The Unit
Unit 8200 conducts signals intelligence, communications interception, codebreaking, cyber operations, and surveillance under AMAN, the IDF’s Military Intelligence Directorate. It is widely reported as the Israel Defense Forces’ largest unit. Peter Roberts of the Royal United Services Institute assessed its capability in 2015. He described it as “probably the foremost technical intelligence agency in the world,” chiefly differing from the NSA in scale.
Its personnel system gives that capability a distinctive route into commerce. Most workers are conscripts aged 18 to 21. The IDF cultivates candidates before service through afterschool coding programs alongside secondary education. Top performers receive invitations as early as 16 or 17.
During mandatory service, recruits develop cyberweapons, build surveillance systems, and intercept communications at national scale. Elsewhere, senior career intelligence professionals would perform this work. Recruits leave with capabilities, working networks, and product ideas developed at unusual youth, technical depth, and operational scale.
The “startup nation” brand describes the commercial output while hiding its production. State-funded military research and development supplies the capabilities. Classified service develops them through conscript labor, and private companies subsequently sell them to governments worldwide. What the state builds in uniform becomes the founder’s entrepreneurial exit.
The Talpiot Program
Talpiot supplies a parallel route into this economy. The elite IDF training program began in 1979 under the Hebrew University of Jerusalem. The Air Force and the Administration for the Development of Weapons and the Technological Industry sponsor it. Talpiot accelerates generalist scientific and engineering talent for research across the armed services.
Nearly 10,000 high-scoring school graduates supply the selection pool. Approximately 300 pass the initial tests of intelligence, group performance, psychological suitability, and security. The final cohort contains 50 to 60 cadets each year. Each signs a nine-year commitment.
Their first stage is a 40-month accelerated BSc in physics, mathematics, or computer science at Hebrew University. They study in uniform and rotate through infantry, armored, artillery, and engineering field training. Six years of standing IDF research and development service follow. Graduates receive their degree and the rank of First Lieutenant.
Talpiot develops generalist talent for weapons research across the IDF. Unit 8200 develops signals intelligence and cyber talent for the intelligence apparatus. Both select from the national talent pool and train recruits inside classified military environments. Both release capabilities developed at state expense into commercial companies. Those companies often share personnel, investors, and clients.
The NSA Raw-Data Agreement
On September 11, 2013, The Guardian reported a secret NSA agreement from documents supplied by Edward Snowden. Unit 8200, designated “ISNU” in NSA communications, receives raw, unfiltered data on U.S. citizens. Israeli signals intelligence therefore gains access to intercepted American communications before U.S. privacy processing, filtering, and minimization.
The NSA normally applies legal minimization procedures before sharing raw collection with even its closest Five Eyes partners. Israel belongs to neither Five Eyes nor that sharing framework. The Unit 8200 arrangement operates outside it. Terms beyond those Snowden disclosed remain classified.
The Alumni Network
Unit 8200 and Talpiot alumni form a dense network between military service and technology companies. Their work spans cybersecurity, communications, cloud infrastructure, and government surveillance. Classified training, state-funded relationships, and operational experience repeatedly become private products. A company count alone cannot explain that conversion.
Confirmed examples include Check Point, Palo Alto Networks, CyberArk, Wiz, and NSO Group. Founders or senior personnel passed through Unit 8200, Talpiot, or adjacent intelligence and defense programs. Their biographies differ, and Israeli technology companies are not uniformly intelligence cutouts. The recurring sequence remains clear: service develops capability, teams leave together, private capital expands the product, and state relationships support its market.
In 2014, forty-three Unit 8200 veterans publicly refused further intelligence operations against Palestinians in the occupied territories. Their letter described private civilian data collected without a legitimate security function. Sexuality, family difficulties, and financial stress became leverage for demanding collaboration or compliance. Veterans inside the unit exposed how its intelligence served coercion beyond security.
