by Ahmad Mohee•Published on October 28, 2026

Analytical judgment. Israel’s September 2024 pager and walkie-talkie operation was a real strategic innovation. It resolved two of cyber deterrence’s four classical problems and left the other two untouched, and the two years since have supplied the test the case itself could not. Hardware-supply-chain weaponization delivered unambiguous attribution, along with a narrow and non-repeatable form of credibility that software-based cyber operations cannot achieve. What it did not deliver was escalation control. The conflict the operation was meant to contain produced the killing of Hezbollah’s Secretary-General ten days later, an Israeli ground invasion, a ceasefire observed in form more than in substance, Hezbollah’s resumption of fire in March 2026, and a renewed war whose daily fatality rate exceeded that of the escalation it was supposed to forestall. The deterrent value was genuine but narrow, and it did not last. The demonstrative value is what persists: the operation showed what a state can do to the supply chain of devices people carry on their bodies.

Executive Summary

On 17 September 2024, some 4,000 to 5,000 weaponized pagers detonated almost simultaneously across Lebanon. Roughly a thousand walkie-talkies followed a day later. Lebanon’s Ministry of Public Health recorded twelve killed, two of them children, and more than 2,750 wounded in the first wave; at least twenty-five were killed and over 600 injured in the second [1][2]. The clinical literature describes the episode as “the first large-scale use of a mass communication device as a targeted attack,” with an injury distribution concentrated in the eyes, face and hands that has no precedent in modern conflict medicine [3].

The case matters because it appeared to resolve problems two decades of scholarship had treated as structural. Classical deterrence requires demonstrable capability, credible commitment and clear communication [4]. Cyberspace degrades all three, through attribution failure, credibility deficiency, escalation ambiguity and norm uncertainty, which together constitute what Joseph Nye called “the cyber deterrence problem” [5]. A hardware-supply-chain operation behaves differently. It produces forensically traceable physical effects that cannot be denied, repudiated or minimized.

The evidence supports a bounded conclusion. On attribution the operation succeeded decisively, and more completely than was apparent at the time: on 11 November 2024 the Israeli Prime Minister’s Office confirmed that Netanyahu had approved it, converting strong inference into state acknowledgment [6][7]. On credibility it succeeded by a mechanism narrower than deterrence theory anticipates, sidestepping the access-versus-signalling dilemma instead of resolving it, since a capability already spent in a single irreversible act leaves nothing further to reveal or conceal [8]. On escalation ambiguity it failed, and the subsequent record makes that failure unusually legible. On norms it provoked contestation without producing convergence.

What has happened since September 2024 is the central new evidence, and it can now be stated in numbers. Hassan Nasrallah was killed on 27 September 2024. Israel invaded southern Lebanon in October, and a ceasefire was agreed on 27 November [9][10]. Sawaya and Spagat’s analysis of Lebanese Ministry of Public Health records, covering 8 October 2023 to 7 June 2026 and totalling at least 8,246 killed and 29,312 wounded, puts the daily fatality rate at 49.9 during the autumn 2024 escalation. It fell to 0.9 under the ceasefire that followed, then climbed to 54.4 between 2 March and 17 April 2026, higher than the escalation the attack was supposed to prevent [11]. Hezbollah resumed fire on 2 March 2026 and confirmed that the strikes were retaliation for the killing of Iran’s Supreme Leader [12]. Within three weeks over a million Lebanese had been displaced, and Israeli displacement orders covered more than fourteen per cent of Lebanese territory [10].

Two things follow. No reading of the pager attack as a durable deterrent survives this record; the more defensible interpretation is that the operation enabled a subsequent military campaign instead of substituting for one, which is precisely the logic Rovner, Cormac and Maschmeyer identify as sabotage’s characteristic strength and its characteristic limit [13]. And the governance gap the case exposed remains open. The regulatory response of 2025 and 2026 has been substantial but misdirected: the European Union’s Cyber Resilience Act, together with successive United States equipment-authorization and grid supply-chain rules, addresses software integrity and vendor provenance, not the pre-positioning of explosive material inside consumer electronics [14][15][16]. No treaty instrument reaches that act directly. No state has been obliged to take a position on it.

