‘A million calls an hour': Israel relying on Microsoft cloud for expansive surveillance of Palestinians

The Guardian

4 days ago

One afternoon in late 2021, Microsoft's chief executive, Satya Nadella, met with the commander of Israel's military surveillance agency, Unit 8200. On the spy chief's agenda: moving vast amounts of top secret intelligence material into the US company's cloud.
Meeting at Microsoft's headquarters near Seattle, a former chicken farm turned hi-tech campus, the spymaster, Yossi Sariel, won Nadella's support for a plan that would grant Unit 8200 access to a customised and segregated area within Microsoft's Azure cloud platform.
Armed with Azure's near-limitless storage capacity, Unit 8200 began building a powerful new mass surveillance tool: a sweeping and intrusive system that collects and stores recordings of millions of mobile phone calls made each day by Palestinians in Gaza and the West Bank.
Revealed here for the first time in an investigation by the Guardian with the Israeli-Palestinian publication +972 Magazine and Hebrew-language outlet Local Call, the cloud-based system – which first became operational in 2022 – enables Unit 8200 to store a giant trove of calls daily for extended periods of time.
Microsoft claims Nadella was unaware of what kind of data Unit 8200 planned to store in Azure. But a cache of leaked Microsoft documents and interviews with 11 sources from the company and Israeli military intelligence reveals how Azure has been used by Unit 8200 to store this expansive archive of everyday Palestinian communications.
If you have something to share about this story, you can contact Harry Davies and Yuval Abraham using one of the following methods.
Secure Messaging in the Guardian app
The Guardian app has a tool to send tips about stories. Messages are end to end encrypted and concealed within the routine activity that every Guardian mobile app performs. This prevents an observer from knowing that you are communicating with us at all, let alone what is being said.
If you don't already have the Guardian app, download it (iOS/Android) and go to the menu. Select 'Secure Messaging'.
To send a message to Harry and Yuval please choose the 'UK Investigations' team.
Signal Messenger
You can message Harry using the Signal Messenger app. Use the 'find by username' option and type hfd.32
Email (not secure)
If you don't need a high level of security or confidentiality you can email [e-mail]
SecureDrop and other secure methods
If you can safely use the tor network without being observed or monitored you can send messages and documents to the Guardian via our SecureDrop platform.
Finally, our guide at theguardian.com/tips lists several ways to contact us securely, and discusses the pros and cons of each.
According to three Unit 8200 sources, the cloud-based storage platform has facilitated the preparation of deadly airstrikes and has shaped military operations in Gaza and the West Bank.
Thanks to the control it exerts over Palestinian telecommunications infrastructure, Israel has long intercepted phone calls in the occupied territories. But the indiscriminate new system allows intelligence officers to play back the content of cellular calls made by Palestinians, capturing the conversations of a much larger pool of ordinary civilians.
Intelligence sources with knowledge of the project said Unit 8200's leadership turned to Microsoft after concluding it did not have sufficient storage space or computing power on the military's servers to bear the weight of an entire population's phone calls.
Several intelligence officers from the unit, which is comparable to the US National Security Agency (NSA) in its surveillance capabilities, said that a mantra emerged internally that captured the project's scale and ambition: 'A million calls an hour'.
The system was built to sit on Microsoft's servers behind enhanced layers of security developed by the company's engineers with Unit 8200's instructions. The leaked Microsoft files suggest that a large proportion of the unit's sensitive data may now be sitting in the company's datacentres in the Netherlands and Ireland.
Disclosures about the role of Microsoft's Azure platform in the surveillance project come as the US tech giant faces pressure from employees and investors over its ties to Israel's military and the role its technology has played in the 22-month offensive in Gaza.
In May, an employee disrupted a keynote speech by Nadella in an act of protest, at one point yelling: 'How about you show how Israeli war crimes are powered by Azure?'
After the Guardian and others revealed in January Israel's reliance on Microsoft technology during the war in Gaza, the company commissioned an external review of the relationship. The review, Microsoft said, had 'found no evidence to date' that Azure or its AI products were 'used to target or harm people' in the territory.
A senior Microsoft source said the company had held conversations with Israeli defence officials and stipulated how its technology should be used in Gaza, insisting Microsoft systems must not be employed for the identification of targets for lethal strikes.