NSO Group and Pegasus
Niv Karmi, Shalev Hulio, and Omri Lavie founded NSO Group in 2010. Their names supply the company’s acronym. Karmi had served in military intelligence and the Mossad. He used those contacts to establish its first government sales. The first functional Pegasus version was finalized in 2011. By the mid-2010s, NSO had become Israel’s most significant and controversial defense-technology export.
Ronen Bergman and Mark Mazzetti reported on the research team in the New York Times in 2022. They wrote that “almost all of NSO’s research team is made up of former Israeli military intelligence personnel, most of them having served in Israel’s Military Intelligence Directorate, and many of these in its Unit 8200.” Israeli law classifies Pegasus as a military export weapon. Every foreign government sale requires explicit Ministry of Defense approval. That approval governs the product’s diplomatic use.
Diplomatic Instrument
The New York Times documented Israel’s treatment of NSO as a “de facto arm of the state,” governed through export approvals. Geopolitical alignment governed approvals and refusals, irrespective of purchasing governments’ human rights records. Azerbaijan, Morocco, the UAE, and Saudi Arabia received approval. These sales served the anti-Iran coalition that culminated in the Abraham Accords.
Ukraine was denied access. Estonia was denied to protect Israel’s relationship with Russia. Sales build political relationships; refusals preserve others. Pegasus becomes a diplomatic bargaining instrument regardless of how a buyer uses it.
The state’s documented role lies in licensing and export approval. The public technical record establishes no Israeli backdoor across every client deployment. Control over sale and access already supplies foreign-policy power.
The Pegasus Project
In July 2021, Forbidden Stories and Amnesty International received a leaked list exceeding 50,000 phone numbers. The list was believed to contain potential Pegasus targets selected by client governments since 2016. Forbidden Stories is a Paris-based nonprofit. The organizations assembled seventeen news organizations and eighty journalists for a joint investigation.
The consortium included The Guardian, Le Monde, Die Zeit, Süddeutsche Zeitung, The Washington Post, and Haaretz. Other participants included India’s The Wire, Daraj, OCCRP, Direkt36, and PBS Frontline. Initial findings appeared on July 18, 2021.
The investigation identified eleven client governments: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the UAE. At least 180 journalists from 20 countries appeared on the list. Potential targeting and confirmed infection remain distinct findings within these cases.
Jamal Khashoggi: Citizen Lab confirmed with high confidence that Pegasus had infected Omar Abdulaziz’s iPhone. Abdulaziz was one of Khashoggi’s closest confidants. Infection preceded Khashoggi’s October 2018 murder at the Saudi consulate in Istanbul by months. Abdulaziz said the software exposed Khashoggi’s private criticism of the Saudi royal family and “played a major role” in his death.
Emmanuel Macron: Le Monde reported Macron and fourteen French cabinet ministers as potential Moroccan targets on the list. On August 2, 2021, France’s ANSSI confirmed Pegasus on three French journalists’ phones. It became the first government body to confirm such infections independently. Macron changed his phone.
Boris Johnson / 10 Downing Street: Citizen Lab reported targeting of Downing Street staff in April 2022. It suspected UAE operators.
Jeff Bezos: A private forensic report linked his phone’s compromise to a WhatsApp message from an account used by Mohammed bin Salman. Saudi officials disputed the allegation. The public record did not establish a confirmed Pegasus infection.
U.S. State Department employees: In December 2021, Pegasus was confirmed on at least eleven employees’ iPhones in Uganda.
Israeli citizens: In January 2022, Calcalist alleged warrantless police surveillance against a broad list of citizens. Official reviews found narrower instances of improper or technically excessive collection. They did not substantiate the full published list. Domestic use and failed oversight remain established without validating every original allegation.
Legal and Regulatory Consequences
WhatsApp, owned by Meta, sued NSO in 2019 over a vulnerability used to infect approximately 1,400 users. Those users included human rights defenders and journalists. In December 2024, U.S. District Judge Phyllis Hamilton found NSO liable. In May 2025, a jury ordered $167 million in punitive damages. A subsequent permanent injunction barred NSO from targeting WhatsApp users.