1. The Strategic Question: Deterrence Breakthrough or Category Error?

The question is not whether the operation succeeded tactically. It plainly did. The question is whether it demonstrates that cyber-physical operations can carry deterrent weight software-based operations cannot. The affirmative case rests on mechanism. Cyber deterrence fails principally because attribution is slow, contestable and technically deniable, and because credibility in the domain requires revealing intelligence access that revealing then destroys [5][8]. An operation that places explosive material inside a device and detonates it produces effects that are immediate, physical, distributed across geography and forensically legible. The attacker’s identity becomes inferable from component sourcing and operational reach instead of from contested network telemetry.

The negative case holds that this reframing mistakes the category. A rival strand of cyber-strategy scholarship argues that cyberspace is characterized by continuous low-level contact, not by discrete threats awaiting dissuasion, and that the appropriate frame is persistent engagement [17]. Israel’s own doctrine supports the objection. The operation sits within MABAM (Mivtza Bein HaMilhamot, the campaign between wars), a framework for continuous calibrated operations below the threshold of general war. If the attack was one move in a sustained campaign of managed friction, and not a bounded signal intended to produce a behavioural response, then asking whether it “restored deterrence” asks the wrong question of the case.

Recent scholarship sharpens this objection into something more useful than a framing dispute. Rovner, Cormac and Maschmeyer define sabotage as the weaponization of friction to degrade a system’s performance from within, and argue that its strategic logic is distinct from both covert action and subversion. Their central finding is that sabotage works poorly on its own but well as an enabler of other instruments of statecraft. They open their analysis with the pager attack, treating it as a classic act of sabotage that degraded Hezbollah’s communications, bred organizational paranoia and prepared the ground for the Israeli invasion that followed [13]. On that reading the operation’s function was preparatory, not dissuasive. The record of the two years since fits that interpretation in a way it does not fit a deterrence interpretation.

This analysis keeps the deterrence frame for two reasons, while treating the sabotage frame as a scope condition and not a rival to be dismissed. First, the operation was discrete, one-time and non-repeatable, which fits deterrence theory’s single-signal logic more naturally than it fits the sustained network-access operations persistent-engagement theory describes. Second, acknowledging authorship (section 3) is a deterrence-theoretic act: saboteurs typically preserve deniability, and Israel discarded it. The deterrence frame should now be read as illuminating one dimension of the operation without exhausting it.

Figure 1: Multi-Paradigmatic Analytical Framework. Rational deterrence supplies the core explanatory framework of capability, credibility and communication, but cannot on its own account for the outcomes. Constructivism explains the normative contest documented in section 8; complexity theory the non-linear effects traced in section 6; and resilience theory Hezbollah’s post-attack adaptation and its capacity to initiate again eighteen months later, examined in section 5.

2. What Happened — and What the Record Now Shows

The infiltration was prolonged. Open-source reconstruction, drawing on device forensics, legal tracing of corporate entities and investigative reporting, indicates a sequence that began around 2015 when Israeli intelligence identified pagers as a weak point in Hezbollah’s communications security. It proceeded through reverse engineering of the Gold Apollo AR924 architecture and the development of a battery-integrated charge using pentaerythritol tetranitrate, and it culminated when Hezbollah’s own decision to migrate to pagers in early 2024 opened the delivery window [18]. Roughly 5,000 compromised devices entered the supply chain through a Hungarian shell entity, B.A.C. Consulting, which had licensed the right to manufacture pagers under the Gold Apollo brand [19]. Dates for the earliest phases are reasonable inferences, not documented events, and the principal forensic source remains an unrefereed preprint. That limitation should qualify the technical detail without undermining the structural finding.

Figure 2: Layered Supply Chain Network. The compromise was difficult to detect from any single vantage point: no participant below the modification facility had visibility of the layer above it, and the brand under which the devices travelled was genuine at the point of licensing. This layered structure is what section 10 addresses in recommending provenance obligations on licensors.

The choice of explosive was strategic, not merely technical. PETN is chemically inert enough to evade explosives trace detection. Its atomic number is close to that of electronic polymers, so it produces little X-ray contrast against the components around it. It requires deliberate initiation, and it achieves lethal effect at roughly six grams, small enough to fit inside a battery [18]. The result was a device that passed the inspection regimes a non-state actor can realistically operate.

Property	Value	Significance
Density	1.76 g/cm³	Similar to electronic component polymers
Detonation velocity	8,400 m/s	Extremely high brisance
Impact sensitivity	Low (~7.5 J)	Requires detonator for triggering
Thermal stability	Stable at room temperature	Safe for covert transport and storage
Quantity per device	~6 grams	Sufficient for lethal effect, difficult to detect

Table 1. Properties of PETN relevant to detection evasion.

