Hamas takeover of Israel's Channel 10 satellite feed (July 2014)
What happened
During Operation Protective Edge in July 2014, the satellite feed of the Israeli broadcaster Channel 10 was taken over for a few minutes and replaced with images of wounded Palestinians and Hamas fighters, accompanied by messages in Hebrew addressed to Israeli viewers. The Izz ad-Din al-Qassam Brigades, Hamas's military wing, claimed responsibility. Two of the Hebrew messages were reported: one telling viewers their government chose to begin the campaign and that they should prepare for a drawn-out stay in bomb shelters if it would not agree to Hamas's terms, and one urging them to call their sons home. Israeli broadcast authorities are reported as saying Hamas was able to take over a satellite feed supplying Channel 10 and that terrestrial broadcasting was unaffected, so viewers watching through digital terrestrial converters did not see the substituted material. It was reported as the second such attack, the first having been against Channel 2. The mechanism is not established: the fullest account states plainly that no details of the attack were available and speculates, without evidence, between a misconfigured defence and spear-phishing of station personnel.
The effect is well attested, by several outlets and by the perpetrator's own claim of responsibility; the mechanism is not attested at all, which is why overall confidence is moderate. The most informative fact in the record is that the takeover reached satellite viewers but not terrestrial ones: it localises the substitution to the satellite distribution path, which is more than the comparable Israeli record from 2016 establishes, but it still does not distinguish a compromised uplink chain from an interfering carrier at the transponder. The EXF-0007 edge that the spear-phishing speculation would support is deliberately not mapped, because that speculation is offered as a guess and not as a finding.
Attack vector
Not established. The takeover reached satellite viewers but not terrestrial ones, which localises the substitution to the satellite distribution path, but no source distinguishes a compromised uplink chain from an interfering carrier at the transponder.
Operational impact
Several minutes of substituted content in place of Channel 10's scheduled programming for its satellite audience. Terrestrial viewers were unaffected.
Affected segments
link, user
Disclosed
2014-07-15
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
Channel 10's scheduled programming was replaced for several minutes for its satellite audience, and the al-Qassam Brigades claimed responsibility for doing it. Loss of service to the intended audience is the reported effect, stated by several outlets rather than inferred.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
Founder ruling 2026-08-05, editorial question 3 (
docs/decisions.mdentry 73).EX-0012.06sits underEX-0012Modify On-Board Values. An interfering uplink displaced a legitimate carrier at a bent-pipe transponder and no source establishes that anything on board was modified. That is theSI-7stored-versus-transient boundary already codified inCLAUDE.md, applied to a technique rather than a control. The best-supported of the five, because the reported split between affected satellite viewers and unaffected terrestrial ones localises the substitution to the satellite path. Rejected anyway: a rule that spares its strongest counter-example is not a rule. SPARTA does not cite this incident atEX-0012.06.No carrier contention is described.
Would be the right edge if the spear-phishing speculation were established. It is not; Security Affairs offers it as a guess. Recorded here so a reviewer with better sourcing knows where it would go.
No source describes an uplink station. Security Affairs is explicit that no attack details were available and speculates in the opposite direction, towards compromise of the broadcaster's own systems.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
Tier 2: Bylined same-week reporting by an established technology publication, citing Israeli broadcast authorities. Retrieved 2026-08-20 through a browser, after HTTP 403 to a command-line client.
Tier 3: A named security practitioner's blog, reporting on and aggregating others' coverage rather than originating it, and explicitly speculating where it lacks facts.
Tier 2: Contemporaneous domestic reporting by an established national newspaper, carrying footage of the substituted broadcast.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.