Full Report
Thousands of people have begun returning to their abandoned homes in northern Gaza after Israeli forces opened the Netzarim corridor, which separates the northern and southern parts of the territory, on Monday, Jan. 27. Israel and Hamas reached a ceasefire agreement in Gaza following more than a year of negotiations. The deal was announced on […] The post Satellite Imagery Shows Schools and Hospitals Destroyed in Northern Gaza appeared first on bellingcat.
Analysis Summary
This report summarizes findings regarding infrastructure damage in Northern Gaza following a military operation, analyzed using open-source intelligence (OSINT) techniques like satellite imagery review. This is **not** a summary of a traditional cyber security incident involving unauthorized network access, data theft, or malicious software.
# Incident Report: Destruction of Civilian Infrastructure in North Gaza
## Executive Summary
This analysis details the significant destruction of civilian infrastructure, specifically Internally Displaced Person (IDP) shelters (primarily schools and tent camps), in Northern Gaza due to a military operation conducted by the Israel Defense Forces (IDF) between October 2024 and January 2025. Satellite imagery confirms that over 80% of identified IDP sites were damaged or destroyed, severely impacting the capacity for civilian return following a subsequent ceasefire.
## Incident Details
- **Discovery Date:** Analysis ongoing, initial post-operation imagery available around late December 2024/early January 2025. The ceasefire allowing return began January 27, 2025.
- **Incident Date:** Renewal of IDF operation began in October 2024, concluding around January 15, 2025 (ceasefire announcement).
- **Affected Organization:** Civilian population and infrastructure of Northern Gaza (Beit Hanoun, Beit Lahia, Jabaliya).
- **Sector:** Conflict/Humanitarian Infrastructure.
- **Geography:** Northern Gaza Strip.
## Timeline of Events
### Initial Access (Start of Renewed Operation)
- **Date/Time:** Commencing in October 2024.
- **Vector:** Direct military operation/Engagement by IDF forces.
- **Details:** IDF renewed operations across Northern Gaza, targeting perceived Hamas/PIJ strongholds.
### Damage Progression
- **Date/Time:** October 2024 - January 24, 2025.
- **Vector:** Strikes, potential fire damage, and large-scale demolitions.
- **Details:** Satellite imagery analysis by Bellingcat shows widespread destruction. 28 of 50 UN-identified IDP sites were heavily damaged or destroyed. Three tent camps visible before the operation were completely razed, with one site later converted into an IDF military position. At least 14 schools showed clear fire damage.
### Impact Realization
- **Date/Time:** January 27, 2025 (Ceasefire allows return).
- **Vector:** Inability for civilians to return to viable housing/shelters.
- **Details:** Civilians began returning to find homes destroyed and former shelters unusable, forcing them to set up makeshift tents in rubble. Three major hospitals (Kamal Adwan, Indonesian, and Al Awda) were previously reported out of service.
### Detection & Response (Analysis/Reporting)
- **Date/Time:** Ongoing, with reporting spanning late 2024 into January 2025.
- **Vector:** Open Source Intelligence (OSINT) techniques, including analysis of satellite imagery (Planet Labs/SkySat) and ground-level photos/videos.
- **Details:** Investigations identified high concentrations of damaged schools near areas of heavy IDF presence (e.g., near Indonesian Hospital). IDF acknowledged operations, stating Hamas systematically violates international law by using civilians as shields.
## Attack Methodology (Contextualizing Military Action)
*Note: This section interprets the military action in technical terms based on the damage assessment.*
- **Initial Access:** Military incursion/Sustained engagement within defined governorates.
- **Persistence:** Sustained military presence leading to ongoing structural damage.
- **Privilege Escalation:** Not applicable in a cyber context; refers to the scope and intensity of military engagement.
- **Defense Evasion:** Not applicable, though the IDF claimed targeting of Hamas/PIJ operatives within civilian structures.
- **Credential Access:** Not applicable.
- **Discovery:** Military reconnaissance informing targeting (as evidenced by geo-located IDF tunnel demolition videos).
- **Lateral Movement:** IDF operations across high-density areas like Beit Lahia and Jabaliya.
- **Collection:** Confirmation of structural damage via satellite and ground imagery review.
- **Exfiltration:** Not applicable (no data exfiltration).
- **Impact:** Complete destruction or heavy damage to infrastructure designated as civilian shelters (schools, camps).
## Impact Assessment
- **Financial:** Not specified, but implied significant infrastructure rebuilding costs.
- **Data Breach:** Not applicable.
- **Operational:** Severe operational impact on humanitarian support for internally displaced persons (IDPs) due to the targeting/destruction of 80% of identified shelters.
- **Reputational:** Analysis published by OSINT groups (Bellingcat) highlighting widespread destruction of civilian sites.
## Indicators of Compromise (Physical/Observational IOCs)
- **Network Indicators:** Not applicable.
- **File Indicators:** Not applicable.
- **Behavioral Indicators:** Appearance of white tents/makeshift shelters among extensive rubble in areas previously documented as destroyed (Observed post-ceasefire). Evidence of extensive fires at former IDP sites.
## Response Actions (Analysis/Reporting Actions)
- **Containment:** Ceasefire agreement reached (Jan 15, effective Jan 19-27).
- **Eradication:** IDF operations concluded in the North by the ceasefire date.
- **Recovery/Mitigation:** Immediate recovery hampered by infrastructure destruction; civilians resorting to temporary outdoor sheltering. The Netzarim corridor opened to permit population transit.
## Lessons Learned
- Civilian infrastructure, historically used as designated shelters, suffered catastrophic damage during the renewed military operations.
- Over 80% of identified IDP sites in the North were visibly damaged or destroyed following the operation.
- The reliance on schools and camps as shelters proved highly vulnerable when military operations resumed in those areas.
## Recommendations
- Further detailed structural assessments are required to map damage against planned return routes.
- Rapid deployment of temporary, secure shelter solutions is necessary given the destruction of established sites.
- Operational transparency regarding targeting confirmed by OSINT analysis should be integrated into future conflict assessments.