Operation Orchard – The Attack on

Syrian Nuclear Reactor

A. Introduction
1. This is the story of a daring operation (Operation “Orchard” also called “Out of the Box”)
executed on the night-early morning of 5th - 6th September 2007 by the Israeli Air Force
(IAF), Army and Intelligence community. The strike destroyed a nuclear reactor that Syria
was building with help of North Korea.
2. During the operation, IAF used electronic warfare to take over Syrian air-defenses and feed
them a false-sky picture. Syria was equipped with advanced Russian air defense system
called Pantsir-S1 which claimed to be immune to electronic jamming. Syria’s Air Defence
System malfunctioned during the entire period of the operation, starting from the time the
Israeli fighters crossed into Syria, bombed their target and returned. Operation Orchard saw
the baptism of fire of the Suter airborne network system. The Suter airborne network attack
system, developed by the US, made it possible to feed enemy radar emitters with false
targets, and manipulate enemy sensors. The network attack activated a secret built-in kill
switch by injecting malware over the air and through the radar system.

3. In all matters of preemption, relevant international law warrants serious attention. During
the attack on Osiraq in 1981, Israeli fighter-bombers destroyed Iraq's nuclear reactor before
it was ready to go on line. Immediately following the attack, the general global community
reaction was hostile. Under the long-standing customary right of anticipatory self-defense,
every state is entitled to strike first whenever the danger posed is "instant, overwhelming,
leaving no choice of means and no moment for deliberation." If anything, this standard,
which dates back to 1837 (in a naval incident known formally as "The Caroline"), is
compelling in the nuclear age.
 4. Regarding the 2007 Israeli Operation Orchard, then Israeli Prime Minister Ehud Olmert,
consciously reasserted the 1981 "Begin Doctrine," this time referencing the Deir ez-Zor
region of Syria. Several years later, in April 2011, the U.N.'s International Atomic Energy
Agency authoritatively confirmed that the bombed Syrian site had indeed been the start of
a substantial nuclear reactor. Indisputably, Olmert's decision, like Begin's earlier one, turned
out to be right.
5. "Defensive warfare does not consist of waiting idly for things to happen," counsels Carl von
Clausewitz in his classic, "On War." "We must wait only if it brings us visible and decisive
advantages." Israel chose not to wait in 1981 and 2007. As a welcome result, the world tody
does not have the same nuclear fears for Syria and Iraq that it harbors for North Korea and
Pakistan.

B. The Milestones
B.1. The Proof
a. The Syrian nuclear reactor was referred to as the Al Kibar site. The nuclear
reactor was produced with the help of North Korea. Assad conducted the
nuclear project in great secrecy. The contacts with North Korea were
coordinated by the head of the Atomic Energy Commission, Othman, and Gen.
Muhammad Suleiman, the regime’s person for dark ops, who also oversaw
military relations with Iran and Hezbollah. This small and secret coterie headed
by Suleiman was directly subordinate to the President. In Israel it was called
“the shadow army.”

