2024–2026 Israeli–United States Espionage Cases

The period 2024–2026 produced an unusually dense cluster of intelligence-related allegations touching Israel and the United States, ranging from Houthi press releases about alleged spy cells in Yemen to U.S. media reporting on a Pentagon threat-level reassessment. The cases differ substantially in their evidentiary basis. Some — such as the arrests and indictments of American citizens for alleged Iranian espionage in Israel — rest on public court filings. Others, most notably the June 2026 allegation that Israel surveilled senior Trump administration officials, relied on unnamed sources and an unpublished seven-page Defense Intelligence Agency document whose contents were not independently verified.[1]

Israeli analyst Yossi Melman and academic Kobby Barda argued that Israel substantially curtailed intelligence operations directed at the United States after the Jonathan Pollard affair in the 1980s. Melman wrote that, to the best of his knowledge, Israeli intelligence had stopped spying on U.S. soil and against American targets worldwide after Pollard — "Period. Not Unit 8200. Not the Mossad and not the Shin Bet" — while neither analyst ruled out some degree of communications monitoring.[1] A White House official called the 2026 reporting "false and sourced to someone who doesn't have any knowledge of what's going on," and the Israeli Embassy in Washington stated that "Israel does not gather intelligence on American entities, let alone US government officials."[2]

On May 6, 2024, Houthi security forces claimed they had uncovered and dismantled a cell allegedly conducting espionage and sabotage on behalf of the United States, Britain, and Israel. The Houthi account described an intelligence entity called Force 400, which purportedly recruited operatives to monitor and document Houthi naval and missile forces involved in attacks on shipping and Israeli territory, reportedly in preparation for strikes by a U.S.-led coalition. The claimed operatives were also said to have admitted planning assassination and sabotage operations against Houthi personnel and facilities. The allegations were attributed to Houthi security forces and the Houthi-aligned outlet al-Masirah, with no independent confirmation of the cell, its recruitment, or the reported admissions.[3]

On November 8, 2025, the Houthi Ministry of the Interior announced the arrest of another alleged espionage network, this time claiming involvement by Saudi, American, and Israeli intelligence services. According to the Houthi account, a "joint operations room" based in Saudi Arabia coordinated cells in Yemen, supplied operatives with sophisticated espionage equipment, and ran training through American, Israeli, and Saudi officers.[4] The alleged network reportedly photographed and tracked buildings, monitored military and security infrastructure, and collected information on civilian and military leaders. Members said they had joined between 2019 and 2024.[4] Confessions and some supporting evidence were released publicly, but the claims could not be independently verified, and the extent of coercion used in obtaining the confessions was unknown.[4]

The most diplomatically sensitive cluster of allegations emerged in June 2026, when NBC News and The New York Times reported that Israel had intensified efforts to obtain intelligence on senior Trump administration officials, particularly those involved in U.S.-Iran negotiations. The NBC report relied on three unnamed U.S. officials — two current and one former — and referenced an unpublished seven-page Defense Intelligence Agency document that supposedly raised Israel's counterintelligence threat designation to "critical."[1][2] The Times reporting similarly drew on unnamed current and former officials and assessments that had not been made public.[1]

The Pentagon raised Israel's counterintelligence threat assessment to its highest level in the weeks preceding those reports, according to officials cited by The Times of Israel.[2] Officials said the change might lead U.S. personnel to take additional precautions when traveling to Israel or meeting Israeli officials, but noted no apparent effect on the extensive intelligence-sharing relationship between the two countries.[2] Specific officials allegedly targeted for monitoring included Trump special envoy Steve Witkoff, Undersecretary of Defense for Policy Elbridge Colby, and his deputy Michael P. DiMino IV.[2]

The Institute for National Security Studies framed the episode as a dispute over access to sensitive U.S. deliberations and the boundaries of intelligence collection by an allied government, noting a possible gap between the White House's effort to preserve close relations with Israel and the Pentagon and intelligence community's emphasis on protecting independent U.S. decision-making.[5] The INSS analysis suggested the episode could prompt Washington to tighten procedures and manage certain deliberations in more restricted circles.[5]

Israel denied the allegations, with the Israeli Embassy calling them "completely false."[2] A White House official rejected them as false and questioned the sourcing.[1] The alleged DIA document was not released publicly, and no formal criminal proceedings arose from the episode.[1]

In December 2025, The Jerusalem Post reported an allegation — attributed to The Guardian and sources briefed on the matter — that Israel had conducted widespread surveillance of U.S. military personnel at the Civil-Military Coordination Center in Kiryat Gat, southern Israel.[6] U.S. commander Lt. Gen. Patrick Frank reportedly summoned his Israeli counterpart and demanded that the recording stop. Staff were said to have been instructed to avoid sharing sensitive information at the center due to concerns that Israel might collect and later exploit the material.[6] The IDF denied the allegation, describing its meeting-documentation practices as transparent and calling the suggestion that it gathered intelligence on partners "absurd."[6]

