What can declassified DIA reports on Palestinian Islamic Jihad tell OSINT researchers today?
Released Defense Intelligence Agency reports from 2001 and 2005 record how Palestinian Islamic Jihad was organized, where its cells operated, and what U.S. intelligence believed about its money. One 2005 report tied a Netanya suicide bombing to PIJ headquarters in Damascus and to Iranian funding. Those claims give researchers names, places, and dates to test against current infrastructure.
Key Takeaways
- A Defense Intelligence Agency release of field reports, once classified up to SECRET//NOFORN, covers the al-Aqsa Intifada in 2001 and Palestinian Islamic Jihad’s 2005 campaign in the West Bank.
- The July 13, 2005, report called the Netanya mall bombing a PIJ operation and said the attacks “represent Irans continued financial support of PIJ via Damascus.”
- Israeli military intelligence told DIA the Tulkarm cell behind the attack had daily contact with PIJ headquarters in Syria and called it after the bombing.
- The reports name twenty-eight people. The cables label them as PIJ suspects, PIJ members, or members of Hamas, Tanzim, and the al-Aqsa Martyrs’ Brigades. They are not one list of PIJ operatives.
- An OctoProbe investigation seeded with PIJ’s current identifiers traced its armed wing’s website, saraya.ps, to nameservers run by Derak Cloud, a company RIPE records place in Shiraz, Iran.
- FOIA does not always deliver. DIA released a usable Mariupol finding to me in 2026 but withheld 277 of 282 pages on Myanmar in full.
What Did DIA Report About Islamic Jihad?
The Defense Intelligence Agency released eight field reports that track the Israeli-Palestinian conflict from February 2001 to July 2005, and the agency has posted them in its electronic FOIA reading room. They are Intelligence Information Reports, or IIRs, raw field reporting that each one says is “not finally evaluated intelligence.” The same reports also appear in a 47-page PDF compilation whose file name carries the DIA case number FOIA-00308-2023. This article cites the reading-room copy of each report and the page of the compilation.
Two eras run through the set. The 2001 reports come from the first months of the al-Aqsa Intifada, the Palestinian uprising also called the Second Intifada. The 2005 reports come from the year Israel prepared to withdraw from Gaza, and Palestinian Islamic Jihad, or PIJ, kept attacking.
The markings tell their own story. The March 30, 2001, report carried the banner SECRET//NOFORN, which barred release to foreign nationals. The July 13, 2005, Netanya report was SECRET. Others were CONFIDENTIAL. DIA struck through each banner on release and blacked out what it still protects under FOIA Exemption 1, for classified information, and Exemption 3, for information that statutes such as 10 U.S.C. § 424 shield. The boxes in the images below are the government’s.
Quotations from the reports are given in sentence case. The originals are teletype in all capital letters, and their spelling, including missing apostrophes, is kept.
| Date | Event in the reports | Report (DIA reading room) |
|---|---|---|
| Feb. 28, 2001 | IDF Spokesperson’s Unit briefs on the “media war” of the Intifada | IIR, DOI Feb. 28, 2001 |
| March 30, 2001 | Israeli official says the IDF does not know “who the enemy is”; Egypt’s intelligence chief visited Israel | IIR, DOI March 30, 2001 |
| Feb. 8, 2005 | Sharm el-Sheikh summit; Israel later returns Tulkarm to Palestinian Authority security control | Sitrep, Feb. 1–3, 2005 |
| March 13, 2005 | Israel credits the PA with arresting three or four PIJ suspects in a Tel Aviv bombing | IIR, DOI March 13, 2005 |
| May 2, 2005 | Raid for a PIJ fugitive near Tulkarm kills an Israeli soldier and two PIJ members | IIR, DOI May 17, 2005 |
| June 21–22, 2005 | West Bank arrests of PIJ suspects; military court sentences | Sitrep, June 21–22, 2005 |
| July 12, 2005 | PIJ suicide bombing at the HaSharon Mall in Netanya; attempted car bomb at Savey-Shomron | IIR, DOI July 13, 2005 |
What Did the 2001 Reports Say About the Intifada?
