☰Series Navigation (13 parts)
Everything in this series so far has been about code: a worm, a cyberweapon, a swarm of software agents.
This one is about explosives in people’s pockets. I find it hard to read about, whatever anyone thinks of the group it was aimed at, and security people who study it as a clever operation and stop there are missing the point. It belongs in this series because the mechanism is the same one, and the cost is written on people’s hands and faces.
The victims did the same thing Iran did at Natanz and the same thing every organization in this series did. They looked at their risk, decided the safe move was to get off the compromised channel, and moved to something they believed the enemy couldn’t reach. Iran built an air gap. Hezbollah bought pagers. Both times, the thing they trusted to keep them safe was already owned by the people they were hiding from, and the trust itself was the weapon. The blast is different. The lesson underneath it is identical.
What happened in the Hezbollah pager attack?
On the afternoon of September 17, 2024, at around half past three local time, pagers carried by Hezbollah members across Lebanon began to buzz with an incoming message. As people lifted the devices to read them, the pagers exploded, thousands of them at nearly the same moment, in homes, cars, shops, and streets.
The next day, September 18, it happened again with a different device. Two-way radios, the walkie-talkies Hezbollah used for its communications, detonated across the country. Some went off at funerals being held for the people killed the day before, where members had gathered to mourn. The second wave killed more people than the first.
Across the two days, at least 42 people died, including a reported dozen or so civilians and several children.
Between 3,500 and 4,000 were wounded. The injuries were concentrated where a person holds a device: the hands, the face, the eyes. Ten months later, survivors were still going through surgeries and learning to live with what the blasts took. Among the wounded on the first day was Iran’s ambassador to Lebanon.
The design detail I can’t get past is that the device asked to be looked at.
It buzzed, and the person holding it brought it up to their face to read the message. Whoever planned that knew exactly where on a human body the blast would land. I think that deserves to be said out loud before anyone starts admiring the tradecraft.
Israel didn’t claim the attack at first. Prime Minister Benjamin Netanyahu publicly confirmed Israeli responsibility in November 2024, describing it as an operation carried out over the objections of some senior officials. He has since presented it as a demonstration of Israeli technical and intelligence skill.
Why was Hezbollah using pagers in the first place?
The reason it belongs in this series sits here, so it’s worth slowing down on.
Hezbollah knew its phones were a liability. A modern smartphone is a tracking device that also makes calls.
It reports its location, it can be turned into a microphone, and an intelligence service with the right access can intercept its communications. For a militant group whose members are targets, carrying a smartphone is carrying a homing beacon, and Israel had a long record of using exactly that kind of access to find and kill people.
So in early 2024, Hezbollah made what looked like the smart, security-conscious decision. It moved off smartphones and onto pagers. A pager is about as dumb as an electronic device gets. It receives short messages and nothing else. It has no GPS, no microphone, no camera, no apps, no internet connection. It can’t be tracked the way a phone can, because there’s almost nothing in it to track. On paper, moving to pagers closed the exact hole Hezbollah was worried about.
That decision was their air gap. It was a deliberate step to a simpler, more isolated technology because the sophisticated one was compromised. And like the air gap at Natanz, it protected against the threat they were looking at while leaving them wide open to the one they weren’t.
Most security people would have made the same call, and I’d have signed off on it myself. Getting off a compromised channel is the textbook move, and that’s what makes this attack so uncomfortable for my field. The defenders did what we teach, and the attacker had planned for exactly that response.
How did Israel get bombs into the devices?
Not by intercepting a shipment and rigging it in a warehouse, though that has been done in other operations. This was deeper. Israel reportedly became the supplier.
The pagers carried the brand of Gold Apollo, a real Taiwanese company. But Gold Apollo didn’t make the deadly batch. It had licensed its name to a company in Budapest called BAC Consulting.
According to reporting in the New York Times, BAC and at least two other shell companies were Israeli intelligence fronts, created to manufacture and sell rigged hardware while hiding any link to Israel. Hezbollah reportedly ordered around 5,000 pagers through an intermediary and handed them out to its people. The explosives were built into the devices during manufacture, hidden in a way that survived ordinary handling and inspection.