Syrian Nuclear reactor Site resembled North Korean Design

b. The Cube, as the site was called was located at an isolated site called Al Kibar,
less than a kilometer west of the Euphrates River. The Koreans and the
Syrians had built a camouflage structure on top of the reactor that made it look
like a factory from the outside. Rubble was scattered around the building and
the place looked fairly neglected. There was not much traffic in the area. In
January 2007, a pipeline leading from the Cube to the Euphrates was
identified in satellite photos. This was the sign of the existence of a cooling
system, an essential element in a reactor.
1 | Page
 c. The next breakthrough occurred in Vienna in early March 2007. Ibrahim
Othman, head of the Syrian Atomic Energy Commission, had come to Austria
to participate in the deliberations of the International Atomic Energy Agency.
A cell of Mossad agents from the Keshet unit broke into the apartment where
Othman was staying and within less than an hour “vacuumed up” the
information that was on his laptop. The material was found to include about 35
photographs from inside the mysterious building in the Syrian desert. The
pictures revealed fusion cylinders and bars and also some Korean workers.
d. It emerged that the Cube design mirrored the North Korean reactor at
Yongbyon, which the North Koreans used to produce fissile material for
nuclear weapons. That was in turn a copy of a British reactor built in 1950s.
B.2. The Decision-Making Process
a. The decision making was made easy by the “Begin doctrine” that mandated
Israel, not to allow any of its foes in the Middle East to develop nuclear
weapons. To hear opinions from individuals beyond the heads of the military
and the intelligence communities, Olmert consulted other experienced people,
3 ex Prime Ministers and external oversight teams. In those meetings
Opposition leader Netanyahu and Barak were very firm in their opinion that
Israel had to attack the reactor. Simon Peres had expressed reservations. The
Prime Minister chose to ignore this suggestion.
b. Olmert decided to share the sensitive information about Syria with the
Americans. He hoped that perhaps the George W. Bush’s administration
would take it upon itself to destroy the reactor. Michael Hayden, the head of
the CIA, wrote years later in The Washington Post that he told Bush that his
agency had concluded that the site at Al Kibar was part of a nuclear weapons
program and there was no other explanation for its existence. However, Bush
told Olmert at their meeting on 19th June that he could not justify an American
attack on a sovereign state. Bush said, he had decided to send an envoy to
Syria to pose an ultimatum to Assad to demolish the reactor, under
international supervision. The Prime Minister warned the American President
that setting the diplomatic channel in motion would make it possible for the
Syrians to hasten the completion of the construction. Assad was liable to
position anti-aircraft batteries near the reactor or even to establish something
like a kindergarten there as a “human shield.”
c. The differences of opinion between the Prime Minister Olmert and Defence
Minister Barak on the matter of the reactor became evident relatively quickly.
The Prime Minister was imbued with a sense of urgency and a desire to act.
Barak, however, believed that the operational plans the IDF had formulated
for attacking the plant had not yet matured sufficiently and did not ensure
complete success. He pushed for formulation of alternative proposals. Barak
also downplayed the risk of attacking a “hot” reactor.
B.3. The Plan
a. Two different air force strike options were on the table, the difference between
them was the size of the aerial force that would be used. The first involved
many planes and could have ensured certain destruction of the reactor, but it
would leave behind a large footprint and was liable to spur the Syrians to a
harsh response. The second option that was ultimately accepted, was
sketched by the air force commander on a paper napkin in a brief conversation
with the prime minister. Eight planes would be allocated to the mission – four
2 | Page
 F-15(I) "Ra’am" (Thunder) and four F-16(I) "Sufa" (Storm) – carrying 16 tons
of bombs.
b. The air force dubbed the plan with the code name “Soft Melody” (the general
staff operation had a different code name, “Ein Habasor,” while at Military
Intelligence they referred to the preparations as “Outside the Box”). The
squadrons to which the mission was assigned were brought into the picture
during the month of June, and only in a limited way.
B.4. The Execution
a. Olmert ordered the briefing of the United States concerning his decision to
attack, which he was close to arriving at. On Tuesday, 4th September, the air
force conducted its last mock maneuver in advance of the attack. At that point,
one of the American media organizations asked the Pentagon a question
about the presence of a nuclear installation in Syria. Any report in the media
was liable to awaken the Syrians out of their complacency, alter their defensive
preparedness around the reactor and deny the IDF the advantage of surprise.
On 5th September, at 8 P.M. the Prime Minister summoned leader of the
opposition Netanyahu and informed him, “it’s at midnight tonight.” Netanyahu
wished him success and said, “I will react in accordance with the
circumstances.”
b. The flight package set out around 10:30 P.M. It was a very long flight, a dark
night and a low altitude of 100 meters above sea level. Mostly it went according
to plan. There was no communication between the planes. On reaching the
target area, they climbed a bit higher, pulling into execution mode.

