IDF C4I and Cyber Defense Directorate

The directorate is responsible for the communications and computing systems used by IDF forces on the battlefield, as well as for cyber defense across the military.[1] Its principal objectives are to initiate, develop, exploit, and strengthen the IDF's technological integration system, ensuring that field commanders have the tools needed to manage complex combat situations in an environment increasingly dependent on computer technology.[1] The directorate operates under the IDF Chief of Staff and coordinates closely with the Operations Branch, which plans the use of military force.[4]

Approximately half of the directorate's personnel serve within the directorate itself, while the remainder are distributed among the military's corps, wings, and commands.[5] The directorate encompasses 33 distinct technological professions.[5] Nearly 50% of its personnel are women, women constitute 40% of its senior command, and two of the five brigadier generals heading its major divisions are women.[5] Mamram, the IDF Center of Computing and Information Systems and one of the directorate's most prominent subordinate bodies, is described as a foundation of Israel's high-technology sector and has existed for more than 60 years.[6]

The directorate traces its institutional roots to the IDF's earlier telecommunications and computing bodies. Ynet reported that the ICT and Cyber Defense Directorate was formally established in 2003 and is responsible for force development and force operation at the General Staff, inter-service, and strategic levels in the fields of digital systems, the electromagnetic spectrum, and defensive cyber.[3] An IDF background page also gives 2003 as the founding date and describes the directorate as responsible for formulating and implementing IDF communications and information-technology policy from that year onward.[7]

The directorate's cyber responsibilities developed gradually in response to the rising strategic importance of cyberspace. In 2009, IDF Chief of Staff Lieutenant General Gabi Ashkenazi defined cyberspace as "a strategic warfare and operating space for Israel."[8] An IDF cyber bureau was subsequently established within Unit 8200 of the Intelligence Branch to coordinate cyber activities for the General Staff, while a separate cyber-defense department was created within the C4I Corps, also called the Teleprocessing Corps.[8] The cyber-defense department's activity was described as mostly classified, but its mandate covered enabling IDF operations on land, at sea, and in the air and working with most IDF elite units to neutralize enemy cyberattacks using technological means.[8]

The IDF's C4I Corps developed a dedicated "Cyber Defense Course" to train soldiers to protect military computer systems. The first class completed the course in May 2012 after several months of intensive study, qualifying soldiers to conduct defensive computer-mediated operations based on the developing technological environment.[8] A 2013 account described a digital war room staffed around the clock by more than 20 specialist soldiers, tasked with identifying and destroying attempts to infiltrate IDF systems, including systems supporting weapons used by forces in the field.[9]

The directorate's structure has evolved through several reorganizations. Following a broader reorganization, the Computer Service Directorate's authority was expanded and its name changed to the CC4I Directorate, within which a Cyber Defense Division whose personnel had backgrounds in offensive cyber activity was formed.[10]

The directorate operates the Communications and Cyber Corps and several classified units, as well as the LOTEM technological-operational enhancement unit and the Cyber Defense Brigade.[7] Within the General Staff's C4I Branch, the elite C4I brigade Choshen — created in 2005 — provides specialized communications support for the IDF's amphibious, airborne, and maneuvering units and is subordinate to the Lotem Information Technology Division.[2] Choshen has three specialized battalions and is considered an essential component of IDF operations, particularly complex clandestine missions; its role encompasses providing, operating, and maintaining all communications services required by the IDF.[2]

The Mamram Center of Computing and Information Systems, part of the C4I and Cyber Directorate, is responsible for IDF computing, software, algorithms, and cyber defense.[6] Its cloud platforms process data both at the core of military networks and at the operational edge, supporting weapons systems, command headquarters, and autonomous systems.[6] Mamram also runs a technological-leadership program for women officers, with approximately 20 officers from across the IDF participating when the program was reported, and 59% of women in the branch enrolling in the IDF Computer Training School.[6]

The directorate operates the Military School for Computer Science and Cyber Defense, which trains thousands of soldiers annually for roles in the Air Force, Navy, and ground forces.[4] Training curricula include software development, data analytics, DevOps, and cyber defense; the school's cyber-defense course incorporates cyber games, hackathons, and simulations such as defending a smart city.[4] The directorate's Cyber Defense Unit regularly conducts hackathons intended to challenge personnel and sharpen skills.[1]