However, Unit 8200 sources said intelligence drawn from the enormous repositories of phone calls held in Azure had been used to research and identify bombing targets in Gaza. One of the sources said that when planning an airstrike on an individual located within densely populated areas where high numbers of civilians are present, officers would use the cloud-based system to examine calls made by people in the immediate vicinity.
The sources also said use of the system had increased during the campaign in Gaza, which has killed more than 60,000 people in the territory, the majority of whom are civilians, including over 18,000 children.
According to health officials in Gaza, at least 60,000 people have been killed during Israel's current military campaign, launched after the Hamas-led attack on 7 October 2023 which killed nearly 1,200 people.
The actual death toll is likely to be significantly higher, as the figure only includes Palestinians killed by bombs or bullets whose bodies have been recovered, leaving out thousands trapped under the rubble or killed by starvation and other indirect victims of the campaign.
According to the data – which includes the deaths of militants – women, children, and elderly people account for approximately 55% of the recorded deaths.
But the initial focus of the system was the West Bank, where an estimated 3 million Palestinians live under Israeli military occupation. Unit 8200 sources said the information stored in Azure amounted to a rich repository of intelligence about its population that some in the unit claimed had been used to blackmail people, place them in detention, or even justify their killing after the fact.
'When they need to arrest someone and there isn't a good enough reason to do so, that's where they find the excuse,' one said, referring to the information stored in the cloud.
A Microsoft spokesperson said it had 'no information' about the kind of data stored by Unit 8200 in its cloud. They said the company's 'engagement with Unit 8200 has been based on strengthening cybersecurity and protecting Israel from nation state and terrorist cyber-attacks'.
'At no time during this engagement,' they added, 'has Microsoft been aware of the surveillance of civilians or collection of their cellphone conversations using Microsoft's services, including through the external review it commissioned.'
The driving force behind the cloud project – described by one source as a 'revolution' within the unit – was Sariel, commander of Unit 8200 between early 2021 and late 2024. A career intelligence officer, Sariel was a strong advocate for projects of this scale.
Following a 2015 wave of deadly so-called 'lone wolf' attacks by young Palestinians, many of whom were teenagers unknown to the security services, Sariel had overseen a significant expansion of the volume of Palestinian communications that Unit 8200 intercepted and stored.
His answer was to begin 'tracking everyone, all the time', said an officer who worked for Sariel at the time. Instead of traditional surveillance of specific targets, Sariel's project relied on mass surveillance of Palestinians in the West Bank and used novel AI methods to extract insights.
'Suddenly the entire public was our enemy,' said another source who worked on the project, which sought to predict whether someone represented a threat to Israeli security.
One system developed in this period, sources said, scanned all text messages between Palestinians in the West Bank and assigned each message a risk rating based on an automated analysis of whether it included words deemed to be suspicious. Still in use, the system – known as 'noisy message' – can identify text messages in which people talk about weapons or discuss wanting to die.
When Sariel became Unit 8200 commander in early 2021, he prioritised forging a partnership with Microsoft that would give the unit the ability to go further and capture and analyse the content of millions of phone calls each day.
At his meeting with Nadella later that year, Sariel does not appear to have explicitly stated his plan to store Palestinian phone calls in the cloud, referring instead to 'sensitive workloads' of secret data, according to internal records of the meeting.
But documents suggest that Microsoft engineers understood the data stored in Azure would include raw intelligence, including audio files, while some Israel-based Microsoft staff, including alumni of Unit 8200, appear to have known about what the unit hoped the joint project would achieve.
'You don't have to be a genius to figure it out,' one source said. 'You tell [Microsoft] we don't have any more space on the servers, that it's audio files. It's pretty clear what it is.'
Microsoft's spokesperson said: 'We are not aware of Azure being used for the storage of such data.' They said Unit 8200 was simply a customer of its cloud services and Microsoft 'did not build or consult with Unit 8200' on a cloud-based surveillance system.
However, in early 2022, Microsoft and Unit 8200 engineers worked quickly and closely together to design and implement advanced security measures within Azure to meet the unit's standards. 'The rhythm of interaction with [the unit] is daily, top down and bottom up,' one document noted.
Among Microsoft staff, the project was shrouded in considerable secrecy and engineers were told not to mention Unit 8200 by name. Under the plan, vast troves of raw intelligence material would sit in Microsoft's datacentres overseas.