On June 24, 2026, Senator Peter Welch submitted Senate Amendment 6403 to S. 4784, which would have required the Secretary of Defense and the Director of National Intelligence to provide Congress with a classified briefing and report on "counterintelligence threats posed by the Government of Israel" within 30 days of enactment.[7] The proposed amendment called for examination of the scope, intensity, and trends of alleged Israeli espionage directed at U.S. defense contractors, members and staff of Congress, and U.S. officials and agencies, including risks to sensitive defense-related intellectual property and proprietary corporate information.[8] The amendment was ordered to lie on the table and was not enacted.[7] The text constituted a proposed requirement for an investigation rather than a factual government finding that Israel had conducted the alleged activities.[8]

Separately, on July 29, 2025, the State Department was asked about reports that two Americans had been detained in Iran on suspicion of spying for Israel. Spokesperson Tammy Bruce neither confirmed nor denied the reported detentions, any alleged Israeli connection, whether the individuals had been released, or whether the United States had contacted Iran, stating only: "I can't speak to that at this point, but hopefully I can soon."[9]

A distinct and more substantiated strand of the period's espionage cases involved American and dual-national citizens arrested in Israel for allegedly spying on behalf of Iran — the adversary of both Israel and the United States — rather than for any allegation that they had acted against American interests.

In September 2025, Israeli authorities arrested Yaakov Perl, a 49-year-old dual Israeli-American citizen who had been living in Morocco, after he entered Israel in July at the direction of Iranian handlers.[10] A joint statement by Israel Police and the Shin Bet described allegations that Perl gathered intelligence on Israeli public figures including National Security Minister Itamar Ben-Gvir and former IDF Chief of Staff Herzi Halevi, communicated with Iranian operatives, attempted to recruit others, and transmitted photographs and videos of Israeli locations in exchange for cryptocurrency.[10] Authorities said he acted on ideological grounds against Israel and Zionism. On September 26, 2025, prosecutors filed charges in the Tel Aviv District Court alleging that Perl aided the enemy during wartime and provided intelligence to the enemy with intent to harm national security.[11]

In June–July 2026, Israeli authorities arrested and indicted Eli Levon, a 21-year-old U.S. citizen studying at Jerusalem's Mir yeshiva, for allegedly sending information to Iranian intelligence.[12] Prosecutors said Levon received cryptocurrency payments — $861.35 from a Telegram account called "Sina" in December and $517.78 from one called "Alecsander" in February — in exchange for assignments that included photographing Jerusalem's Central Bus Station, hiding a note-containing cigarette box at Hadar Mall, planting a USB flash drive wrapped in a NIS 50 bill, and sending footage from Jerusalem locations. He was charged with contact with a foreign agent and providing information that could benefit an enemy; the indictment noted that he refused a request to supply a list of fellow yeshiva students.[12]

Also in June 2026, Israeli police announced the arrest of a second unnamed 20-year-old U.S. citizen in the Jerusalem area on suspicion of security offenses for allegedly photographing and filming "sensitive sites" on behalf of an Iran-linked agent, receiving between dozens and hundreds of dollars per task.[13] The investigation was conducted jointly by the Shin Bet and police under a sweeping gag order, and the suspect's identity and later legal outcome were not disclosed in available reporting.[13]

The arrests of American nationals in Israel formed part of a broader documented pattern of Iranian mass-recruitment efforts targeting Israelis and foreign nationals residing in Israel. Iranian operatives used Telegram, Facebook, Instagram, and email to offer easy cash for simple-seeming tasks such as tracking a senior figure or photographing a military base.[14] One case involved attempts to recruit young Israelis to conduct surveillance targeting Defense Minister Israel Katz, though the exact date, number of recruits, and final legal outcome were not specified in available reporting.[14]

In a case reported in 2025, 71-year-old Israeli citizen Moti Maman returned to Ben-Gurion International Airport after a covert mission to Iran during which he met Iranian handlers; his assignment was reportedly to penetrate Israeli society and gather intelligence on senior figures. The Shin Bet arrested him, and he was convicted of grave espionage and sentenced to 10 years in prison, though he was expected to serve approximately three years due to mitigating circumstances.[14] Separately, a February 2026 analysis cited a figure of roughly 34 Iranian spies or traitors uncovered in Israel, though no list, methodology, reporting period, or case-by-case breakdown accompanied the figure.[15]

A parallel legal front involving Israeli technology ran through U.S. federal courts, centered on NSO Group, the Israeli developer of Pegasus spyware. In January 2024, a U.S. federal court rejected NSO's motion to dismiss Apple's lawsuit or transfer it to Israel, requiring NSO to respond substantively to Apple's claims.[16] In December 2024, U.S. District Judge Phyllis Hamilton ruled that NSO was liable for hacking WhatsApp and breaching its contract with the platform, having exploited a WhatsApp vulnerability to install Pegasus on more than 1,400 users' devices, including those of journalists, human-rights activists, and dissidents.[17] Evidence in the case indicated that exploitation of a single vulnerability generated approximately $61.71 million in revenue between the second quarter of 2018 and the second quarter of 2020, with estimated profit between $21.31 million and $40.24 million.[18]