Israeli F-16 taking off for the Raid

c. The target had been lit by Sayeret Matkal special commandos, using their
laser designators. The F-15 (I)s released their bombs locking them to the laser
painted targets. Each plane dropped two bombs. They confirmed on the

3 | Page
 thermal system that the bombs had hit the structure. The facility was totally
destroyed. Upon hitting the target, the leading F-16 broadcasted the word
“Arizona” on long-range radio back to Tel Aviv. On hearing the codeword
“Arizona”, everyone was jumping up and down in the operation room. It was
12:25 AM, Israel time, on Friday, 6th September.
d. Then the jets started to fly back, in accordance with the planning, at a low
altitude. On the way back, in order to reduce weight and save fuel, one of the
planes jettisoned an empty fuel container which landed on the Turkish side of
the Syrian-Turkish border. The commandos were extracted. All Israeli aircrafts
landed at the base safely at 1:30 AM.
e. After the attack, MI chief Yadlin went to the Turkish chief of staff to explain the
considerations and circumstances and to reassure him that there had been
absolutely no violation of Turkish sovereignty during the operation. The Turks
were not happy, but they decided not to make an issue of it.
f. Shortly after the arrival of the planes, Olmert phoned American President, who
was on a visit to Australia and informed him about the attack. The following
afternoon, the Syrian news agency issued a laconic statement to the effect
that during the night its air defense system had chased away Israeli planes
that had penetrated Syria’s air space.
g. The Syrian regime completed the destruction of the bombed building and
buried the ruins in sand. When the IAEA wanted to visit the site, the Syrians
claimed there was nothing to see because there had been nothing there. Yet
in 2008, IAEA inspectors found traces of radioactive substances there, and
the agency said there was a high probability that a nuclear reactor had been
in operation at the site.

Syrian Destruction of the Site to Hide Evidence

C. Electronic Warfare at its Best

C.1. Pre-Operation Actions
a. Information warfare goes by many names, such as network attack and non-
kinetic warfare. At the operational military level, however, these disciplines can
generally be defined as efforts to defeat or neutralise hostile military units
through the use of the electronic transmissions to distort, degrade or capture
the adversary’s battlefield knowledge infrastructure. This is done without

4 | Page
 causing tangible physical damage to the equipment the adversary uses to
collect, process and disseminate its battlefield knowledge.
b. Since the Bekaa Valley engagements in 1982, Israel has used unmanned
drones to provoke Syrian surface-to-air missile (SAM) systems into ‘lighting
up’ and thus revealing their emissions signatures to lurking sensor platforms,
such as Rivet Joint.
c. Prior to the main attack, the strike force attacked a Syrian air defence facility
at Tall al-Abyad, near the Turkish border. The site, which comprised of two
radar systems and probably a mix of SAMs, was damaged and disabled with
a mix of electronic attack and conventional PGMs. The penetration of the
Syrian ADS network involved corrupting the radar application and hijacking of
the broader system through viral propagation across the computer network.

Russian Pantsir-S1 Air Defence System with M1-Tor Radars

d. Immediately after the suppressive attack at Tall Abyad, Syria’s air defence
radar network started showing multiple targets. The operator rebooted the
system after it crashed for a period of time long enough for the IAF to complete
its mission and exit the way it entered, without being detected electronically.

5 | Page
 Syrian Radar started showing Multiple Aerial Targets
e. This was no mean feat considering that Syria had the densest and most
comprehensive air defence system (ADS) in the region. How did the non-
stealthy F-15s and F-16s penetrate the Syrian ADS perimeter without being
detected?
C.2. Syrian Air Defence
a. With nearly 200 active surface-to-air missile (SAM) batteries and early warning
(EW) complexes, Syria had the largest integrated air defence system (IADS)
in the Middle East. Long-range S-200 was received by Syria in 1984. Syria's
EW network had 27 EW complexes that relied primarily on the PantsyrS1E
system. The Pantsyr-S1E system combined command-guided missiles with
twin 30 mm guns. It could shoot down incoming precision-guided munitions
and is useful for defending key installations or weapon systems. Syria also
had two state-of-the art radar systems from Russia, reckoned to be Tor-M1
launchers that carry a payload of eight missiles, as well as two Pachora-2A
systems.
b. There were numerous deficiencies in the Syrian IADS that could be exploited
by adversaries. Terrain was the most significant one. The mountains of
western and southern Syria produced blind zones and limited the
effectiveness of SAM engagement radars to identify targets, particularly at
lower altitudes. Hostile aircraft could use 'terrain masking' where they put high
ground between themselves and a SAM battery's radar systems.