Through its Hoshen unit, the directorate developed an encrypted military smartphone launched in 2018.[11] The device supports encrypted conversations, video, text messages, files, emails, and other applications, and is used to convey battle plans, orders, and operational information among forces, headquarters, bases, and the home front.[11]

The IDF describes the Cyber Defense Brigade as a dedicated classified formation created to protect the military's computer systems, enabling operational activity on land, in the air, and at sea and creating cyber superiority for the IDF.[12] The brigade includes a defensive operations center, a defensive intelligence center, a technological center known as Unit Matzov, and an electronic-warfare center.[12]

The Cyber Defense Division operates within the directorate in both peacetime and wartime, protecting IDF networks from malicious cyberattacks.[13] It employs technological defenses, a General Staff intervention unit, and dedicated cyber defenders, and works in cooperation with Military Intelligence, the Shin Bet, the Mossad, and the Defense Ministry's security establishment to identify attackers, locate them, and remove threats.[13]

Rather than waiting for known intrusion indicators, the division conducts proactive network hunting even when there is no specific indication of a breach.[13] A General Staff red team within the division emulates adversaries, performs penetration tests, and conducts surprise exercises across IDF branches and directorates to examine the effects of cyberattacks on operational processes and commanders in the field.[13] The division also participates in defining technological requirements for weapons systems: before the IDF purchases major platforms such as aircraft or submarines, the division must approve the adequacy of their protective cyber envelope.[13]

The directorate's cyber-defense headquarters includes a special intelligence department tasked with researching and scanning adversaries' methods, capabilities, and intentions for attacking the IDF through cyberspace.[14] Hundreds of soldiers serve around the clock as cyber defenders, and cyber-related operations have also yielded intelligence warnings that contributed to the arrest of hundreds of Palestinians suspected of planning terrorist attacks.[14]

In 2017, data attributed to the directorate indicated that approximately 10% of malfunctions in IDF computerized systems during the preceding year were suspected or confirmed cyberattacks, encompassing both operational and classified systems.[14] Most attacks were blocked or thwarted by the cyber-defense apparatus, although the trend had increased in previous years.[14]

In a reported incident several months before June 2020, the C4I Directorate identified attempted Iranian cyberattacks against the IDF's supply chain — the network connecting the army to civilian services supplying gas, food, and other necessities.[15] Compromising it could have exposed information about companies, facilities, and the IDF's operating methods. Cyber Defense Unit soldiers conducted a covert operation over several days to expose the attackers and foil the plan.[15]

The MAMAD Center, operating within the Cyber Defense Brigade, served as a focal point for intelligence and cooperation concerning Hamas's cyber capabilities.[16] Following Hamas's attempted cyberattack in May 2019, the center and partner organizations collected intelligence on Hamas cyber personnel and operating locations. Ynet reported that Israeli airstrikes subsequently targeted the cyber apparatus and more than ten operational centers in an operation involving a broad coalition of IDF, intelligence, and national cyber bodies.[16]

The directorate's spectrum-warfare forces are responsible for blocking and disrupting communications, including radio and cellular frequencies, and can prevent remote activation of explosive devices by blocking control signals.[17] Battalion 5114, described as a central General Staff spectrum-warfare unit, operates within the directorate.[17]

During Operation Rising Lion in June 2025, soldiers from the 5114th Spectrum Warfare Battalion used electronic warfare to thwart dozens of attempted infiltrations by Iranian UAVs, providing an additional layer of air defense using advanced technological means to detect and neutralize aerial threats in real time.[17][18] Military officials attributed the destruction of approximately 25% of 1,100 drones launched at Israel by Iran during a twelve-day conflict to the 5114th Spectrum Battalion, noting that the spectrum array — initially developed for defensive purposes — was also used during the war to disrupt enemy communications and bring down drones.[5]

The Spectrum and Communications Division manages the electromagnetic spectrum and strategic military communications, including links between headquarters and distant aircraft or submarines, and is also responsible for space and satellite communications.[5]