In May 2025, a federal jury in California awarded Meta approximately $168 million — $444,719 in compensatory damages and roughly $167.3 million in punitive damages — finding that NSO had exploited WhatsApp vulnerabilities and supplied the exploit to clients who used Pegasus to spy on journalists, activists, and political opponents.[19] In October 2025, a federal court permanently barred NSO from breaking into or attempting to break into WhatsApp's systems and from targeting WhatsApp, while reducing the punitive-damages award from approximately $167 million to $4 million.[20]

The U.S. Commerce Department had previously placed both NSO Group and the Israeli company Candiru on its export blacklist in 2021, restricting American companies from doing business with them without authorization.[21] In December 2021, Israel changed its cybersecurity-export licensing policy to require purchasers to pledge not to use Israeli equipment for terrorist acts or serious crime, and subsequently limited eligible recipient countries for Israeli cyber technology to 37.[22] In February 2024, the United States announced additional visa restrictions on individuals involved in commercial-spyware misuse, though the cited source did not identify a specific Israeli company as the primary target.[22] These proceedings concerned a commercial Israeli firm and alleged misuse by foreign government clients, not a judicial finding that the Israeli government itself directed espionage against the United States.[20]

A related but distinct investigation, dubbed Qatargate, arose in early 2025 when Israeli authorities examined allegations that aides to Prime Minister Benjamin Netanyahu had promoted Qatari interests in Israeli and international media in exchange for payment.[23] Netanyahu aide Eli Feldstein and adviser Jonatan Urich were arrested. Investigators suspected that Qatari-linked payments were routed through ThirdCircle, a U.S.-based lobbying firm founded by Jay Footlik, a former special assistant to President Bill Clinton and a longstanding American-Jewish lobbyist for Qatar.[23] The alleged offenses included bribery, contact with a foreign agent, breach of trust, and promotion of Qatari interests while Feldstein remained in government service.[23]

Footlik was scheduled to be questioned by Israeli police in the United States in June 2025 concerning allegations that he paid Feldstein a salary while Feldstein was still serving in the Israeli government, promoted Qatari interests during wartime, and coordinated meetings with Israel's chief rabbis on Qatar's behalf.[23] On May 12, 2025, the Rishon Lezion Magistrate's Court ordered Urich held under house arrest for 10 days, rejecting a police request for a longer period; Judge Menachem Mizrahi expressed skepticism that Urich would ultimately be indicted, while noting that the charging decision rested with the State Attorney's Office.[23] Qatar, the company Perception, Urich, and other involved parties denied the allegations; Netanyahu described the investigation as a "political manhunt" and was questioned but not named as a suspect.[23]

Separately, in November 2024, an Israeli court revealed information suggesting that people working in Netanyahu's office may have leaked classified documents in a way that could have complicated Israel-Hamas ceasefire negotiations, leading to the indictment of Feldstein and another individual for disclosing confidential information.[24] While not a U.S.-Israeli espionage prosecution, the episode formed part of a broader cluster of Israeli intelligence and classified-information controversies during the period.

A further strand of the period involved Israeli-founded human-resources software company Deel and U.S.-based competitor Rippling. Rippling alleged that Deel had recruited its payroll manager, Keith O'Brien, to act as an insider and pass confidential company materials to Deel; O'Brien admitted under oath that he passed confidential material for $6,000 per month.[25] Deel denied wrongdoing and accused Rippling of conducting its own coordinated espionage campaign. In January 2026, CTech reported that the U.S. Department of Justice had opened a criminal investigation into the allegations, with federal prosecutors issuing grand-jury subpoenas seeking information about a possible operation financed through Deel's corporate accounts.[26] Deel's spokeswoman said the company was not aware of any criminal investigation and would cooperate with valid official inquiries.[26] The allegations remained contested in cross-border civil litigation.

Against the backdrop of the espionage allegations, U.S. and Israeli authorities continued active intelligence cooperation directed against Iran. On October 30, 2024, the FBI, U.S. Department of the Treasury, and Israel's National Cyber Directorate jointly attributed a series of cyber operations to the Iranian group Emennet Pasargad, which used the cover company name Aria Sepehr Ayandehsazan and the personas "Cyber Flood" and "Contact-HSTG," active since October 2023.[27] The joint advisory detailed a July 2024 operation in which the group compromised a French company operating commercial digital displays in an attempt to broadcast montages condemning Israeli participation in the Paris Olympic and Paralympic Games, planted a fabricated news story, and sent threats to Israeli athletes under the identity of a fictitious French far-right organization called "Regiment GUD."[27] The same operation sought to contact families of Israeli hostages held in Gaza through the "Contact-HSTG" persona.[27] The activity was characterized as cyber-enabled influence and cognitive warfare rather than espionage in the traditional sense.[27]