a result of its findings, the government decided that it would be the responsibility of the ISA to gather intelligence to prevent the deterioration of Israeli Arab sentiment that could lead to unrest and violent nationalistic subversion. The Israel Police Force, on the other hand, would be responsible for collecting and evaluating intelligence regarding public order unrelated to nationalist activities (State Comptroller, 2022).

The Difficulties in Assessing the Moods of Minorities and Their Intentions

Israeli Arabs Since the 2000 October Riots

In the years following the October riots, the significant recommendations by the Or Commission were not implemented (Sade, 2010), and there is no indication that the government discussed this matter further. The government acted as if the possibility of the recurrence of riots and political subversion was low, an attitude which may have led to the strategic surprise of the May 2021 riots.

In the years leading up to 2021, a trend was observed within the Arab sector of a sharpening criticism of the State of Israel. According to the public opinion survey conducted by the Harry S. Truman Research Institute for the Advancement of Peace at the Hebrew University in Jerusalem and the Palestinian Center for Policy and Survey Research in Ramallah (PSR), in 2006, during the Second Lebanon War, for example, Arab citizens of Israel held a pro-Hezbollah position. (Matza, 2016, 49; Nachmias, 2006). Their criticism, which sometimes accused Israel of war crimes, was perceived by Jews as evidence of an enemy seeking to annihilate Israel. However, the situation of the Israeli Arabs is possibly more complicated, as scholar Sammy Smooha writes that the war revealed not only the commitment of Israeli Arabs towards Palestinians and Arabs but also their Israeli identity. They were vulnerable and injured by Hezbollah missiles just like other Israeli residents of Haifa and the north; they expected help and received it from the rescue services, as is customary in Israel (Smooha, 2013).

As Yoram Cohen, the former head of the ISA, said, “The ideological leadership of the Arab public in Israel is much more extreme than the majority of the public, and sometimes it attracts Israeli Arabs to places with which the public does not identify”. In a closed meeting in March 2012, Cohen elaborated:

Israeli Arabs have been involved in three terrorist attacks in the past year. The number of people involved in terrorism among Israeli Arabs is not significant. We have arrested 20-30 Israeli Arabs in the past year compared to 2,000 Palestinians detained in Judea and Samaria. The problems with Israeli Arabs are complex, but these are not security problems. These are alienation, the problem of integration into society, the problem of employment, poor management of local councils, crime and drugs” (Ravid, 2012).

Between the 2000 October riots and the outbreak of riots in May 2021, the IDF conducted three major military operations in the Palestinian Authority. It is important to note how Israeli Arabs responded to each of the operations to better understand their mentality. The first was Operation “Defensive Shield,” which was held March-May 2002 in major cities in the West Bank and aimed to eliminate the infrastructure that had enabled terrorist attacks on Israeli civilians during the Second Intifada. The second operation was “Cast Lead,” which took place in December 2008 in the Gaza Strip and was intended to put an end to the firing of Hamas missiles from the Gaza Strip at Israeli civilians. During Defensive Shield, Arab civilians in Israel showed almost no protest in the face of IDF activities (Rabinovitz, 2002), but six years later, in Operation Cast Lead, the situation was completely different. There were routine demonstrations in Arab communities against Israel’s bombing of Palestinian population centers, civilian infrastructure and schools (Ilani & Lis, 2008). The third Israeli military operation was “Protective Edge,” in July-August 2014, which once again aimed to stop rocket fire into Israel from the Gaza Strip as well as to destroy the tunnels from Gaza that enabled them to attack Israel (State Comptroller, 2017).

With the outbreak of Protective Edge, the Arab public in Israel was already in the midst of a wave of protests, demonstrations, and arrests. The operation signaled another wave of protests in various parts of Israel against the war in Gaza. Some demonstrations were led by local organizations, some by disorganized youth, while organized Islamic movements led others. As the war continued and the number of deaths among the civilians in Gaza increased, so did the protests among the Arab public in Israel. However, other voices in the Arab sector wanted to balance protests and cooperation with Jewish citizens, mainly in the mixed cities and business areas; and the Jewish public also wanted such collaboration to continue. It should be noted that in this case, Israeli Arabs protested the operation and also discussed Jewish-Arab relations intensively on social media (Rabinovitz and Abu Baker, 2002).

