What Makes Israel So Good at Hacking?

Let’s not go there in this video… Love’em or hate’em, Israel is pretty good at hacking. Fighting off invasions by neighboring countries from day one, it’s since consolidated into a cyber superpower. Flame, Stuxnet, Duqu, Gauss.

Offensive cyber toolkits like these have frustrated Iran’s nuclear programs again and again. Israel’s even hacked Kaspersky, catching the Russian government using their anti-virus software as a global search engine for classified data. From monitoring mobile comms, intercepting satellite traffic, tapping undersea fiber cables, some consider Israeli intelligence to be on par with the NSA, maybe even spying on them too, having been ranked the third most aggressive actor against America.

And that’s not counting the private sector, second only to the US in its VC funding for cybersecurity. We’re punching 200 times above our weight. Besides the usual buffet of cybersecurity firms, there’s boutique ones too, specializing in offensive cyber.

Companies like WiSpear, which sells interception vans, NSO Group, which crafts zero-day mobile phone exploits, and other shady companies selling off-the-shelf hacking tools to organizations who are willing to pay premium prices for nation-state level cyber capabilities. So that got me thinking. .

. How does a country with a population of about New York city even get so good at cyber? I mean at a glance, there’s really not much there.

Let’s go back to the beginning, to one of Israel's lowest moments. The Yom Kippur War was the biggest Intelligence failure in Israel’s history. Caught off guard in a joint invasion by Egypt and Syria, Israel suffered unexpected losses in the opening days of fighting.

Positions being overrun, panic and confusion spreading across the country… Lack of strategic depth is one of Israel’s biggest weaknesses; its narrowest point being only 9. 3 miles wide. So being unprepared for battle is a quick path to defeat and extinction.

1973 was an embarrassment that forced the entire military-political establishment to resign, leading Israel to completely revamp its intelligence forces into an early warning system like no other. Yehida Shemone Matayim, Unit 8-200. 8200 has become one of the largest units in Israel, from 5,000 to 10,000 people if you include reservists.

In charge of signals intelligence, they’re also the offensive cyber operations arm for the country. Involved with every major operation, it supplies 90% of all Israel’s intel for clients like the Mossad, Shin Bet, and other special units. These relationships combine physical and remote hacking methods to help them project regional power.

Take Operation Outside the Box, a bombing run of Syria’s nuclear reactors. The Mossad broke into a Syrian official’s hotel room to plant malware on his computer, which then let 8200 discover secret nuclear plans and pictures. To verify the target, they monitored communications in the area, while commandos raided the facility to collect soil samples.

During the bombing run, a hacking plane injected code into Syria’s air defense systems to show clear-skies on enemy radar screens. Ever since its Yom Kippur humiliation, Israel has become an intelligence powerhouse, anticipating conflict far in advance. Its cyber units are designed to support Israel’s national defense strategy of avoiding long wars of attrition and projecting the image that Israel can act on its own without any allies.

Strike first, defensible borders, deterrence, decisive victory, and close coordination with traditional military units for kinetic action. It’s kind of like Krav Maga, their close combat system, where you avoid fighting, but strike with massive violence when provoked, targeting body parts that cause permanent injury or death. That’s the basis of Israel’s cyber-intelligence apparatus: to enable its defense policy of fighting in a way that makes up for any size or numeric disadvantages.

You might be thinking of ganging up on me. But just remember what I do to people who try to hurt me. But hold on a second: how do you actually build up a cyber force that can support all this in the first place?

There’s no crotch kicking your way to success when it comes to cybersecurity. I’m wondering if there’s anything we can learn as a reproducible model for cyber security teams and other countries to follow. Let's find out!

So there’s a concept called Revolution in Military Affairs, that lets a country boost its power by orders of magnitude. I first came across the term in the book, Unrestricted Warfare, written by two senior PLA colonels. It’s one of the first to introduce legal, economic, and cyber as other forms of warfare.

The authors really liked this guy called Andy Marshall. He ran a secret Pentagon think tank called the Office of Net Assessment. According to Marshall, RMA is all about how well you operate and organize your people with technology.

For instance, before WW2 the French and Germans both had access to planes, tanks, and radios. But the French layered on old WW1 doctrines, producing the Maginot Line. an expensive series of fortresses focused on a defensive war of attrition.