6 | Page
 c. Although the Syrian ADS was extensive in all respects, the quality of the
systems deployed was uneven. The ADS network was centralised and
communicated on dedicated frequencies.
d. The network has been improved by the incorporation of the S-300P-series
system. Modern Chinese radar systems inducted, are designed to limit the
effectiveness of any network-centric warfare attempts to degrade it. Israel
claims that it possessed indigenously developed countermeasures that were
designed to defeat S-300 series systems.
e. A series of Israeli air strikes that were carried out in 2013, involved weapons
launched from outside Syrian territory. This was in contrast to the long-range
deep penetration that Israeli aircraft carried out in September 2007, indicating
the improved Syrian capabilities.
C.3. Network Centric Collaborative Targeting (NCCT) Program
a. The USAF has pursued a highly classified initiative called the “Big Safari”. Big
Safari emphasizes integration of ISR (intelligence, surveillance and
reconnaissance), space and information operations to defeat threats of special
concern. Israel used a similar system for the Operation Orchard.
b. The program has two modules, Suter and Network Centric Collaborative
Targeting (NCCT). The Suter program (named after its creator Colonel
Richard ‘Moody’ Suter) focuses on invading communications networks and
taking over as systems administrator. The prime contractor for Senior Suter
was BAE Systems. NCCT enables a network of sensors to collaborate in
determining the location of a target with minimal human intervention. The
prime contractor for NCCT was L-3 Communications.
c. The Suter program first emerged in 2002. Pentagon modified the capabilities
of the EC-130H Compass Call aircraft to support Operation Iraqi Freedom.
Subsequently, US forces in Iraq used the "Compass Call" to prematurely set
off insurgent IEDs along convoy routes. NCCT and Suter were also tested in
a limited way operationally in Iraq and Afghanistan against insurgent
communication networks.
d. NCCT mimics the way the human central nervous system instantaneously
focuses the eyes on the potential source of a threatening sound. When an
enemy asset communicates or moves, a sensor platform will get a line of
bearing on it. It will further alert the other sensors to focus on the enemy asset
and provide corroborating evidence of the enemy’s identity and location. The
sensors can pick up even relatively weak signals such as those from cell
phones and can detect other C2 components that produce electromagnetic
signatures.
e. Once two other sensors detect the asset, the NCCT system automatically
calculates the location of the asset to within a few hundred feet. NCCT reduces
the time needed to locate a target from hours or minutes down to seconds.
f. The NCCT then compares the signals to dynamic databases of previously
collected signals to ascertain, even the individual identity of the emitting
enemy unit using radio finger printing technology.
C.4. Suter Program
a. Once NCCT localizes and identifies the target, Suter goes to work. The Suter
technology enables USAF operators to invade enemy communications and
7 | Page
 computer networks, particularly those associated with integrated air defence
systems, while preventing enemy operators from understanding or
counteracting the exact nature of the invasion. Suter reduces the target zone
initially calculated by NCCT by at least an order of magnitude, which implies
tens of feet. After pinpointing the target antennas, Suter beams electronic
pulses into the antennas that effectively corrupt, the processing systems that
present the enemy operators with their physical picture of the battlefield. It is
widely speculated that Digital Radio Frequency Memory (DRFM) technology
was used to feed misleading information to the Syrian air defence radar
system. The data streams insert customized signals, including specialized
algorithms and malware, into the vulnerable processing nodes.
b. Corruption of an ADS network results in fabrication of phantom targets and
fake messages. Suter operators then take over control of enemy radars. By
steering the enemy sensors away from friendly aircraft, Suter operators can
figuratively put blinders on the enemy operators. Consequently, friendly
aircraft don’t have to be stealthy. Even if the operators know they’re being
hijacked, regaining control of the system is not easy.
c. Suter has two generic parts: one for inserting input and one for monitoring
output. Block one encompasses the second task, ie monitoring the infected
system. Technology from this block allows friendly operators to monitor what
enemy radars see. The main platform for this collection task is the RC-135
Rivet Joint electronic surveillance aircraft. Rivet Joint is based on the
venerable KC-135 strategic tanker airframe, designed for high altitudes, fast
subsonic speeds, and long ranges or loiter times. The platform can carry aloft
for extended periods large quantities of gear necessary to perform passive
monitoring.
d. Block two encompasses the input insertion task. This allows friendly operators
to inject a malware and seize control of enemy networks and physically
manipulate enemy sensors. This involves control over the electromagnetic
vectoring of radar beam produced by the non-rotating SAR (synthetic aperture
radar). It also involves mechanical shifting of the array panels away from
bearings that would point towards friendly aircrafts.
C.5. Platforms Used
a. The main platform for this insertion task is the EC-130 Compass Call electronic
attack aircraft. Compass Call is based on the C-130 Hercules tactical cargo
transport. Relative to Rivet Joint, Compass Call flies lower, slower, and
shorter, but this profile maximises the aiming precision of it’s signal beams.
Israel replicated the system architecture of blocks 1 and 2 when it deployed
its two new Gulfstream G550 special mission aircraft, equipped with the IAI
Elta EL/W-2085 radar system. The intelligence version monitors hostile
signals traffic, while the surveillance version pumps out invasive data streams
from onboard phased-array radars.