The impact of “Operation Protective Edge” on Arab-Jewish relations in Israel, particularly on the possibility of a return to cooperation, did not receive significant attention in the Jewish public discourse. During the fighting, many questions haunted the Arab public but Israeli society was not aware of them and Arab Israelis were marginalized. In Israeli society, there were manifestations of racism, intolerance, and even hatred toward Arabs, which further threatened the possibility of coexistence. On the Israeli-Arab side, the socioeconomic and political distress experienced by many Arab citizens fueled the protest, which was further fueled by a strong empathy for the Palestinians in Judea, Samaria, and Gaza (Foier, 2014; Matza, 2016).

Compared to the Jewish population, the Arabs in Israel have been at a considerable economic disadvantage for many years: “The poverty incidence of Arab families continues to rise [...] Arab households have a low income [...] and they have difficulty covering their expenses.” (Haddad Haj-Yihia, 2017, p.5). This has caused feelings of discrimination and alienation from the government and also from society as a whole. The data shows that Arab men currently earn about 60% of the wages of Jewish men. The labor force participation rate for Arab women is particularly low—22%. The employment rate of Arab 18-22-year-olds is also very low—about 26%. The prevalence of poverty is high and reaches about 48% of the total population, compared to 15% in the Jewish sector (Yashiv & Kasir, 2013). A study carried out about four years ago indicates an improvement in the employment figures of Israeli Arabs, which are still far below the Jewish sector (Botosh, 2020).

Historically, Israel’s Arabs have not been heavily involved in terrorist activities (Matza 2016, pp. 45-46). However, in recent years, there have been some severe cases, such as the October 2015 attack on the central bus station in Beersheba, perpetrated by a resident of the village of Hura in the Negev. There also was the January 2016 terrorist attack on Dizengoff Street in Tel Aviv, committed by an assailant from Arara, and the attack on the Temple Mount, committed by two residents of Umm al Fahm in July 2017. All of these attacks were perceived as perpetrated by individuals, not by the Arab population as a whole, which remained uninvolved.

An Examination of Available Intelligence Before the Outbreak of Demonstrations and Riots in May 2021

The Israeli Response: The Military Operation, “Guardian of the Walls”

On Jerusalem Day, May 10, 2021, during the flag parade through the streets of Jerusalem, Hamas-led Palestinian terrorist organizations began firing massive rocket barrages from Gaza towards Jerusalem and then later to other areas in Israel. To counter the attacks, the IDF mounted, on the same day, Operation “Guardian of the Walls,” a large-scale military campaign in the Gaza Strip. The operation lasted until the ceasefire, which took effect on May 21 (Ministry of Foreign Affairs, 2023). During the operation, terrorist organizations fired about 4,360 rockets from Gaza at Israel. The IDF conducted many attacks in Gaza and caused huge damage (IDF, 2021). “Guardian of the Walls” was unique as the trigger to the clash between Hamas and Israel began following the escalation of riots inside Israel on Jerusalem Day, in which dozens of Palestinian demonstrators from Judea and Samaria and several policemen were injured. Immediately afterward, Israel faced an outbreak of mass demonstrations and riots in several cities, including most of the mixed cities where Jews and Muslims were living together as neighbors.

A recent study conducted in February 2022 (Shragai, 2022) cites dozens of statements and quotes regarding the reasons for the violence from Muslim clerics and Arab youth who took part in the riots, including Arab residents in mixed cities. The research suggests that two direct and central reasons motivated the May Riots—the “Defense of Al-Aqsa” and the friction surrounding the “Residence of the Jewish families in Sheikh Jarrah-Shimon the Tzadik.” However, the research claims that another fundamental factor behind the events was Israeli Arab preoccupation and discourse on the Nakba (translated as “the disaster of the establishment of the State of Israel”) and the hope for the realization of the “right of return” to the places where Arabs had lived before 1948.