The U.S. Commerce Department blacklisted NSO in November 2021. Its stated reason was “acting contrary to the foreign policy and national security interests of the United States,” in the designation. The designation effectively barred U.S. companies from supplying its operations. It damaged NSO’s access to the American technology ecosystem without closing the company. Israeli Ministry of Defense licensing continued.
A U.S.-based investor group acquired NSO in late 2025. David Friedman became its incoming executive chairman. He had served as U.S. ambassador to Israel under Trump.
Cellebrite
Cellebrite was founded in Petah Tikva, Israel, in 1999. It introduced the Universal Forensic Extraction Device, or UFED, in 2007. This portable hardware and software system extracts a phone’s contents and produces a structured forensic report. The contents include messages, contacts, photographs, encrypted application data, and deleted files. Cellebrite listed on Nasdaq in 2021 at a $2.4 billion valuation.
Israel classifies Cellebrite’s products as “dual-use civilian services.” That classification removes them from Ministry of Defense licensing requirements that apply to Pegasus. Cellebrite therefore reaches a wider government market with less oversight. The administrative category changes the scrutiny applied to surveillance capability.
The client record shows the consequences of that access.
Bangladesh: Cellebrite sold to the Rapid Action Battalion, a paramilitary force linked to extrajudicial killings. After public reporting in 2021, it announced an end to RAB sales. Existing equipment remained operational.
Russia and Belarus: UFED processed political opponents’ phones for years. An Israeli activist brought a Supreme Court suit in 2021 after the extraction of Navalny associate Lyubov Sobol’s phone. Cellebrite then terminated cooperation with Russia and Belarus. In 2023, documented FSB use extracted data from anti-war activist Dmitry Ivanov’s phone.
Hong Kong: Police used UFED on phones belonging to demonstrators detained during the 2019–2020 protests. Cellebrite announced an end to Hong Kong and China sales in October 2020. The Intercept reported continuing Chinese sales in 2021.
Myanmar: The state budget included MacQuisition software from Cellebrite subsidiary BlackBag Technologies. Court documents established police use of Cellebrite technology against two Reuters journalists’ phones. The journalists were convicted for reporting on Rohingya massacres. Cellebrite claims it stopped selling to Myanmar in 2018.
Philippines: Cellebrite sold to the Duterte government. In The Palestine Laboratory (2023), Antony Loewenstein documented training of government bodies involved in drug-war killings. He wrote: “Cellebrite cannot claim ignorance of its involvement in the killings.”
Saudi Arabia: Haaretz reported Cellebrite’s phone-hacking services in September 2020. A company representative had traveled to Riyadh in November 2019 for a covert operational engagement.
Serbia: Amnesty International reported police use of UFED against journalist Slaviša Milanov’s phone in December 2024. Police bypassed its security and installed domestic spyware. Cellebrite halted product use in Serbia in February 2025.
United States — ICE: A 2017 Immigration and Customs Enforcement contract was worth $2.2 million. A 2019 contract was worth $30–35 million. An $11 million contract was renewed in September 2025. Immigration enforcement is the primary use. CBP, the Secret Service, and TSA also use the tools.
In April 2021, Signal creator Moxie Marlinspike demonstrated exploitable arbitrary-code-execution vulnerabilities in UFED software. A phone under examination could, in principle, run code that corrupted Cellebrite’s evidence database. Cellebrite had to patch the vulnerabilities and temporarily removed full iPhone support. The examined object could compromise the instrument producing its evidence.
Carbyne and the Barak-Epstein Link
Amir Elichai, Alex Dizengoff, Yony Yatsun, and Lital Leshem founded Reporty in Israel in 2015. The company later became Carbyne. Former prime minister and IDF chief of staff Ehud Barak supplied early investment and chaired its board. He was not an operating founder. Carbyne established its headquarters in New York while retaining Israeli research and development.