The March 30, 2001, report captured an Israeli official six months into the uprising who saw no way out. He said he was “quite pessimistic about the future” and could not “see any agreement,” according to the report. The army’s challenge, he said, was “to fight only those who fight us and to ease the situation on the people.” That was hard, he said, because “we don’t know who the enemy is,” since the Israel Defense Forces and the Palestinian Authority’s security forces no longer coordinated.
The same report said the IDF would ease closures when it could but would also increase “deliberate actions against the enemy, even though it might escalate the situation.” It also reported that the director of Egypt’s General Intelligence Directorate, Maj. Gen. Omar Suleiman, spelled “Soliman” in the cable, had visited Israel two weeks earlier “to explore ways to keep the violence down to a manageable level.”
The February 28, 2001, report shows a second front. An IDF Spokesperson’s Unit officer described the Palestinian strategy as “violence begets coverage, begets violence, begets more coverage, begets legitimacy for more violence.” The report also logged traffic to the IDF’s own website. Weekly hits rose from 7,642 before the uprising to 130,680 in its fourth week. The most, about 3,500 a week, came from Saudi Arabia, “with a slightly lower number from Iran,” the report said. In 2001, that was a web-analytics finding filed as intelligence. Today it is the kind of signal an open-source researcher collects without a clearance.
What Did the Netanya Report Say?
The July 13, 2005, report is the core of the release. It said “the 12 July suicide bombing outside the HaSharon Mall in Netanya was a Palestinian Islamic Jihad (PIJ) operation.” It put the blast at 6:40 p.m. local time, with three to four kilograms of explosives and steel shrapnel, four killed and more than eighty-five injured. PIJ, it said, also attempted a suicide car bombing at Savey-Shomron in the West Bank forty minutes earlier.
The report gave PIJ’s purpose in two parts. First, the attacks sent the Palestinian Authority a message “that PIJ is a significant actor in the current situation,” it said. Second, “the attacks represent Irans continued financial support of PIJ via Damascus, and Iran and Syrias interest in disrupting disengagement from Gaza Strip.” PIJ claimed the bombing twice, the report said: once in a video by the bomber aired on Al Jazeera and once in “a statement from PIJ headquarters in Damascus, Syria.”
The command link was specific. Israeli Defense Intelligence “highlighted that the PIJ cell that conducted this attack has daily communication with the PIJ headquarters in Syria,” the report said. It added that Israeli intelligence knew of no order from Damascus to carry out the attack, but “this PIJ cell called its headquarters in Syria after this attack.”
The report also placed the cell. Tulkarm, returned to Palestinian Authority security control after the February 2005 Sharm el-Sheikh summit, “has become a center for this PIJ cells activity,” it said. The IDF went back in that night to arrest about ten members of a cell “led by Louis ((Saadi)).” The double parentheses are the cables’ way of marking a surname. “Louis” is a transliteration, and a researcher’s work starts there: the spelling has to be matched against Arabic-language and Israeli sources before it is treated as an identity.
The cable is one source, written a day after the attack, and it should be read that way. Israel’s letter to the United Nations on July 13, 2005, said the bomber carried “7 to 10 kilograms of explosives” and that “four women — two of whom were only 16 years old — were killed in this attack and 90 others were wounded.” The weight of the bomb differs from the DIA account. Comparing a classified report with what governments said in public is exactly what these releases make possible.
How Did U.S. Intelligence Assess PIJ’s Infrastructure in 2005?
Taken together, the 2005 reports describe PIJ’s structure as U.S. intelligence received it that year. Researchers can line it up like this:
- Command: A headquarters in Damascus that issued claims of responsibility and took calls from West Bank cells, according to the July 13 report.
- Money: Iranian financial support routed “via Damascus,” in the same report’s assessment.
- Field cells: A Tulkarm cell of about ten members, plus activity in the Jenin refugee camp, Qalqilya, Bethlehem, and nearby villages, according to the June 21–22 situation report.