The two waves differed in a way that bears on the casualty pattern. Walkie-talkies carry more batteries and more internal volume, which permits four to five times the explosive mass. That produced a markedly higher case fatality rate on the second day despite far fewer devices.

Characteristic	Pagers	Walkie-talkies	Consequence
Device size	Compact (pocket-sized)	Larger, hand-held	More volume for explosive
Battery count	1–2 batteries	Multiple batteries (4–6)	Greater total PETN mass
Estimated PETN	~6 grams	20–30 grams	4–5× greater explosive energy
Casualty impact	12 killed, ~2,750 injured	≥25 killed, >600 injured	Higher case fatality rate for walkie-talkies

Table 2. Comparison of pager and walkie-talkie modifications. Casualty figures follow the Lebanese Ministry of Public Health [1][2]; the forensic preprint reports a higher combined total of 42 fatalities [18].

Three elements of the public record have been clarified since the operation, and each bears on the analysis. Israel acknowledged authorship when the Prime Minister’s Office confirmed on 11 November 2024 that Netanyahu had approved the attack, and he subsequently displayed a pager at the United Nations General Assembly [6][7]. Taiwan’s prosecutors closed their investigation the same day, concluding that neither the devices nor their components were manufactured by Taiwanese firms or individuals [20][21]. That conclusion substantiates the layered-compromise account instead of weakening it: the brand under which the devices travelled was genuine, the manufacturing was not, and the nominal manufacturer’s own government could find no domestic involvement. Supply-chain compromise of this kind needs neither the cooperation nor the awareness of the firm whose name the product carries.

The human cost has also proved more durable than the initial counts conveyed. The health ministry’s figures of twelve killed with more than 2,750 wounded on 17 September, and at least twenty-five killed with over 600 injured on 18 September, run below the forensic preprint’s estimate of 42 fatalities, and the ministry’s numbers should be preferred [1][2][18]. But fatality counts understate what happened. Reporting one year on found that no survivor had fully recovered. Documented injuries include bilateral blindness, enucleation, amputated fingers and hands, and facial reconstruction; one survivor had undergone forty-five surgeries in nine months. Lebanese hospitals were overwhelmed, and casualties were sent to Iran, Syria and Iraq for treatment [2]. An injury profile concentrated in the eyes and hands, inflicted on several thousand people in a single afternoon, turns a nominally low fatality figure into a mass permanent-disability event. This matters for the proportionality assessment in section 7, and for any ethical assessment of the method.

3. Attribution: The Problem the Operation Solved

Figure 3: Cyber Deterrence Problems — Outcomes for This Case. The figure summarizes the findings developed across sections 3 to 6 against Nye’s four-problem framework [5]. Attribution is resolved by this case’s specific mechanism and credibility more narrowly so; escalation ambiguity is not resolved; norm uncertainty remains contested and is addressed in section 8.

Attribution is the problem the operation resolved most clearly. The mechanism deserves precision, because this is the narrowest and strongest claim available here. Forensic evidence, including component sourcing, the explosive signature and the corporate architecture traceable through the Hungarian entity, pointed firmly toward Israeli capability. But forensics established capability, not authorship. What made attribution unambiguous was political confirmation: Netanyahu’s implicit acknowledgment first, then his office’s explicit confirmation of approval [6][7]. Attribution came from physical undeniability combined with deliberate disclosure, not from forensics alone.

This is rarer than it looks. In the canonical comparison case, Stuxnet, the operators never acknowledged authorship. Iran could infer a great deal about the attacker’s technical sophistication and received no explicit political signal at all. Non-acknowledgment plausibly limited Stuxnet’s deterrent value, since capability demonstrated without resolve demonstrated is an incomplete signal. The pager attack supplied both halves.

Recent work on sabotage treats this as a deliberate and consequential choice. Rovner, Cormac and Maschmeyer note that saboteurs may make themselves identifiable precisely so the victim is forced to reconsider the technological balance between them, and they describe an “implausible deniability” posture in which an attacker formally disclaims responsibility while the victim retains no real doubt [13]. Israel went further and abandoned deniability outright. On the deterrence reading advanced here, that abandonment is what turns a successful sabotage operation into a deterrent signal; on the sabotage reading it departs from the instrument’s normal logic and needs explaining. Both readings agree the acknowledgment was decisive, and both identify a cost. Section 8 argues that the disclosure which created the signal also created the template.