Carbyne’s cloud-based emergency-call system receives location, video, audio, and other caller data. On November 4, 2025, Axon announced an acquisition agreement worth $625 million, subject to closing conditions. Axon’s May 2026 investor materials describe Carbyne as integrated into its 911 business. One vendor now joins emergency dispatch, police hardware, body-camera evidence, and real-time communications.
Peter Thiel’s Founders Fund made Carbyne its first Israeli startup investment. The 2021 Series B included former CIA Director David Petraeus. Former Homeland Security Secretary Michael Chertoff joined the board. Andrew Intrater, CEO of Columbus Nova, acquired a stake in 2017. Columbus Nova managed investments for Russian oligarch Viktor Vekselberg. AT&T led a $100 million Series D round in 2025.
Barak invested approximately $1 million at Carbyne’s founding in 2015. Haaretz traced a substantial portion to Jeffrey Epstein. Barak publicly acknowledged their business relationship. He also acknowledged roughly thirty visits to Epstein’s New York properties through the 2010s. These continued after Epstein’s 2008 sex-offender conviction. Barak left Carbyne’s board in April 2020.
The connection joins documented investment, chairmanship, reported funding, and infrastructure now inside Axon’s public-safety business. The record establishes no intelligence-insertion or Epstein-direction chain for Carbyne. Money and political access met Israeli security networks, emergency communications, and American police infrastructure inside the same company. That institutional convergence carries its own consequence without an invented directing chain.
The Structural Reading
Five documented features organize this surveillance export economy. They explain how military capability becomes commercial power and diplomatic leverage.
First: state-subsidized military R&D. NSO, Cellebrite, Verint, Check Point, and related companies commercialized technologies developed inside the IDF at state expense. The state paid for talent identification, clearances, classified infrastructure, technical training, and operational deployment against real adversaries. Commercial spinouts privatize that investment. Founders receive the primary financial benefit, while the state gains strategic and diplomatic utility from exports.
Second: export as diplomacy. The New York Times documented Pegasus licensing as foreign-policy decision-making. Gulf-state approvals preceded and partially enabled the Abraham Accords. In these legally documented cases, the “private sector” surveillance industry carries state foreign policy. Its governing comparison is strategically reviewed weapons sales, rather than ordinary American technology firms selling abroad.
Third: regulatory arbitrage. Pegasus’s military classification requires Defense Ministry approval, while Cellebrite’s “civilian dual-use” classification avoids comparable scrutiny. Those categories let different products serve different markets. Political administration manages the classification instead of technical capability alone. Weapons receive ministry review; civilian labels permit lighter scrutiny. The overall economy receives less external accountability than its surveillance function warrants.
Fourth: occupation as laboratory. Loewenstein’s The Palestine Laboratory documents occupied Palestinian territories as a persistent testing environment for surveillance and control technology. Ethical and legal restrictions apply with less force there than in other testing environments. A captive population lacks effective legal recourse against the testing. Technologies calibrated in Gaza and the West Bank are sold to governments seeking comparable control over their own populations.
Fifth: the revolving door. The IDF supports the transition from Unit 8200 service to company founding within its security-industrial strategy. Former commanders join firms founded by teams that served under them. Petraeus, Chertoff, and Founders Fund supply intelligence-adjacent credibility in the United States. That credibility helps Israeli security products enter American procurement.
The “startup nation” brand foregrounds commercial value and entrepreneurial exits. State training, classified experience, occupation-based testing, and diplomatic licensing remain behind that public account. These documented relations carry the structural argument. Criticism of its sources cannot itself serve as evidence for the architecture.
October 7 and Unit 8200
Hamas’s October 7, 2023, cross-border attack produced the largest single-day killing of Jewish people since the Holocaust. It marked Israel’s largest intelligence failure since the 1973 Yom Kippur War. The apparatus whose commercial products surveil populations worldwide failed to protect its own border.