Israel was surprised by the attack of Hamas on Jerusalem. According to a leading Israeli military correspondent: “Intelligence assessments before the outbreak of Operation Guardian of the Walls delivered together by the Israeli Military Intelligence (IMI) and the ISA were wrong. Israel relied on assessments of Yahya Sinwar, the head of Hamas in Gaza, but, in fact, the real Hamas decision-maker is Mohamad Deff (the head of the military arm of Hamas), who authorized the firing of rockets on Jerusalem at 6 pm on May 10” (Yehoshua, 2021).

The Evolution of the May 2021 Civil Riots

Immediately before the outbreak of the riots, the Temple Mount and Jerusalem were at the forefront of developments and were known to be sensitive issues for Israeli Arabs. There were grounds to assess that this could become a central issue, especially after Hamas in Gaza had fired in the direction of Jerusalem, claiming that it was defending the Temple Mount.

The riots in Jerusalem erupted amid unrest in the city against Israel’s plan to force Arab residents of the East Jerusalem neighborhood of Sheikh Jarrah to evacuate their homes. The unrest intensified during the month of Ramadan and continued with Arab clashes at the Nablus Gate to the old city of Jerusalem; it then spread to Muslim clashes with police on the Temple Mount. Following the events, Hamas in Gaza sent an ultimatum demanding that Israel evacuate its forces from the Temple Mount and Sheikh Jarrah. When the ultimatum expired on Jerusalem Day, May 10, Hamas and Palestinian Islamic Jihad launched a barrage of rockets from the Gaza Strip toward the Jerusalem area and other cities. In response, Israel launched Operation “Guardian Walls.” During the riots, there were approximately 520 violent clashes between the rioters and the police: three Israeli citizens were killed, and dozens were wounded, among them 306 policemen. A total of 6,000 Israeli Arabs actively participated in the riots, and among them, 3,200 were arrested and 574 were indicted. There was also massive damage to property. The physical and property damages caused by the riots were estimated at tens of millions of New Israeli Shekels (NIS) (State Comptroller, 2022).

In the early days, the police initially framed the riots as local public protests and tried to lower the “flames,” even when this meant not intervening with force. Only later, the police commissioner explained, “[f]rom the moment we understood the intensity of the events and the number of events, in less than 24 hours a response was given throughout the country, within four days the Intifada was eliminated [...] with zero casualties, with a minimum of measures” (Hankin, 2022).

As part of their response, the Israel Police was reinforced by Border Police forces. Four days after the start of the riots, the ISA became actively involved in helping the police. It issued an unusual statement in light of the escalation of violent incidents, stating that it was terrorism (Mako, 2021). The ISA’s support for the police was very valuable, mainly in supplying alerts of further violent incidents and also in the interrogation of suspects who were arrested during and after the riots (Zaken, 2021). It was later reported that contrary to initial publications, the ISA estimated that less than ten percent of the Arab perpetrators had a prior criminal record, and the primary motivation of the Arab rioters, who were mainly between the ages of 20-30, had been Palestinian nationalism (Ben David, 2022).

From the end of the Second Intifada till May 2021, none of the clashes between Israel and the Palestinians ever prompted a specific warning about possible widespread riots by Israeli Arabs. However, suppose one connects such clashes to fundamental (basic) intelligence about the attitude of the Israeli Arabs to the State of Israel, especially in the immediate period before the outbreak of the riots. In that case, the events can be seen as “weak signals.” In other words, while the signals did not communicate that something substantial was about to happen, ISA could have captured these signals and amplified them using forecasting techniques (Barnea and Meshulach, 2020). In contrast to the Second Intifada, when the ISA had made a specific assessment of the possibility of riots breaking out, the May 2021 riots were a complete surprise (State Comptroller 2022). “The ISA had assessed that the events were only local and the main emphasis was on Jerusalem” (Ibid.). According to the report by the state comptroller:

“In the months leading up to the events of the Guardian of Walls, the ISA recognized a trend of increasing tension in the Arab sector and insisted on the potential risk and the possibility of an outbreak, including in the context of friction between Jews and Arabs in mixed cities,” (Ibid.) but it was not assessed as an intelligence warning.