4. Credibility Without Repeatability: The One-Shot Mechanism

The credibility finding needs more qualification than the attribution finding, and the qualification is substantive. Glaser locates the cyber credibility deficit in a specific tension: conducting retaliatory cyber operations requires maintaining intelligence access to adversary networks, but revealing that access to substantiate a threat destroys it, while concealing it leaves the threat unsubstantiated [8]. Fearon’s account of credible commitment turns on visible hand-tying, meaning irreversible acts or sunk costs that compel follow-through [22].

The pager attack sidesteps Glaser’s tension instead of resolving it. Because the demonstrated capability was consumed in a single irreversible act, Israel had nothing further to reveal or conceal about ongoing access. The nine-year infiltration was spent in the execution. Hardware-supply-chain operations can therefore achieve credibility, but by a mechanism that trades the sustainability of a standing capability for the one-time, undeniable proof Fearon calls hand-tying. Whether this constitutes credibility in the forward-looking sense Fearon describes, or only the retrospective clarity of a completed and undeniable act, is a distinction the available evidence cannot settle.

The practical consequence is that the mechanism generalizes poorly. A deterrent threat draws its force from the prospect of repetition. An operation whose credibility comes from having already been executed, through an access route that executing it closed, leaves the deterring state no better positioned for the next round than it was before. The exception is reputational: the adversary now credits it with a general willingness to do such things. That effect is real but weak, and section 5 indicates it was insufficient.

5. Did It Deter? The Two-Year Verdict

Tactically the operation achieved deterrence by denial without ambiguity. Hezbollah’s pager network was destroyed, its secure communications were disrupted for weeks, and the organization was pushed onto less secure alternatives. Assessments published in the weeks afterward by RUSI and the Washington Institute described the episode as a major security breach and judged that Hezbollah was not pressing toward general war.

The strategic verdict is more complex, and it can now be assessed against a dataset. Sawaya and Spagat’s analysis of Lebanese Ministry of Public Health records, covering 8 October 2023 to 7 June 2026, records at least 8,246 killed and 29,312 wounded in Lebanon, and disaggregates fatalities by phase. The daily death rate was 1.9 during the low-intensity exchanges preceding the September 2024 escalation and 49.9 during the escalation itself. It then fell to 0.9 under the ceasefire that ran from late November 2024 to 1 March 2026, a reduction of roughly ninety-eight per cent. It rose to 54.4 per day between 2 March and 17 April 2026, exceeding the original escalation, before settling at 21.3 per day under the ceasefire that followed: more than twenty times the 2024 ceasefire rate [11].

These figures cut both ways, and an honest reading has to hold both halves. The 2024 to 2026 ceasefire period represents a genuine and dramatic de-escalation, consistent with some combination of deterrence and exhaustion. It cannot be attributed to the pager attack specifically. The intervening period contained Nasrallah’s killing on 27 September 2024, a ground invasion, the destruction of much of Hezbollah’s senior leadership, and a ceasefire negotiated under intensive external pressure [9][10]. To credit a de-escalation that followed all of this to a communications attack that preceded all of it would be a straightforward post hoc error. The pager attack is better understood as the opening move of a campaign whose later and far more destructive phases did the coercive work.

The de-escalation did not hold either. The ceasefire was never fully observed, and the Office of the High Commissioner for Human Rights verified 139 civilian deaths in Lebanon between the ceasefire and 1 March 2026 [10]. On 2 March 2026 Hezbollah fired on northern Israel for the first time since the agreement, and confirmed that the strikes were retaliation for the killing of Iran’s Supreme Leader in US and Israeli strikes days earlier [12]. In the three weeks that followed, the Government of Lebanon recorded 1,029 killed and 2,786 injured. More than a million people were displaced. Israeli warnings and displacement orders covered over 189 towns and villages, amounting to more than fourteen per cent of Lebanese territory [10]. By late May, Israeli forces had advanced beyond the declared “yellow line” and issued displacement orders covering the whole of southern Lebanon [23].

Several conclusions follow. Whatever restraint Hezbollah exercised after September 2024 was not durable, and the organization retained or reconstituted enough capability to initiate eighteen months later. This looks like organizational resilience and not deterrence compliance: the group absorbed the shock, investigated, reorganized and reconfigured. The restraint of late 2024 was in any case overdetermined. Intensive US and allied diplomacy, fear of a general Israel–Iran war, Lebanon’s domestic fragility, and the organizational disruption of losing command communications all pushed the same way. The disruption mechanism in particular is observationally indistinguishable from deterrence by denial, since a network destroyed by an adversary and a network its owner distrusts and reorganizes around produce similar downstream behaviour by different causal routes. Both were almost certainly operating. Table 3 sets out how each observable outcome admits of a deterrence reading and a non-deterrence reading the open-source record cannot separate.