8 | Page
 EC-130 Compass Call aircraft
b. More recently, the Suter programme added a block 3, which focuses
specifically on penetrating networks controlling time-critical and tactically
elusive targets, such mobile missile launchers. Block 3 does not add new
tasks, but rather refines Suter technology to meet more stringent mission
requirements.
c. Although not part of the NCCT or Suter programs as such, the USAF network
attack package also includes the F-16CJ, which focuses on suppressing
enemy air defences using traditional weapons. Should the Suter electronic
attack fail, the F-16CJ can electronically jam or destroy enemy radar and
communications assets the old-fashioned way, using anti-radiation missiles or
other PGMs. Compass Call can jam enemy radar too.
d. In executing the 6 September raid, the IAF apparently used many of the
offensive options mentioned above. According to US observers, the strike
force used some traditional jamming, which is still an important means of
defeating air defence systems.

D. Conclusion
1. There had been indications that the Syrian government had been interested in acquiring
nuclear weapons for decades, dating back to the regime of Hafez Al Assad. The big break
came in 2007, when Israeli agents obtained actual photographs of the reactor under
construction inside the building and what appeared to be North Korean specialists working
at the site.
2. Operation Orchard showed the capabilities of the Israeli Air Force. The capabilities were
later used to carry out an air strike on a weapons convoy and military complex near
Damascus, at the beginning of 2013. As done in 2007, on the night between 29th and 30th
January 2013, Israeli bombers entered and egressed the Syrian airspace almost completely
undetected by the Syrian air defenses: a sign that Syrian radars can do nothing against
9 | Page
 Israel’s Electronic Warfare systems, most probably further improved to embed the capability
to inject malware from F-16s into enemy networks.
3. The strategy of not jamming radar signals and using a more sophisticated approach of
"hacking" into enemy defences is new. The process involves locating enemy emitters with
great precision and then directing data streams into them that can include false targets and
misleading message algorithms. This signals the beginning of a new era in Electronic
Warfare.

10 | Page