The State Comptroller reported (2022) that the Director General of the ISA said in a discussion that took place after the May 2021 events: “We must say honestly that we did not foresee the outbreak, neither the scope of the participants nor the intensity of the violence that developed by the Israeli Arabs.” In that discussion it was apparently stated that the “ISA unit responsible for the coverage of the Israeli Arabs failed to provide a warning about the outbreak before the events began. The phenomenon that led to the outbreak was not surprising. However, the surprise was reflected in the outbreak’s scope and intensity and the characteristics of the attacks. At this point, the ISA’s unpreparedness for the scenario that materialized in the events of May 2021 was clearly visible.”

Contrary to the observation by the Inspector General of the Israeli Police, who said, “No one predicted the riots in the mixed cities—neither the police nor the ISA and not the IDF” (Levi and Ilani, 2022), the Director General of the ISA said: “We understood that the area was unstable. We recognized the trends, but we thought that the direction we were heading was individual terrorist attacks and not a wide outbreak of nationalist riots.”

The remarks by the General Director of the ISA made it look as if there was some intelligence before the eruption of the May 2021 riots—that may be termed “weak signals”—that were not fully understood as alarming. “Weak signals” are fragments of relevant information received by the agency. However, the organization does not recognize them as a warning because of their weak magnitude or because of the noise and the information congestion around them. When they are received, their importance is not recognized and they therefore do not spur further organizational action (Schoemaker and Day, 2009).

The Unique Challenges of Early Warning

It is impossible to ignore the fact that important conclusions of the Or Commission after the Second Intifada (2000), which contained proposals for improvements in a variety of areas related to the Arab sector in Israel, were never implemented. The Israeli government ignored the Commission’s report as though they believed that the occurrence of the Second Intifada had been exceptional and was unlikely to happen again. The result was that the ISA was caught off guard again.

According to Yehezkel Dror, a leading Israeli political science strategist (Dror, 2022), the reasons for the blindness of internal security bodies, especially the ISA, is rooted primarily in ongoing intelligence that depends on indicative signals of what may happen shortly. This contrasts strategic intelligence, which, according to Dror, should be included in any assessment. It goes deeper into the study of historical processes and their causes and produces dynamic assessments, even for the long term. Dror’s assessment coheres with the critique by the State Comptroller of the ISA’s failure to understand the potential threat to Israel’s internal security as a result of the mood change and increasing alienation among Arab Israelis (State Comptroller, 2022).

The lack of awareness of the possibility of a flare-up in the mixed cities after the Hamas attack on Israel and the start of Operation “Guardian of the Walls” explains, to some extent, the belated understanding that the riots had severe subversive implications, the police’s slow response and the delayed arrival of the ISA on the scene.

The trusted bodies of Israeli internal security—mainly the ISA but also the police—were taken completely by surprise with the riots and violence in the mixed cities in May 2021. As a result, there was no prepared plan for dealing with them. It should be added that academic studies indicating the increasing adaptation of the Arab minority to Israeli citizenship had not mentioned the possibility of violent riots (Hadad Haj-Yichia, 2021). However, other available intelligence has indicated that other publications on the Arab sector described an intense situation (State Comptroller. 2022).

It is possible to look at this event and the ISA’s delayed response from another angle: the difficulty in detecting weak signals in the absence of precise early warnings. These signals include discrete searches for radical websites, interest in violent local riots, new radical connections, widening criticism of the government, etc. Such signs alone could not be interpreted as an immediate actionable threat. They could not predict unexpected damage without support from solid intelligence indicators such as extremely violent discourse in social media or violent intentions, which were missed.