Observable outcome	Deterrence interpretation	Alternative explanation
No immediate large-scale Hezbollah offensive	Demonstrated Israeli capability and willingness dissuaded major escalation	Fear of Israeli counteroffensive, regional war, US diplomacy and domestic political constraints encouraged restraint regardless of deterrence
Shift to cautious, less coordinated fire	Deterrence by denial: compromised communications deter complex operations	Operational disruption and the need to rebuild secure command and control limited logistics and command capacity
Strong rhetorical threats but calibrated kinetic action	Psychological deterrence: leadership internalized the risks of Israeli penetration	Standard Hezbollah signalling pattern under external and domestic pressure

Table 3. Competing explanations for Hezbollah’s post-attack behaviour.

Most consequentially, the trigger for the 2026 escalation lay outside the Israel–Hezbollah dyad altogether. Hezbollah resumed fire in response to the killing of its patron’s Supreme Leader. No deterrent signal directed at Hezbollah in September 2024 could have been calibrated against a contingency of that kind. This is the clearest available demonstration that the operation did not purchase escalation control, and the point is structural, not contingent: a deterrent relationship nested inside a patron–proxy structure can be overridden by events in the patron relationship that the deterring state’s signalling never addressed.

One further observation concerns the channel through which pressure on Hezbollah actually operated. The most substantial constraint placed on the organization after 2024 was not an Israeli deterrent signal but a Lebanese state process. The cabinet approved the objectives of a US-sponsored disarmament plan in August 2025; the army completed a first phase between the Litani and the southern border by January 2026; and a second phase covering the Litani–Awali area was announced in February 2026 with a four-month horizon [32][33]. Hezbollah rejected disarmament north of the Litani throughout, and Secretary-General Naim Qassem called the government’s focus on the question a grave error serving Israeli objectives [32]. Whatever coercive effect the 2024 operations ultimately produced was mediated through Lebanese domestic institutions and external diplomacy, not through a dyadic deterrent relationship. Classical deterrence theory does not model that mechanism, and cyber-physical signalling does not engage it directly.

6. Escalation Ambiguity: The Problem It Did Not Solve

Nye locates escalation ambiguity in the difficulty of anticipating an operation’s second- and third-order effects [5]. The pager attack inverts the usual form of this problem without escaping it. Its immediate effects were the least ambiguous in the history of cyber-enabled operations: thousands of devices, one moment, visible consequences. Its escalatory trajectory was nonetheless opaque to the actors involved. Hezbollah’s measured initial response depended on US diplomatic intervention and on organizational disruption Israel could not have fully anticipated or controlled. What followed, from decapitation and invasion through a partially observed ceasefire to renewed war triggered by events in Iran, was not a trajectory any planner could have specified in September 2024.

Undeniability of an act is not predictability of the responses to it, and the two are routinely conflated. A cyber-physical operation can make its own effects wholly unambiguous while leaving adversary and third-party reactions exactly as unpredictable as in Nye’s account of software-based operations. The acknowledgment that solved attribution may even have worsened escalation management. An unacknowledged operation leaves an adversary room to absorb a blow without a public reckoning; an acknowledged one imposes a reciprocal obligation to respond. Hezbollah’s vows of “just punishment,” and what came after them, fit that reading. The disaggregated fatality data in section 5 measure the result: the phase that began eighteen months after the attack was more lethal per day than the phase the attack was meant to arrest [11].

7. The Legal Gap: Why the Booby-Trap Prohibition Did Not Bite

The jus ad bellum question is the least contested. Between 8 October 2023 and 17 September 2024 Hezbollah fired more than 8,000 rockets toward Israel, displacing tens of thousands of civilians and causing both military and civilian casualties. Cohen and Shany conclude that this volume exceeds the quantitative threshold for armed attack, and note that the operation followed roughly eleven months of failed negotiation and graduated response [19].

The jus in bello questions are genuinely unsettled. Pagers procured specifically for secure military communication and distributed selectively to operatives have a reasonable claim to military-objective status under Article 52(2) of Additional Protocol I. Proportionality is where the argument turns, and the long-term injury data in section 2 bear on it directly. An assessment weighing anticipated military advantage against twelve immediate deaths differs materially from one weighing it against several thousand permanent disabilities concentrated in the eyes and hands [2][3]. Table 4 sets out the elements such an assessment must weigh.