The Germans had their military stripped down after losing, and had to completely reorganize everything. They made a lighter, mobile strategy called blitzkrieg, using tanks and air support in ways never seen before. You can probably guess who won the fight.

When it comes to cyber power, it’s no different. Everyone pretty much has access to the same technologies and tools. The key differentiating factor is all about how you organize human capital, and innovate on operational concepts, and that’s where Israel wins.

So the IDF is like one big HR department for the country. Each year, over 60,000 guys and gals assess into different units based on school grades, personality, and IQ tests. High scores mean tech units like 8200, while low scores mean the border police.

Getting into the right one is key for job interviews down the road in your professional career. It’s a lot of brand-signaling, kind of like going to Harvard or MIT. But the selection process begins as early as kindergarten, with teachers using games and activities to form class distributions later.

Elementary school kids take intelligence tests, with high performers getting better extracurricular development. In high school, afterclass cyber programs help train and identify young talent for military tech units. When it’s time to enlist, formal interviews and tests screen for recruits who are self-taught learners who can solve problems creatively, and are also nice to work with.

But just getting in the door of 8200 doesn’t prove you’re actually good. There’s tons of sub-units and even more subtopics within. For placement into the right team, you go through a 6-month mind bootcamp, where from dawn to dusk, you’re learning programming, Arabic, project management, and intelligence tradecraft.

You’re then organized in small teams working on projects that mimic real-world missions with tight deadlines. There’s a similar model used at Carnegie Mellon’s capture-the-flag team, one of the best in the world. First, get lots of high school students to try out in PicoCTF and pick the top 50 performers.

For those who end up at Carnegie Mellon, train them with coursework and actual CTFs. Then have these guys run the next year’s PicoCTF selection process. You basically funnel the most people through the smallest filter, invest in the ones that make it, then use them to recruit new replacements.

But technical chops aren't everything. You also gotta find personalities with the right cultural fit. There’s four key traits that technological units like 8200 look for: Chutzpah, audacious, doing what no one else is willing to do.

Rosh Gadol, taking initiative and doing things the best way possible, even if it means more work because you see the bigger picture. Bitzua, being resourceful at getting things done. Davka, doing things despite a situation and rubbing it in just on purpose.

So there was this one chemistry test in middle school where I left my calculator at home, and the teacher wouldn't let me borrow another one. Super frustrating, I had to figure out which clear liquid was alcohol or antifreeze. Just to spite her, I taste-tested them when she wasn’t looking and passed the test.

Now, I’m far from being an IDF poster boy, but that’s the kind of person I’d look for to hack into people’s networks. But being a motivated nerd with authority problems isn’t enough. You’ve also got to be good at getting along with others you work with.

When you go from being the smartest person in the room to being surrounded by others who are just as good or smart as you, it’s easy to be stubborn and try to one-up others to prove yourself. That’s why learning to work with others collaboratively in a group is also a quality they look for, especially in later stage practical assessments. Brains, personality, and teamwork.

People who have these traits often end up in units doing the most exclusive offensive cyber and intelligence work in the IDF. Something doesn’t quite add up. Just getting the best people is half the battle.

You need to put them in the right environment too and figure out how to retain that talent. When I was in the military doing cybersecurity, one of the biggest problems was retention. Basically every single person who had some technical ability left as soon as they could.

It really boiled down to three things: meaningful work with other talented people for a higher purpose you truly believed in. But the environment we were in just didn’t make it possible. All the smart folks ended up doing admin work, and those lucky few that got a technical role were surrounded by others who really weren’t qualified for the job.

The layers of bureaucracy were crushing, and it didn’t feel like your individual actions had much of an impact on the big picture. Price’s law suggests that the square root number of people in an organization does half the work. So with 100 people, that’s just 10.

36 people, it’s 6. In a tall hierarchy, your best players get separated by layers of bureaucracy. So imagine an organization of 6400 people.

That’s like 1% of the organization doing all the work. To make things worse, your friends in the private sector are making 3-4 times as much money doing things they actually want, and expressing any desire to leave the service to join them is strongly discouraged. So after you do finally get out, people want to run as far away from that old life as they can, for instance, a YouTuber.