In an article that explores the best way to detect weak signals and avoid strategic surprises, “Forecasting for Intelligence Analysis: Scenarios to Abort Strategic Surprises,” the authors Barnea and Meshulach (Barnea and Meshulach, 2020) suggest using the methodology of scenarios to clarify and interpret weak signals. The article explores how to prepare organizations to be alert to possible strategic surprises and enable them to prepare for them in advance. Key topics include the following:

1. How do we gather intelligence and examine weak signals that can prefigure and anticipate a threat?
2. How can we survey relevant areas to study such signs?
3. How can we build prevention scenarios?
4. How can high-level discussions about these scenarios be conducted, utilizing the involvement of external and unbiased experts?
5. How and when should you decide to create/not create a threat alert?

The authors propose scenario methodology and show how using what they call “surprise-preventing scenarios” could constitute an important added-value tool to an organization’s intelligence toolbox and should, therefore, be seriously considered.

In addition to detecting weak signals and correctly interpreting them, which is the responsibility of the ISA, the Israeli government needs to keep in mind the ideas that are important to its Arab citizens—ideas that seemed to have triggered the May 2021 Riots. Even though the economic situation of Israeli Arabs and their welfare services are far better than those of the Palestinian Arabs in the Palestinian Authority and most Arab countries, Israeli Arabs know that they are discriminated against compared to Jews. They feel that they are belittled and hated. In addition to this, the legislature has passed laws that diminish their equality, such as The Nation-State Law of the Jewish People (2018). This law specifies certain rights that are granted only to the Jewish people, such as the right to self-determination and the right to return. The problem is what the law leaves out: it excludes minorities, omits equality, ignores democracy and the Declaration of Independence, and undermines the fragile balance of Israel as a Jewish and democratic state (Fuchs and Navot, 2023).

The hostility toward Israel of Palestinian elements such as Hamas, the memory of the two Intifadas, and especially the terrorist acts that have harmed many Jews add to the reasons for the discrimination of Israeli Arabs and hatred towards them. Jews feel less secure as a result of the terrorist incidents (Shuker 2022). The reasons for discrimination are also religious. For example, Jewish rabbis and clerics openly call for the discrimination of Arabs and do not allow them to live alongside Jews (Nachshoni 2010).

Regarding the May 2021 riots, it is important to ask: What kind of strategic surprise did Israel face? The information gathered shows that no organized effort stood behind the Arab rioters in 2021, similar to the Second Intifada in 2000 and also the First Intifada in 1987 (Lustick, 1993). The surprise, then, of May 2021 can be defined as a type of diffused surprise (Barnea, 2019) that started in East Jerusalem and expanded into the mixed cities of Israel as a spontaneous phenomenon that developed gradually, mainly through social media, as a popular protest against Israel. The ISA found this phenomenon challenging to tackle because they could not identify any leaders or organizations directing the activity and could not halt them. This situation precisely fits the definition of diffused surprise.

Intelligence agencies know that surprises can occur but are deeply frustrated when they fail to see the disasters they should have anticipated (Watkins and Bazerman, 2003). Watkins and Bazerman (2003) present a model for better scanning and claim that, “In studying predictable surprises that have taken place in business and government, we have found that an organization’s inability to prepare for them can be traced to three kinds of barriers: psychological, organizational, and political. Executives might not be able to eliminate those barriers entirely, but they can take practical steps to lower them substantially.” The authors note that these failures arise from breakdowns in recognition, prioritization, and mobilization. The failure to act at any of these three stages will leave organizations vulnerable, as seems to have happened in this event. Effective prevention of surprises requires first, the study of potential changes that may risk the internal stability of a state to be recognized early. Then, once they have been identified, they must be given high priority. The third stage is to mobilize the organization’s resources, look deeply into the indicators, and decide if any action must be taken.

Conclusions

According to the State Comptroller (2022), in the months leading up to the Guardian of Walls operation and surrounding events, the ISA recognized increasing tension in the Arab sector and even the possibility of an outbreak, including in the mixed cities. However, this was not considered as an intelligence warning. The ISA’s assessment was that the events would be purely local, with the main emphasis on Jerusalem.