Factor	Analysis
Casualties	At least 37 fatalities, predominantly military operatives; two children killed [1][2]
Military advantage	Destruction of the secure communication network; temporary operational paralysis; forced migration to less secure platforms
Civilian harm	Incidental injuries to non-combatants near operatives; several thousand permanent disabilities concentrated in the eyes and hands; psychological harm from personalized targeting [2][3]

Table 4. Elements of the proportionality assessment.

UN human rights mechanisms characterized the simultaneous targeting of thousands of individuals as a violation of international human rights law and called for an independent investigation [24]. None has been established. UN experts were still calling for independent investigation of Israeli conduct in Lebanon in April 2026, and OHCHR’s assessment of the renewed fighting found apparent failures to comply with distinction, proportionality and precautions in attack, alongside a finding that Hezbollah’s unguided rocket fire into populated areas likely violated the prohibition on indiscriminate attacks [10][25]. The accountability track this case generated has produced statements, not process.

The booby-trap question is the most interesting and the most consequential for policy. Article 7 of CCW Amended Protocol II prohibits booby traps in the form of “apparently harmless portable objects which are specifically designed and constructed to contain explosive material.” The argument that the prohibition does not apply holds that an object purchased and used for military purposes is military equipment and not an apparently harmless object, and that the provision’s concern is perfidy and civilian harm [19]. That argument is not obviously wrong, which is the problem. A provision drafted to prohibit substantially this physical act can be read not to reach it, because the category “apparently harmless” is defined by the object’s function to its possessor and not by its appearance to the world. The gap is definitional, and it is the clearest single candidate for codification this case identifies.

8. Norm Catalysis, Emulation, and the Hardware Security Dilemma

Constructivist norm theory holds that norms emerge from contestation among relevant audiences and not from single events [26]. On that account the pager attack is better understood as a catalytic event than a norm-generating one, and it catalysed interpretation across three audiences that reached incompatible conclusions. Legal and institutional elites framed the operation through legality under international humanitarian law. Strategic communities framed it through effectiveness and replicability. Affected publics and human rights organizations framed it through bodily integrity and the personalization of violence; Boelt Back’s ethnomethodological research on post-attack Lebanon documents a spillover of distrust from the targeted devices to electronic devices generally [27]. Catalysis of this kind does not produce convergence. It can accelerate fragmentation, as legal ambiguity lets competing interpretations coexist, strategic incentives encourage normalization, and incompatible narratives of lawful deterrence against terrorism resist synthesis.

The security-dilemma logic is correspondingly structural [28]. Demonstrating the capacity to weaponize a supply chain increases perceived vulnerability for every actor dependent on globally sourced electronics, pushing them toward defensive measures that are costly and imperfect, while offensive methods are expensive but replicable once established. Buchanan’s cybersecurity dilemma describes the same bind at network level: intrusions undertaken for defensive or intelligence purposes are indistinguishable from offensive preparation once discovered [29]. The pager attack demonstrates it at hardware level, where the involuntary participants, meaning manufacturers, licensees and logistics firms, have neither visibility nor remedy. Table 5 disaggregates the points at which that compromise becomes possible, and indicates why defensive verification is so much harder than offensive penetration.

Vulnerability type	Exploitation method	Detection difficulty
Component sourcing	Acquisition of legitimate branded parts via licensing; subversion at the manufacturing stage	High — components appear authentic
Firmware access	Reverse engineering of microcontroller firmware; development of modified firmware	High — firmware not user-inspectable
Manufacturing process	Infiltration of the manufacturing facility; insertion of modified batteries during assembly	High — legitimate and modified components intermixed
Distribution interception	Compromise of logistics nodes; battery replacement in transit	Medium — requires specific access nodes
Quality assurance bypass	Subversion of QA personnel and processes; documentation falsification	Medium — depends on QA rigour

Table 5. Supply-chain vulnerability taxonomy. Four of the five points of entry are rated high-difficulty for the defender, which is the structural basis of the asymmetry identified in section 9 and addressed in section 10.

Two years of evidence allow more discipline here than forecasting usually permits. No state has visibly replicated a hardware-supply-chain weaponization operation of this kind. That absence fits high barriers to emulation at least as well as it fits an incipient arms race, given that the operation required nine years of access, a licensed manufacturing front, and willingness to spend all of it at once. Lawson has documented the field’s recurring tendency to extrapolate worst-case futures from single dramatic incidents [30]. Proliferation remains a plausible trajectory, not an observed one.

