The revolving door

Israel, and cyber power as a labour market

Israeli cyber power is usually told as one of two stories, and they rarely meet. In the first, Unit 8200 is an elite hacker factory, the military-intelligence unit reportedly behind Stuxnet and a generation of prodigies. In the second, an Israeli company sells an intrusion tool to a government that turns it on a journalist, and the story is a scandal. One telling is admiring, the other appalled, and both point at the same place without naming what connects them.

Read as a labour market rather than an arsenal, the two become one. What is distinctive about Israeli cyber power is not a weapon but a flow of people: technical talent selected young, trained inside military intelligence, and released in large numbers into a private industry that turns the training into products. The state produces the capability and then cannot keep it. The interesting object is the door.

More talent than the state can hold

The substrate is a small state with a long-standing sense of existential and asymmetric threat, compulsory service that lets the military select from a whole cohort, an intelligence establishment treated as strategic infrastructure, and a deliberate policy of technological superiority. Unit 8200, the largest part of military intelligence, holds the IDF’s signals intelligence and, since 2009, its offensive cyber work; by one assessment it accounts for roughly four-fifths of the intelligence directorate’s personnel. A unit that large, selecting that hard, trains far more capable people than the state has posts to keep them in.

The coupling: from the unit to the market

The coupling is human before it is technical. The pipeline runs unit to veteran to start-up to product to regulated export, and the veterans are the mechanism: the founders of firms from Check Point to NSO came out of 8200, and Candiru, by Citizen Lab’s account, recruits from its ranks. The products are concrete, Pegasus from NSO and DevilsTongue from Candiru, intrusion tools sold to governments. And the exports are a matter of state: the defence ministry licenses offensive-cyber sales as national-security policy, aligned to the Wassenaar controls, tightening the rules when a scandal makes the diplomacy expensive. Carnegie counts Israeli-connected firms supplying commercial spyware to fifty-six of the seventy-four governments that have bought it anywhere.

Where China’s signature is a procurement chain, the state buying operations from a contractor market, Israel’s runs the other way. The state produces the people, and the market buys them. China’s coupling is state to contractor to operation. Israel’s is state to person to company to market, and only partly back to the state.

Israeli cyber power drawn as a revolving door. A left-to-right pipeline of five nodes, joined by solid arrows: military intelligence (Unit 8200), veterans, companies, products, and the global market. A dashed vertical line labelled "the door" sits between the state and the market, where people cross out. A wide dashed arc runs back over the top from the market to military intelligence, labelled as returning only partly: a strong sector, diplomatic weight, and a pool to rehire from. Solid edges are people and products leaving the state; the dashed return is what comes back, a sector and a talent pool, not the capability itself.

The signature is a labour market, not an arsenal

The signature, then, is a labour market. The capability does not sit in an arsenal the state controls; it sits in a population of trained people and the companies they build, licensed but not owned. Ecosystem is the word usually reached for, and it hides the mechanism by sounding organic. A revolving door is the more useful word, because it tells an observer to watch the transfers, the people and the techniques moving across the boundary between the state and the market.

Where the tidy version breaks

The evidence has a hard edge, and it is the interesting one. There is strong support for every structural link, the selection, the training, the migration of people, the firms’ lineage in the unit, the export regime, and almost none for the arrow that would make this a simple story of state control: that the government wanted a given capability and a company duly built it. The civilian cyber directorate does not run offensive operations at all, and the firms are commercial concerns. Treating every Israeli cyber company as an arm of the state collapses the very question at issue: how state-made capability becomes market capability without the state issuing each instruction. Pegasus is a product, and its abuses are its buyers’. A door moves people and knowledge both ways; it does not imply a hand pushing each one through for a named purpose.

What stays open

So the return edge is the one that does not close. Capability leaves the state through people, becomes a product, sells abroad, and comes back only partly, as a strong sector, a diplomatic instrument, a pool the agencies can rehire from. Whether the door is a designed policy or an emergent habit the state learned to tolerate and then to regulate is not something the outside record settles. What can be said is that the capability the state trained does not stay the state’s.

What survives is a single migration. Israeli cyber power is not, in the end, an arsenal. It is a labour market: a security state that turns conscript talent into commercial capability, and a commercial sector that turns it back into strategic weight, with people carrying the technique across a boundary the state polices but does not close. The weapon everyone names is downstream. The transfer is where the capability lives.