Nevertheless, the ISA could have improved the chances of not being caught by surprise. The agency could have warned the government of a severe situation called “strategic notice” (Omand, 2010), meaning to warn the government that there were security developments of which it needed to be aware. This was not done as the ISA did not anticipate the outbreak. It looks as if it did not learn the lessons from the internal unrest of October 2000, which began with demonstrations by Islamic elements at the holy site of the Muslims, Al-Aqsa, in Jerusalem and then spilled over the Green Line into Israel.

Assuming that in similar cases in the future, there may be no specific intelligence indicators of the development of an internal threat with extremely subversive characteristics but only weak signals, the great challenge is to understand deep social processes, read correctly the moods of a large minority, and identify, in a timely way, changes that may indicate the brewing of a storm. The centrality of Jerusalem in Arab/Palestinian national consciousness and identity is a delicate subject that must be addressed.

Monitoring a large minority who have felt alienated from the State of Israel, have not been satisfied with their status and could possibly take action leading to subversion, was defined by law as the responsibility of the ISA. The ISA’s challenge is knowing when and how the outbreak will happen.

While intelligence organizations are expected to warn senior government executives about risks to internal stability as a result of subversive activity, this seems highly challenging when related to events that present only weak signals that are not fully understood, which is what happened in the eruption of the May 2021 riots in Israel.

Based on an analysis of the widespread riots of the Israeli Arabs in May 2021, the ISA is now expected to develop new capabilities that will help it identify timely changes in the moods of a targeted population, such as the Israeli Arabs. As a result of this case study, it is reasonable to assume that a warning about potential riots will not come from one “golden” piece of intelligence that will indicate the intentions of radical groups among the Arab population to act against the government. However, it will be a gradual, diffused development that may explode without advanced warning. It will need exceptional analytical capabilities to identify changes in internal dynamics in the moods of minority crowds, alienated from the state, particular indicators to identify these changes and the drivers that may indicate when such changes may lead to violent subversive actions that threaten national security.

Acknowledgments

I thank Professor Avi Meshulach from the Hebrew University of Jerusalem for his valuable comments. I also want to thank my students, Lea Guez and Julian Katzenmaier from Reichman University, for helping gather the information used throughout this paper.

References

Ansoff, H. I. (1975). Managing strategic surprise by response to weak signals. California Management Review, 18(2), 21–33. https://doi.org/10.2307/41164635

Bar-Joseph, U. (2000). Towards paradigm shift in the Israeli security conception. Israel Affairs, 6(3-4). https://doi.org/10.1080/13537120008719574

Barnea, A. (2017). Counterintelligence: Stepson of the intelligence discipline. Israel Affairs, 23(4), 715–726. https://doi.org/10.1080/13537121.2017.1333725

-. (2019). Strategic intelligence: A concentrated and diffused intelligence model. Intelligence and National Security, 35(5), 701–716. https://doi.org/10.1080/02684527.2020.1747004

-. (2020). Integrating the counterintelligence discipline into Israel’s security concept. Strategic Assessment,23(2), 23-39. https://tinyurl.com/yzcwdd92

-. (2023). Israeli Intelligence, the Second Intifada, and strategic surprise: A case of “intelligence to please”? International Journal of Intelligence and Counterintelligence, 36(2), 516–540. https://doi.org/10.1080/08850607.2021.1994347

Barnea, A., & Meshulach, A. (2020). Forecasting for intelligence analysis: Scenarios to abort strategic surprise. International Journal of Intelligence and Counterintelligence, 34(1), 106–133. https://doi.org/10.1080/13537121.2017.1333725

Ben Ari, Y. (2020, September 27). The skeleton in the closet of the Second Intifada. Haaretz. [Hebrew]. https://tinyurl.com/2n5w6a92

Ben David, A. )2022, April 29(. It is still unclear where the border between criminal activity and national activity is in the Arab sector. Maariv. [Hebrew]. https://tinyurl.com/2wp7nh68

Ben Menachem, Y. (n.d.). Were Jerusalem and the Temple Mount the reasons for the May 2021 riots? The Jerusalem Center for Public Affairs. https://tinyurl.com/mw68rufx

Dror, Y. (2022). The truth from the state of the Jews, p. 53. Miskal Yedioth Ahronoth Books [Hebrew].