Files suggest that by July this year, 11,500 terabytes of Israeli military data – equivalent to approximately 200m hours of audio – was held in Microsoft's Azure servers in the Netherlands, while a smaller proportion was stored in Ireland. It's unclear if all of this data belongs to Unit 8200; some may belong to other Israeli military units.
According to the files, Unit 8200 informed Microsoft that it planned to move over time as much as 70% of its data, including secret and top secret data, into Azure and was willing to 'push the envelope' with the kind of sensitive and classified information that intelligence agencies normally held on their own servers. 'They're always trying to challenge the status quo,' one executive noted.
Asked about Sariel's meeting with Nadella, Microsoft's spokesperson said it 'is not accurate' to say the CEO provided his personal support for the project with Unit 8200. They said Nadella 'attended for 10 minutes at the end of the meeting' and there was 'no discussion' of the content of the data the unit planned to move into Azure.
However, according to internal Microsoft records of the meeting seen by the Guardian, Nadella offered support for Sariel's aspiration to move so much of the elite surveillance unit's data into the cloud, described earlier in the meeting as including sensitive intelligence material.
'Satya suggested that we identify certain workloads to begin with and then gradually move towards the 70% mark,' one record states. It adds that Nadella said 'building the partnership is so critical' and 'Microsoft is committed to providing resources to support.'
Several months before meeting Microsoft CEO Nadella in 2021, Sariel had published a book about artificial intelligence under a pen name – revealed by the Guardian to be the spy chief's – in which he urged militaries and intelligence agencies to 'migrate to the cloud'.
Known within Israeli intelligence as a tech evangelist, Sariel valued what he characterised to colleagues as a friendly relationship with Nadella, according to a senior intelligence source. 'Yossi bragged a lot, even to me, about his connection with Satya,' they said. (Microsoft denied that Nadella and Sariel had a close relationship.)
'He sold [the partnership] internally and got a huge budget,' another former intelligence colleague said. 'He claimed it was the solution to our problems in the Palestinian arena.'
Sariel declined to comment and referred the Guardian's questions about the project to the Israel Defence Forces. An IDF spokesperson said its work with companies such as Microsoft was based on 'legally supervised agreements'.
They added: 'The IDF operates in accordance with international law, with the aim of countering terrorism and ensuring the security of the state and its citizens.'
After publication, the IDF issued a new statement. 'We appreciate Microsoft's support to protect our cybersecurity. We confirm that Microsoft is not and has not been working with the IDF on the storage or processing of data.'
For its part, Microsoft viewed the multiyear partnership as a lucrative commercial opportunity. Executives anticipated hundreds in millions of dollars in revenue and 'an incredibly powerful brand moment' for Azure, according to the files.
'[Unit 8200's] leadership hopes to expand the mission-critical work tenfold in the coming years,' one executive noted.
As Unit 8200 began to make use of Azure's storage capabilities in 2022, intelligence officers rapidly grasped the new powers at their disposal. 'The cloud is infinite storage,' one source familiar with the system said.
Calls – which include calls made by Palestinians to international and Israeli numbers – are typically retained in the cloud for about one month, though storage can be scaled up, allowing the unit to keep hold of calls for longer periods of time when needed, several intelligence sources explained.
This allows the unit to go back in time and retrieve the phone conversations of people who become of interest, they said. Previously, surveillance targets would need to be pre-selected for their conversations to be intercepted and stored.
Several of the sources insisted the cloud-based system had prevented deadly attacks against Israelis. One said 'saving lives' of Israelis was the principal motivation behind Sariel's vision for the system. But it notably failed to prevent the Hamas-led attacks of 7 October 2023 in which nearly 1,200 people were killed in southern Israel and 240 people were kidnapped.
In the wake of the attacks, Sariel faced criticism for his apparent prioritisation of 'addictive and exciting' technology over old-fashioned intelligence methods, which some critics said contributed to the disaster. Sariel resigned last year, accepting responsibility for '8200's part in the intelligence and operational failure'.
In the ensuing war in Gaza, the cloud-based system pioneered by Sariel has been put to frequent use alongside a series of AI-driven target recommendation tools also developed on his watch and debuted by the military in a campaign that has devastated civilian life and created a profound humanitarian crisis.
Israel's destruction of Gaza's telecoms infrastructure has reduced the volume of phone calls in the territory but sources said the information held in the cloud remained useful. According to one, enthusiasm for the system had grown among intelligence officers working on Gaza as the war progressed and they saw the military is 'heading towards long-term control there'.