Contrast that with Israel’s cyber units where people coming in the door are heavily pre-screened so there’s a baseline standard of quality people to work with. Recruits are organized into smaller, flatter, flexible teams, in a culture where it’s encouraged to challenge the status quo. In some cases, it feels less like the military and more like working at a tech startup, where your hard work has a clear and direct impact on the outcome and mission.

IDF cyber soldiers are given lots of responsibility from a young age, so while their peers in other countries are spending their formative years iin college, partying away at academic life, they’re grinding 18 hour days on real-world missions, stressing out if the targets they helped bomb were terrorists or Palestinian families. They’ve fully brought into the idea that what they do matters, and working hard to deliver the right intel means life or death for people. Because after it’s all over, there's a lucrative career path waiting for them on the other side.

Coming from brand-name training grounds like Unit 8200, 81, Talpiot, and Havazalot means there's a community of old grads from those same units working in industry waiting to usher you into the next level of Israeli society. So instead of scattering off to the four winds after the IDF, all this human capital that Israel’s refined and developed gets concentrated in the same local geography with veterans continuing to serve in the reserves until they’re 48. Everyone knows everyone, with one degree of separation, creating rich social networks that form what Harvard Business Review calls “Economic Clusters”.

These dense communities are what Silicon Valley is for tech and Wall Street is for finance, geographic hubs that drive innovation and productivity at the world-class level. Israel’s small size has actually become a key part of its strategic cyber advantage. Somewhere in the Negev desert, Israel’s building this advanced technologies park, where companies, academia, and military cyber units are co-locating.

It’s a military-technological complex, blending policy, theory and practice together. Public-private partnerships like these are incubators for a new source of cyber talent, where young service members get to work in tandem with civilian researchers, entrepreneurs and industry practitioners. A sneak peak at Ben Gurion University’s Cyber Labs shows 12 ways to hop an air gap using malware.

They have proof-of-concept covert channels to communicate over heat, LED, infrared, magnetic fields, hard drive sounds, fan vibrations, and more. In Israel, academic research projects like these may one day be operationalized on a mission or productized in a startup. So how does a country create a cyber ecosystem like this in the first place?

Well, it all boils down to building up human capital, and reinvesting it back into the community to compound over time, which could look something like this: First, you need to have the political will to wanna be a cyber power to begin with. It could be a high-profile attack, something existential or humiliating at the national level that motivates leaders across the country to want to spend money on your cyber force, and more importantly, cut out any bureaucracy that would get in the way. The next step is to recruit a group of practitioner-educators from the private sector with existing expertise in cybersecurity, to staff and train the unit.

Concentrate the initiative in a small geographic area, ideally somewhere cosmopolitan and a nice place to live. Have these guys design and build programs and assessment pipelines that draw from school-age students. During selection, pick candidates who are self-taught learners and creative at figuring out problems they’ve never seen before, especially when it comes to programming, networking, and security topics.

You want to find novices who can quickly get to the intermediate level with just a little formal training. You’re also looking for personality traits that make them independent self-starters who are daring at getting things done. These are the guys that makes it to the training pipeline.

During the training, don’t just dole out lectures and homework. Organize recruits into small teams working on projects modeled after real-world scenarios that the teaching staff has experienced themselves. Harvard Business School’s case study method is a great place to start.

Put the recruits in stressful group projects with tight deadlines and screen for the ones who can quickly learn to work with each other as a team and drop the ones who are self-absorbed or struggle to adapt. Once you’ve got the cream of the crop, get them leveled up for a few years working high-impact missions with plenty of freedom, funding, and minimal bureaucracy. Invest in their personal development along the way, take action on their feedback, and help them transition to the private sector if they want to move on somewhere else.

This way, you’re building a brand-name reputation for the unit as a hard place to get into, an awesome place to work, and a launchpad for promising future careers. But before they leave, put the guys on their way out in charge of running the selection process for new recruits to close the loop on your cybersecurity human capital engine. By having the best talent reinvest in the next generation and seed more organizations when they leave.

You’ll eventually build a diverse community of cyber talent, cross-pollinating across business, academia, and government. In 10-20 years, you’ll be well on your way towards becoming a cybersecurity powerhouse. So, what do you think makes Israel so good at hacking, and is their model reproducible in other countries?

Let me know in the comments below! If you enjoyed this video, share it with friends and other people you know. Thanks so much for watching and hope to see you soon!