Post-attack reporting identified several parts of the failure. Unit 8200 had reportedly stopped routine monitoring of some Hamas handheld-radio traffic. Border spotters repeatedly warned about exercises and preparations resembling an assault. Analysts held Hamas’s “Jericho Wall” plan but judged the operation beyond its capacity. Egyptian officials said they had warned Israel; the warning’s precision and routing remain disputed.
One assumption filtered these different signals. Hamas was considered deterred and uninterested in all-out war. On October 7, only two female spotters on duty survived without being killed or taken captive.
Commander Yossi Sariel resigned in September 2024, accepting responsibility for Unit 8200’s part in the failure. His resignation supplied neither a comprehensive public accounting nor sole ownership of the failure chain. Other institutions and decision-makers remained within it.
Unit 8200’s technical superiority is the capability RUSI compared favorably with the NSA. Alumni firms sell real-time monitoring internationally on its reputation for surveillance effectiveness. Meanwhile, the unit failed to prevent an attack prepared over an extended period against a border it specifically covered. Whether it adequately processed warnings remains part of that failure question.
The leading post-attack explanation concerns systemic judgment. Technology displaced human analysis. Military hierarchies suppressed junior personnel’s threat assessments, particularly those of women. The hakontzeptsia effect describes confirmation bias: the prevailing account filtered out conflicting signals. Substantial intelligence resources had also shifted toward West Bank settler protection amid escalating settler violence. That diversion reduced capacity for assessing Gaza threats.
Protective failure and commercial surveillance power coexist within the same apparatus. Its exported phone extraction and spyware did not secure the border against the prepared attack. Surveillance capability acquires its consequence through the direction of its use. A system effective at controlling populations can still fail to protect them.
References
Primary investigative sources:
- Forbidden Stories / Amnesty International, The Pegasus Project, July 18, 2021. Consortium of seventeen news organizations, eighty journalists.
- Citizen Lab, University of Toronto — multiple technical reports on Pegasus targeting, 2016–2024.
- Ronen Bergman and Mark Mazzetti, “The Battle for the World’s Most Powerful Cyberweapon,” New York Times Magazine, January 28, 2022.
- Antony Loewenstein, The Palestine Laboratory: How Israel Exports the Technology of Occupation Around the World (Scribe / Verso, 2023).
- Edward Snowden documents / The Guardian, September 11, 2013 — NSA-Unit 8200 raw-data sharing agreement (Greenwald, Poitras, MacAskill).
- Financial Times, July 10, 2015: “Unit 8200: Israel’s Cyber Spy Agency” — Peter Roberts (RUSI) quotation.
- Haaretz — Israeli police Pegasus misuse (January–February 2022); Barak-Epstein-Carbyne (July 2019); Cellebrite-Saudi Arabia (September 2020).
- Calcalist (Israel), January–February 2022 — Israeli police domestic Pegasus surveillance.
- Amnesty International, December 2024 — Serbia Cellebrite report; February 2025 follow-up.
- ANSSI (French cybersecurity agency), August 2, 2021 — independent confirmation of Pegasus on French journalists’ phones.
Corporate and regulatory record:
- U.S. Commerce Department Entity List designation, NSO Group, November 2021.
- WhatsApp LLC v. NSO Group Technologies Ltd., U.S. District Court, Northern District of California — Judge Phyllis Hamilton, December 2024 liability finding; May 2025 jury damages verdict.
- Cellebrite (CLBT) — Nasdaq listing documents, 2021.
- Axon Enterprise / Carbyne acquisition, November 2025.
Secondary scholarship:
- Peter Roberts (RUSI), quoted in Financial Times, July 10, 2015.
- Wall Street Journal, July 2007: “How an Elite Military School Feeds Israel’s Tech Industry” — on the Talpiot-to-tech pipeline.
- Signal / Moxie Marlinspike, April 2021 — technical disclosure of Cellebrite UFED vulnerabilities.
- Julie K. Brown, Miami Herald — Epstein/Acosta NPA investigation (2018–2019).
- Unit 8200 veterans’ open letter, September 2014 — forty-three signatories refusing Palestinian-territory intelligence operations.