Supply chain attack turned pagers into killer devices in Lebanon?

The pagers used by Iran-backed militant group Hezbollah, with no GPS capabilities, no microphones and cameras, were meant to avoid Israeli surveillance. Instead, they turned out to be killer devices as several pagers detonated across Lebanon within a span of 30 minutes on Tuesday, leaving nine dead and over 3,000 wounded.
But, what led to the old-school communication devices, which became largely obsolete in the early 2000s, to explode? Experts and former intelligence officials have called it a prime example of a “supply chain attack”, which involves infiltrating a supplier and placing a small amount of explosives inside the new pagers.
Hezbollah has blamed Israel’s Mossad, one of the most feared and controversial intelligence agencies, for the explosions that came amid a broader war in the Middle East.
The 1,000-odd pagers, developed by Taiwanese company Gold Apollo, were from a new shipment that Hezbollah had received in recent days. However, Gold Apollo has claimed that the devices were made by a Budapest firm, called BAC Consulting KFT, which has a licence to use the Taiwan firm’s brand name.

Gold Apollo’s office in the city of New Taipei (AFP)

It is highly likely that the shipments were intercepted by Mossad before being imported to Lebanon. A small quantity of PETN, a highly explosive material, is likely to have been placed in the batteries of the devices, according to a report in The Times of Israel.
They were then detonated by raising the temperature of the batteries remotely or through a radio signal.
This is the reason why some Hezbollah members disposed of their pagers after they felt a heating sensation before the spate of explosions, preventing further casualties.
The fact that a compromise in the supply chain happened is a given, as experts said pagers do not usually have batteries large enough to be forced to explode. Most pagers use AA or AAA batteries. The newer models have lithium-ion.
A former British Army officer said a pager already has three of the five main components that are needed in an explosive device. An explosive device needs a container, a battery, a triggering device, a detonator and an explosive charge.
“A pager has three of those already. You would only need to add the detonator and the charge,” the former officer told AFP.
Another analyst, Charles Lister of the Middle East Institute, claimed the pagers were sabotaged at source. “A small plastic explosive was almost certainly concealed alongside the battery, for remote detonation via a call or page,” Lister told AFP.

According to the book “Rise and Kill First”, published in 2018, Israeli intelligence forces have a decades-long history of using communication devices like cell phones to target their enemies.
One such incident dates back as far as 1972 when Israel is believed to have taken revenge on the Palestine Liberation Organisation (PLO) for the Munich Summer Olympics massacre. Eleven members of Israel’s Olympic team were killed by Palestinian militants on September 6, 1972.
As part of their revenge, Mossad spies entered the flat of PLO’s Paris chief, Mahmoud Hamshari, and swapped his phone’s base with a replica packed with explosives.
As Hamshari answered the phone, it was remotely detonated by an Israeli team. Hamshari lost a leg and later succumbed to his injuries.
Around 24 years later, another Israeli agency, Shin Bet, used the same modus operandi to snuff out Hamas bombmaker Yahya Ayyash, who was behind several suicide bombings that killed around 100 Israelis.
On January 5, 1996, as an unsuspecting Ayyash received a call from his father on his Motorola Alpha cell phone, the device exploded, killing him instantly. The phone was reportedly given to Ayyash by a Palestinian collaborator, making the incident the first known case of a supply chain attack.
What the Hamas bombmaker did not know is that Shin Bet inserted 50g of RDX in the cellphone, enough to kill anyone holding the device close to their ear.

Not only Israeli spy agencies, Russia’s KGB is also known to have previously installed eavesdropping equipment inside 16 IBM typewriters supplied to the US embassy in Moscow in 1976.
The implant devices were likely installed by Soviet intelligence officers when the typewriters were under the control of customs officials before they reached the embassy. The US came to know about it only eight years later, in 1984, during a National Security Agency (NSA) operation codenamed “Project Gunman”.
The NSA report concluded that the Soviet operation had most likely compromised every document typed on the 16 typewriters between 1976 and 1984.