In December 2025, the military completed a major reorganization of the C4I and Cyber Defense Directorate under Major General Aviad Dagan, restructuring it around five operational divisions.[19][20] The five were the Operations Division, Cyber Defense Division, Force Build-Up Division, Bina Information and Artificial Intelligence Division, and Sphera Spectrum and Strategic Communications Division.[20]

The Bina Division consolidated most IDF units working on artificial intelligence, including Shahar, Matzpen, Mamram, the AI Center of Excellence, and the Software and Information School.[20] Its mandate is to develop AI capabilities, provide commanders with immediate information and intelligent tools, and support real-time decision-making.[20] The reorganization also included a new artificial-intelligence unit and an expanded electronic-warfare array intended to enhance Israel's defensive cyber capabilities, including countering drone attacks.[21]

One significant product of the directorate's AI development is a system that transcribes IDF radio networks in real time, stores conversations in a searchable database, and processes them with artificial intelligence, enabling brigade commanders to query the system and receive answers within seconds.[20] A December 2025 report attributed the establishment of the Artificial Intelligence Division in part to the military's security failure on October 7.[22]

The Cyberspace Defense Division, first established in 2018, is tasked with protecting the IDF's cyber domain and electronic systems within the reorganized structure.[5] The new Information and Artificial Intelligence Division also develops military ICT systems involving big data, cloud computing, and software, including systems for rapidly transcribing communications and identifying casualties.[5]

The directorate has cooperated with U.S. Cyber Command since the establishment of the two organizations.[23] The IDF awarded a service medal to a U.S. Cyber Command liaison officer for promoting strategic operational cooperation in the cyber arena, reflecting the depth of the institutional partnership.[23]

In December 2022, the directorate's Joint Cyber Defense Division led the seventh Cyber Dome exercise in cooperation with U.S. Cyber Command.[24] The exercise simulated real-world cyber scenarios, focused on improving readiness for growing cyber threats in the Middle East, and incorporated personnel from the IDF Intelligence Directorate.[24] It was held at the Georgia Cyber Center in Augusta, Georgia, and the IDF characterized it as part of an ongoing and close operational partnership.[24]

The directorate also participates in cyber drills and capacity-building exercises with foreign militaries and other Israeli organizations, and takes part in emergency exercises conducted in close cooperation with the National Cyber Directorate.[10] The IDF has articulated the view that it is an inseparable part of protecting Israel's national cyberspace during emergencies and wartime.[10]

In June 2018, the directorate held its first international digital and cyber conference at the Communications Corps heritage site in Yehud.[25] Approximately 70 foreign representatives attended, including six generals and 16 colonels from 13 delegations representing 11 countries.[25] The conference addressed ICT development, technological challenges on the battlefield, digital transformation, cyber technology, and cloud technology.[25]

Compulsory military service has been identified as a structural factor enabling Israel to harness technically capable personnel for its cyber programs, contributing to both the IDF's military cyber capabilities and the broader civilian technology sector.[26]

From the outset of the IDF's formal engagement with cyberspace, a structural division separated the directorate's defensive mission from the offensive and intelligence-collection missions assigned to Unit 8200 within the Military Intelligence Directorate.[8][27] Some analysts considered that split inadequate for the IDF's rapidly changing operational requirements.[27] A 2021 N12 account likewise described an earlier division between a defensive body led by the ICT Directorate and an offensive body associated with Unit 8200, and reported that then-Chief of Staff Gadi Eisenkot decided in 2015 to establish a cyber arm, with the Cyber Defense Brigade created first under a brigadier general.[13]

On June 15, 2015, the IDF Spokesperson announced that the Chief of Staff had decided to establish a cyber command in response to "the substantial challenges facing the IDF in the cyber realm."[21] The proposed command was to lead operational activity in cyberspace, initially operate within both the Military Intelligence Directorate and the C4I Telecommunications Directorate, report directly to the Chief of Staff, and eventually become the fifth branch of the General Staff. Its precise force-building and operational role remained subject to further design.[21]