- Tactics: Suicide bombings timed together “for a more spectacular effect with strategic consequences on the political situation,” the July 13 report said, and an attempted car bomb.
- Media: Video claims through Al Jazeera and from Damascus.
- Pressure: Arrests of PIJ suspects in Tel Aviv bombing cases. On March 13, an Israeli official faulted the Palestinian Authority for blaming that bombing on a “third party” without naming the perpetrators from PIJ, according to the report. A May 2 raid “to arrest a PIJ fugitive in Saida village” near Tulkarm killed an Israeli soldier and two PIJ members, according to the May 17 report.
None of that is finally evaluated intelligence, and much of it is an Israeli briefing relayed by DIA. Its value lies in the dates, places, and claims a researcher can now check.
The reports also carry errors that matter in research. One situation report is dated “20040208,” yet it reports that a Gaza crossing “was opened on Monday, 7 Feb 05” and sits with other 2005 reports. Its date line is off by a year. Teletype also drops apostrophes, and OCR turns the struck-through SECRET//NOFORN banner into strings like “SECRETFANF.” Every quotation in this article was checked against the page image, not the OCR.
Who Is Named in the Reports?
The reports name dozens of people, and the OctoProbe investigation extracted twenty-eight of them as name nodes. The cables do not call them all PIJ operatives. Fifteen appear as “PIJ suspects” detained or arrested in June 2005 sweeps. Six are labeled PIJ “member” or “activist,” most in military court sentences. Three are labeled Hamas members, two Tanzim members, and two members of the al-Aqsa Martyrs’ Brigades. All come from two situation reports, dated June 22, 2005, and, by the cable’s own typo, February 8, 2004.
Suspects are not convicts, and a 2005 arrest list is not a membership roster. The extraction also shows why a tool’s output needs a human check. For several February 2005 names, the investigation kept the given names and dropped the surname the cable marks in double parentheses. It also missed two people in the June list. Each name should be traced to the line that labels it before it is used.
Where Does PIJ’s Infrastructure Point Now?
PIJ’s current identifiers lead to Iranian and Chinese providers. The OctoProbe investigation began with two inputs about PIJ and grew to seventy-five nodes and ninety-one links over three rounds. Its anchors were the domain saraya.ps, three Telegram channels, and reference pages from the European Council on Foreign Relations and the National Counterterrorism Center. The center says PIJ “receives support from Iran and Lebanese Hizballah” and keeps “offices in Iran.” The DIA release was uploaded to the same investigation.
The site at saraya.ps was live on October 21, 2026. Its page title, in Arabic, calls it the site of Saraya al-Quds, “the military wing of the Islamic Jihad Movement in Palestine.” Its two nameservers, the internet servers that tell the world where a domain lives, are sara.ns.derak.cloud and sina.ns.derak.cloud. The network behind them, AS60423, is registered in RIPE’s records to E-Money Net Developers 24 Company, with Derak Cloud as its technical contact, both at addresses in Shiraz, Iran. One nameserver address sits in a block RIPE lists in Iran. Another sits at Hetzner, a German host. The site itself resolves to an address held by VDSina, a Russian hosting company.
The second domain is a lesson in stale leads. In August 2004, Israel’s Intelligence and Terrorism Information Center listed jimail.com/abrar as one of PIJ’s “subsidiary site” addresses, served by a Baltimore provider, according to Daily Alert. The same report named sarayaalquds.com as the armed wing’s site at the time. Today jimail.com uses DNSPod nameservers, Tencent’s free DNS service, and NetEase mail servers, and it resolves to Alibaba Cloud in China. Its current registration dates to November 19, 2004, after that report, so the domain may have changed hands. Nothing in the investigation ties today’s jimail.com to PIJ.
That is the caution for the whole map. DNSPod, NetEase, and Hetzner serve huge numbers of unrelated customers, and sharing one of them proves nothing. The Iranian nameservers on saraya.ps are a different kind of fact: a choice by whoever runs the armed wing’s site to put its DNS in Iran. That choice rhymes with what DIA reported in 2005. It is not proof of who pays for it today.