Feldman, S. (2001). The second Intifada, a net assessment. Strategic Update 4(3), 4-12. https://tinyurl.com/y73kztf6

Foier, D. (2014, July 19). Israeli Arabs in the shadow of Protective Edge. Globes. [Hebrew]. https://tinyurl.com/z42y8d2e

General Security Service Law (2002). https://tinyurl.com/yc8578bb

Hadad Haj-Yichia, N. (2017). The Arab Society in Israel: Their Socio-Economic Position and a look to the Future. The Israeli Democracy Institute. [Hebrew]. https://tinyurl.com/3k3h4jjx

-. (2021, March 17). The Arab sector is no more on the sideline. The Israeli Democracy Institute. [Hebrew]. https://tinyurl.com/yvyap53f

Hankin, Y. (2022, January 12). If it will happen again – Operation Guardian Walls as a case of hybrid warfare. Maarachot. [Hebrew]. https://tinyurl.com/ykcdnet7

Harel, A. (2022, February 17). We have arrested many Israeli Arabs without actual need, and it did not help. Haaretz. [Hebrew]. https://tinyurl.com/4e76jf8d

Harkabi, Y. (1999). War and Strategy, p. 534. Maarachot Publishing [Hebrew].

IDF (2021, June 14). Operation Guardian of the Walls. https://tinyurl.com/yckpd6tr

Ilani, O., & Lis, Y. (2008, December 28). Israeli Arabs protested against the operation. Haaretz. [Hebrew].

Intelligence Heritage Center (n.d.). Four years of violent conflict between Israel and the Palestinians. Interim Summary [Hebrew]. https://tinyurl.com/7rjbrf3w

Knesset Center of Research and Information (2020, September). Information About employment and salaries in the Arab sector. [Written by N. Botosh] [Hebrew]. https://tinyurl.com/5ypj5hb6

-. (2021). Overview of Arabs in mixed cities. [Written by I. Avgar, E. Weisblai, R. Schwartz and M. Lerer. [Hebrew]. https://tinyurl.com/5yh8x7a5

Lavi, E. (2010). Israel challenge with the Intifada: A critical view. Strategic Assessment 13(3), 87-104. [Hebrew]. https://tinyurl.com/497tdkp5

Levi, L., & Ilani, I. (2022, September 12). Police Commissioner: “In the next violent confrontation, the social networks should be blocked.” Ynet. [Hebrew]. https://tinyurl.com/4wah2372

Lustick, I. (1993). Writing the Intifada: Collective action in the occupied territories. World Politics 45(4), 560-594. https://www.jstor.org/stable/2950709

Margalit, L. (2018, August 14). ISA: A key defender against subversion or undermining democracy? Israel Democracy Institute, [Hebrew]. https://tinyurl.com/ymy6798t

Matza, D. (2016). Patterns of resistance among Israel’s Arab-Palestinian minority: A historical review and a look to the future. Memorandum No. 170, INSS. https://tinyurl.com/2rstvmpp

Meridor, D., & Eldadi, R. (2019). Israel’s national security doctrine. The report of the committee on the formulation of the national security doctrine (the Meridor Committee), ten years later.. Memorandum No. 187. INSS. https://tinyurl.com/2u2fw5pn

Ministry of Foreign Affairs (2015, September 13). Wave of terror 2015-2023. https://tinyurl.com/3jjfayhh

N12 (2021, May 14). The Shin Bet in an unusual announcement: “Working alongside the police in thwarting and preventing the violent outbursts.” N12. [Hebrew.] https://tinyurl.com/3wfekdrt

Nachmias, R. (2006, September 26). Most Palestinians want to be like Hezbollah. Ynet. [Hebrew]. https://tinyurl.com/3uzbjzxw

Nachshoni, K. (2010, October 17). “50 City Rabbis: Do Not Rent Apartments to Arabs.” Ynet. [Hebrew]. https://tinyurl.com/vuue764e

Navot, S., & Fuchs, A. (2023, December 11). Nation-State Law explainer. The Israel Democracy Institute. [Hebrew]. https://tinyurl.com/mtxfteuf

Omand, D. (2010). Securing the State, pp. 219-224. Hurst and Company.