The regulatory record points the same way, and its shape is instructive. Supply-chain security has moved substantially since 2024. The European Union’s Cyber Resilience Act brought incident- and vulnerability-reporting obligations into force on 11 September 2026, with full product requirements following in December 2027; the United States tightened equipment-authorization rules against national-security supply-chain threats in December 2025 and revised grid supply-chain risk-management standards in September 2025 [14][15][16]. None of these instruments addresses the act this case involves. They govern software integrity, vendor provenance and vulnerability disclosure, which is the compromise of a device’s logic, not the pre-positioning of explosive material inside its battery. Technical work on hardware trust, including blockchain-based verification of device authenticity, remains at the research stage [31]. The policy conversation moved toward cyber supply-chain assurance while the demonstrated threat was physical.

9. Regional Security Implications

Implication	Analytical significance
Attribution can be engineered, not merely established	A state can manufacture clarity about authorship by combining physically undeniable effects with deliberate disclosure. This is a reproducible choice, not a property of the technology, and it detaches attribution from forensic capability.
Credibility achieved by expenditure does not persist	A capability consumed in its own demonstration leaves no standing threat. Deterrent effects obtained this way decay, and the March 2026 resumption of hostilities is consistent with that decay.
The de-escalation of 2024–2026 was real but not attributable to the attack	A ninety-eight per cent fall in the daily fatality rate followed decapitation, invasion and a negotiated ceasefire as well as the pager attack. Single-cause attribution is unavailable.
Escalation control was not obtained and may have been reduced	Acknowledgment that solved attribution also created a reciprocal obligation to respond. Undeniability of an act and predictability of reactions are distinct properties, routinely conflated.
The decisive escalation trigger lay outside the dyad	Hezbollah resumed fire after the killing of Iran’s Supreme Leader, not in response to Israeli signalling. Deterrence calibrated within a dyad cannot govern outcomes driven by a patron’s strategic position.
The legal gap is definitional and remains unclosed	CCW Amended Protocol II’s “apparently harmless portable object” category can be read not to reach devices used for military purposes. No state has been obliged to state a position.
Regulation has addressed the wrong layer	Cyber supply-chain instruments now in force govern software and provenance; physical pre-positioning of explosive material in consumer devices remains unregulated.
Defensive capacity is asymmetrically distributed	States can afford offensive supply-chain penetration; non-state actors, low-resource states and civilian institutions cannot afford equivalent verification. This produces structural denial while incentivizing reciprocal capability development.

Table 6. Strategic implications and their analytical significance.

10. Policy Considerations

For states and defence establishments. Treat the credibility mechanism as non-transferable. The operation’s deterrent value derived from conditions that do not obtain in state-on-state contexts: deep asymmetry, a non-state target, years of uncontested access, and willingness to expend that access entirely. Planning that assumes otherwise mistakes a boundary condition for a doctrine. Where supply-chain operations are contemplated, the acknowledgment decision deserves treatment as a distinct strategic choice with costs on both sides of the ledger, since disclosure buys the signal and creates the template at the same time. The record in section 5 further suggests that operations of this kind should be planned as enablers of a subsequent campaign, which is how this one in fact functioned, and not as alternatives to one.

For manufacturers, licensees and supply-chain regulators. The Taiwanese finding that no domestic firm or individual was involved in devices sold under a Taiwanese brand identifies the structural exposure precisely: brand licensing transfers reputational liability without transferring visibility or control [20][21]. Licensors should be required to maintain verifiable provenance over manufacturing conducted under their marks. More consequentially, the instruments now entering force address software integrity and not physical tampering. Extending conformity assessment to include physical-integrity attestation for licensed manufacturing, covering weight and density verification and battery-assembly provenance, would address the demonstrated threat instead of the adjacent one [14][15].

For international actors. The gaps identified above point to three measures. First, the definitional ambiguity in CCW Amended Protocol II Article 7 should be resolved by amendment or interpretive declaration, on the model by which landmines and blinding lasers eventually received dedicated instruments; the minimum useful outcome is that states be obliged to state a position instead of operating in ambiguity. Second, hardware-attestation capacity should be funded internationally and directed at the civilian-adjacent institutions least able to self-fund it, such as hospitals, humanitarian communications networks and utilities, and not at states already capable of self-defence. Third, red-line diplomacy should prioritize the categories where emulation would be most consequential: implanted and life-sustaining medical devices, humanitarian communications equipment, and critical civilian infrastructure controls. Device-neutral rules are easier to negotiate and do less to prevent the worst cases. None of these measures would have prevented this operation, conducted by a state with resources no non-state actor can match. Their value lies in raising cost and narrowing the target set for the next actor contemplating emulation.