Native graph export from the investigation was not available for this draft, so the figure above is drawn from the investigation’s own node and link data.
Why Does a 2005 Report Matter Now?
The 2005 reports’ central claim, that Iran funded PIJ through Damascus, is the same relationship researchers track now. PIJ leader Ziyad al-Nakhalah declared this month that the “unity of the resistance forces in Palestine and in the region” would remain, JNS reported on October 13, 2026. PIJ said more than eighty of its fighters had been killed on the Lebanese front, according to the same report.
Old reporting gives that present a baseline. It tells a researcher where PIJ said its headquarters was, which towns its cells worked from, how it claimed attacks, and who U.S. intelligence believed paid. Each is a hypothesis to test against today’s domains, channels, and hosting records.
When Does FOIA Help, and When Does It Fail?
FOIA can hand a researcher a citable government finding, as the Kabul evacuation record does, or it can return little more than proof that records exist. Two requests I filed with DIA show both ends.
The useful end came on September 29, 2026. My request of March 21, 2023, FOIA-00121-2023, concerned a referral the Army’s Intelligence and Security Command had made, INSCOM FOIA Referral #0210F-22. DIA located three documents, fifteen pages, and released two in part. It withheld the third, one page, in full under Exemptions 1, 3, and 6, the last for personal privacy. What it released includes a paragraph from the April 18, 2022, Defense Intelligence Digest:
In mid-March, a Russian airstrike destroyed a theater in Mariupol, where approximately 1,000 people were sheltering, according to a press report. Commercial imagery from before the strike showed that the word “children” in Russian had been written in the front and rear of the facility, intending to identify the facility as a nonmilitary or noncombatant installation, according to a separate press report. We do not know whether Ukrainian Armed Forces or Azov Battalion forces were present at the theater during the strike.
Everything around that paragraph is blacked out, and stamps on the enclosures say the next six and seven pages “are denied in full.” The paragraph still does work. It is an agency’s written account, dated and portion-marked unclassified, that the word for children was visible before the strike. Its last sentence is just as useful: DIA put in writing that it did not know whether Ukrainian or Azov forces were inside. A researcher can cite both the finding and the stated gap.
The other end came on May 9, 2023. I filed FOIA-00028-2023 on October 27, 2022, asking for DIA reporting on genocide, ethnic cleansing, extrajudicial killings, and other human-rights abuses in Myanmar from January 1, 2016, to October 27, 2022. DIA’s search “located 55 documents (282 pages) responsive to your request,” the agency wrote. It referred one document, five pages, to another agency, because it “did not originate with DIA.” It withheld the other 54 documents, 277 pages, in full.
The letter cited Exemption 1, for information classified under Executive Order 13526, and Exemption 3, through two statutes. One, 10 U.S.C. § 424, “protects the identity of DIA employees, the organizational structure of the agency, and any function of DIA,” the letter said. The other, 50 U.S.C. § 3024(i), “protects intelligence sources and methods.” DIA wrote that it “has not withheld any reasonably segregable non-exempt portions of the records.” The 2026 Ukraine letter used the same sources-and-methods language but cited subsection 3024(h), a small inconsistency worth noting in any appeal.
That is a sources-and-methods denial, not a finding that the subject is off-limits. It still leaves a researcher with metadata only: DIA holds 54 documents on abuses in Myanmar over those six years, and one more came from elsewhere. The topic is also diplomatically delicate, human-rights reporting on a country where Washington balances pressure against engagement. The count is a lead in itself. It is the basis for an appeal, which the letter allowed within ninety days, or for a request to the agency that holds the referred document.
How This Story Was Reported
Quotations were checked against the DIA page images and matched to the reading-room copies on DIA’s website. The OctoProbe investigation (633e8a09) was pulled through the platform’s API on October 21, 2026, with DNS records checked the same day through Google Public DNS and network holders through RIPEstat. Telegram channels are identified by handle only. Both FOIA letters are my own, with my name and addresses blacked out in the images.