Or Commission (2003). State commission of inquiry into clashes between the security forces and Israeli citizens in October 2000. Section 1: Chapter 1, Paras. 4-19; Chapter 3, Paras. 184, 189, 191–194. [Hebrew]. https://tinyurl.com/yx7tepmy

Rabinovitz, D. (2022, May 14). Alienated Peace. Haaretz. [Hebrew]. https://tinyurl.com/28sn2k7u

Rabinovitz, D., & Abu Baker, H. (2002). The upright generation. Keter Publishing [Hebrew].

Ravid, B. (2012, February 3). ISA Head on Tag Mehir: The Settlers From Yitzhar are Terrorizing the Government. Haaretz. [Hebrew]. https://tinyurl.com/yx7ane37

Sade, S. 2010, August 28. Sometimes, the war is just an excuse: The grim reality of the commissions of inquiry in Israel. TheMarker. [Hebrew]. https://tinyurl.com/yyjuhrfb

Schoemaker, P.J.H., & Day, G.S. (2009, April 1). How to make sense of weak signals. MIT Sloan Management Review. https://tinyurl.com/msxpf4ar

Smooha, S. (2013). Second Lebanon War and the Arabs in Israel. In F. Aziza, N. Nachmias & M. Cohen (Eds.), Welfare services, health and education in emergency time: Lessons from the Second Lebanon War (pp. 163–172). Pardes [Hebrew].

Shelach, O. (2015). Dare to win—A security policy for Israel. Yedioth Books [Hebrew].

Shmaryahu-Yeshuron, Y. (2022). Retheorizing state-led gentrification and minority displacement in the Global South-East. Cities 130. https://doi.org/10.1016/j.cities.2022.103881

Shragai, N. (2022). The Israeli Arab rioters still mourn the “Nakba” and yearn for the “Return.” Jerusalem Center for Public Affairs. https://tinyurl.com/yu8k6zem

Shuker, P. (2022, June 20). Survey about Jews’ attitude towards Israeli Arabs after the May 2021 riots. Jerusalem Institute for Strategy and Security - JISS. https://tinyurl.com/5e6ymc4a

State Comptroller of Israel. (2017, February 28). Decision-making processes in the Cabinet regarding the Gaza Strip before and at the beginning of Operation Protective Edge. https://tinyurl.com/b3ht544b

-. (2022, July 27). Special audit report mixed cities, p. 1, 21-23, 112 [Hebrew]. https://tinyurl.com/yju3nh23

The Jewish Nation-State Law (2018). [Hebrew]. https://tinyurl.com/35mau6ck

Walter, B. (2022). How civil wars start and how to stop them. Crown Publishing.

Watkins, M. D., & Bazerman, M. (2003). Predictable surprises: The disasters you should have seen coming. Harvard Business Review. https://tinyurl.com/2eff94uh

Wohlstetter, R. (1962). Pearl Harbor, warning and decision, pp. 111–112, 387–389. Stanford University Press.

Wootkliff, R. (2018, July 18). Final text of Jewish nation-state law, approved by the Knesset early on July 19. The Times of Israel. https://tinyurl.com/4t93kub8

Yashiv, E., & Kasir, N. (2013). Working market of Israeli Arabs: A survey of the characteristics and options for policy. Tel Aviv University (Department of Public Policy) & Bank of Israel [Hebrew].

Yehoshua, Y. (2021, May 26). In the hands of Deff. Yediot Ahronot. [Hebrew].

Zaken, Dani. (2021, September 24). Legal Issues are almost resolved: The ISA will join the battle against criminal activity in the Arabic sector. Globes. [Hebrew]. https://tinyurl.com/yn9sp79h

Ziv-Av, R. (2023, November 19). He was unafraid to ask. Ynet [Hebrew]. https://tinyurl.com/59metyjv