The devices were attractive for exactly the reasons a careful buyer would want: long battery life, rugged, reliable, able to carry encrypted messages. They were good products. That was the point. A front that sells junk gets found out. A front that sells a good pager builds a reputation, wins the order, and delivers the weapon inside a device the customer is glad to have.
The radios followed the same logic through a murkier path. The walkie-talkies bore the markings of ICOM, a Japanese manufacturer, and matched a model, the IC-V82, that ICOM said it had discontinued around a decade earlier and no longer supplied. Whether those were counterfeits built to look like ICOM units or real units diverted and rigged, the structure was the same: a trusted-looking device, sold into Hezbollah’s supply chain, carrying a bomb the buyer never suspected.
I’m not going to walk through how the attackers built or triggered the explosive charges. That detail is available elsewhere for anyone who wants it, and it adds nothing to what I care about here. The weapon that matters to me is the trust, and the chemistry was only the way the attackers delivered it.
Was the pager attack legal?
This is contested, and both sides deserve a fair hearing, because serious people disagree about it and I can’t settle it for anyone.
A group of United Nations human rights experts called the explosions a terrifying violation of international law. Their core argument is about discrimination. At the moment thousands of devices detonated, there was no way to know who was holding each one or who was standing next to them. A pager could be in a fighter’s pocket, or on a kitchen table next to a child, or in the hand of a medic.
International humanitarian law requires an attacker to distinguish between combatants and civilians and to weigh whether harm to civilians is proportional to the military gain. The objection is that a weapon detonating in thousands of unknown locations at once can’t meet that standard by design. Human Rights Watch and several legal scholars raised a second problem.
A body of law prohibits booby-traps built into ordinary, harmless-looking portable objects. That’s close to a literal description of what these devices were.
The other side has serious advocates too. They argue the devices went to Hezbollah’s members, that Hezbollah is a party to an armed conflict with Israel, and the operation hit the group’s fighters while sparing the wider population a bomb on a building would have caught.
On this view the attack was a more discriminating use of force than the alternatives, and defensible under the laws of war. Some also note that Israel hasn’t ratified the booby-trap protocol critics cite, a gap that complicates the legal claim even if it doesn’t settle the moral one.
I’m a technology person, and I won’t pretend the legal question resolves cleanly.
The disagreement is real, and both sides are arguing in good faith about how centuries-old rules apply to a new kind of weapon. What worries me more is the precedent. Every weapon in this series got copied once it proved it worked, and I don’t expect the next government that rigs a supply chain to limit itself to targets it can justify.
Why does the pager attack belong in a series about isolation?
Because the pager attack is the physical, brutal proof of the thing every other article here argues in software.
Hezbollah did the security-conscious thing. It identified that its communications were compromised, and it withdrew to a simpler, more isolated technology to protect itself. That’s textbook defensive thinking, the same instinct that builds an air gap around a nuclear plant. And it failed for the same reason the air gap at Natanz failed: an attacker who had made themselves part of the supply the victim trusted defeated the isolation upstream, before the device ever reached the user.
There’s no patch for this, no setting to change, no scanner that catches it.
Hezbollah could have inspected those pagers and found nothing wrong, because there was nothing wrong with them as pagers. They worked. They just also belonged to the enemy from the moment they were built. When the people you’re protecting yourself from make the thing you buy to protect yourself, no amount of care with the device saves you.
Ten months after the blasts, survivors were still going through surgeries, and I think that fact belongs in every conversation about this operation. It gets described as brilliant far too often, as if the brilliance cancels out the people who happened to be standing next to a pager when it went off. Security people can learn everything this attack has to teach without admiring it, and I wish more of them would.
The next article stays with the pagers and takes apart the supply-chain lesson in full: why going low-tech didn’t help, and what it means for anyone, in any field, who buys hardware through layers of resellers they’ll never meet. For the wider view of security, the cybersecurity hub collects the rest of my work.