The plan was abandoned in 2017. Instead, the C4I Directorate's cyber-defense unit was upgraded into an operational command with authority to act and respond, including counterattacks and "active defense," while Unit 8200 and its intelligence and reported offensive cyber functions remained within Military Intelligence.[28] The reorganization also introduced a coordinating unit called "Firewall Control." Reporting at the time said that responsibility for major nationwide attacks and national infrastructure during emergencies was still being resolved through proposed legislation and Knesset discussions.[28] A Jerusalem Center for Security and Foreign Affairs commentary later described the continuing offensive-defensive split and said that the General Staff was considering a separate Cyber Directorate responsible for both.[29]

The head of the IDF Cyber Defense Division holds designated legal authority under Israeli temporary legislation enacted during wartime conditions. Under a temporary order passed by the Knesset on December 6, 2023 — effective December 7, 2023 — an IDF "competent officer" was defined as the head of the IDF Cyber Defense Division, or a colonel from that division authorized in writing by the head of the IDF Telecommunications and Cybersecurity Division.[30]

The temporary order authorized electronic penetration of, or activation of, computers used to operate stationary cameras, and permitted deletion, alteration, disruption, or interference with computer material under specified conditions.[30] Such authority could be exercised when penetration was considered essential to thwart or prevent access to visual information from a stationary camera that could seriously jeopardize state security or the continuity of IDF operational functions during significant military operations.[30] The order required that the authority be limited to what was strictly necessary and exercised for the shortest possible period, with restoration of the owner's access to camera information where possible after the circumstances requiring the operation ended.[30]

The order was effective for six months and could be extended for three additional months by the defense minister, with the prime minister's consent and approval from the Knesset Foreign Affairs and Defense Committee, if significant military operations continued.[30] It required monthly confidential reporting on implementation — including the number of computers approved for penetration, authorized soldiers or Israel Security Agency employees and their duties, types and numbers of operations conducted, and any special events or malfunctions — submitted to the Knesset Foreign Affairs and Defense Committee's Subcommittee on Intelligence and Secret Services and to the attorney general.[30]

A separate temporary law passed on December 25, 2023, authorized the head of the IDF Cyber Defense Division — alongside officials from the Israel Security Service, National Cyber Directorate, and Directorate of Security of the Defense Establishment — to declare that a serious cyberattack had occurred or might be imminent, when there was a real concern that the attack could harm state security, public safety, or essential supplies and services.[31] When such a declaration was made, an authorized employee could order a digital-service or storage provider to detect, prevent, or stop the attack within a specified reasonable period, with the relevant agencies required to submit confidential monthly reports to the attorney general and the Knesset Foreign Affairs and Defense Committee.[31]

The directorate has been led by a series of major generals drawn from the IDF General Staff. Major General Eran Niv served as head of the J6 and Cyber Defense Directorate at the time of the December 2022 Cyber Dome exercise.[24] The Jewish Virtual Library lists Major General Lior Carmeli as head of the C4I Directorate, though that page contains outdated and internally inconsistent personnel information.[32]

In May 2024, the IDF announced that Brigadier General Aviad Dagan would be appointed head of the J6 and Cyber Defense Directorate and promoted to major general.[33] Dagan was subsequently identified as the directorate's commander during the December 2025 reorganization.[5][20]

The directorate has been referred to by several names across official, journalistic, and analytical sources, reflecting both organizational evolution and inconsistent English translation of Hebrew institutional titles. Historical and analytical sources use C4I Corps, C4I Directorate, C4I Telecommunications Directorate, CC4I Directorate, and Computer Service Directorate.[8][10] News and official sources also use Communications and Cyber Directorate, J6 and Cyber Defense Directorate, and C4I and Cyber Defense Directorate.[23][1] The IDF's English-language overview uses "C4I and Cyber Defense Directorate," while Ynet's Hebrew reporting uses a title rendered in English as "ICT and Cyber Defense Directorate."[1][3]

Sources also identify distinct subordinate bodies — including an IDF Cyber Defense Division and a separate IDF Telecommunications and Cybersecurity Division — without always making clear how these relate to the broader directorate.[30] The IDF's directorate overview identifies it as the organization's elite technological unit and states that technological advances over two decades transformed it into a center and leader in its field.[1]