11. Analytical Conclusion

Israel’s 2024 pager attack was a strategic innovation in cyber-physical coercion that partially restores classical deterrence logic through clear attribution and irreversible physical effects. It does so only within asymmetric conflicts against non-state adversaries, and only temporarily. The operation resolved attribution decisively and credibility by a narrow, non-repeatable mechanism. It did not resolve escalation ambiguity, and it did not produce normative settlement. Its denial effects were well supported; its punishment effects were plausible but never independently confirmed; and the restraint it appeared to purchase was overdetermined at the time and, as the record since has shown, temporary.

The two years since have supplied the kind of test single-case analysis rarely receives. The result is not a reversal of the original assessment but a sharpening of it. The attack was followed by the decapitation of Hezbollah’s leadership, an invasion, a ceasefire observed in form more than substance, and in March 2026 a resumption of full hostilities triggered by events in Tehran and not by any calculation about Israeli resolve. That phase proved more lethal per day than the escalation the attack was meant to forestall [11][12]. A deterrent that cannot survive a shift in its target’s patron relationships was not a deterrent in the sense classical theory describes. The more defensible interpretation, which the most recent scholarship on sabotage supports, is that the operation enabled the campaign that followed instead of replacing it [13].

What persists is the demonstration. The operation established that a state with sufficient patience can place explosive material inside the consumer electronics carried by its adversary’s personnel and detonate them at a moment of its choosing, and it established this publicly, in a form other states can study. Whether that demonstration is contained depends on three things developing faster than the incentive to emulate: physical-integrity attestation in licensed manufacturing, a legal category that actually reaches the act, and red lines around the device classes where the next such operation would do the most harm. The regulatory movement of 2025 and 2026 has been real but aimed at a different problem. The question this case leaves open is therefore not whether deterrence is possible in the digital age. It is how international humanitarian law, supply-chain governance and deterrence theory should treat consumer devices once they can be turned, quietly and at scale, into weapons.

---

References

[1] Middle East Eye, “Lebanon: Twelve killed and 2,750 wounded after deadly pager blasts,” 17 September 2024, https://www.middleeasteye.net/news/scores-hezbollah-members-wounded-communications-devices-explode

[2] PBS NewsHour, “Survivors of Israel’s pager attack on Hezbollah last year struggle to recover,” 2025, https://www.pbs.org/newshour/world/survivors-of-israels-pager-attack-on-hezbollah-last-year-struggle-to-recover

[3] R. Alameddine, N. Baha’, M. Ahmad, J. Saade and W. J. Kheir, “The synchronized pager explosions: an unprecedented pattern of injuries,” World Journal of Emergency Surgery 20 (2025), p. 70, https://doi.org/10.1186/s13017-025-00587-6

[4] T. C. Schelling, Arms and Influence (New Haven: Yale University Press, 1966).

[5] J. S. Nye, “Deterrence and dissuasion in cyberspace,” International Security 41, no. 3 (2017), pp. 44–71, https://doi.org/10.1162/ISEC_a_00266

[6] France 24, “Israeli PM’s office confirms Netanyahu approved Lebanon pager attacks,” 11 November 2024, https://www.france24.com/en/middle-east/20241111-israeli-pm-office-confirms-netanyahu-approved-lebanon-pager-attacks

[7] NBC News, “Israel’s new defense minister says Hezbollah is defeated; Netanyahu acknowledges approving pager attacks,” 11 November 2024, https://www.nbcnews.com/news/world/israels-new-defense-minister-says-hezbollah-defeated-netanyahu-acknowl-rcna179554

[8] C. L. Glaser, Rational Theory of International Politics: The Logic of Competition and Cooperation (Princeton: Princeton University Press, 2011).

[9] Council on Foreign Relations, “Conflict with Hezbollah in Lebanon,” Global Conflict Tracker, accessed 1 November 2026, https://www.cfr.org/global-conflict-tracker/conflict/political-instability-lebanon

[10] OHCHR Regional Office for the Middle East and North Africa, “Deaths and displacement in Lebanon: update on the human rights situation in Lebanon (2–22 March 2026),” 24 March 2026, https://www.ohchr.org/sites/default/files/documents/countries/lebanon/update-on-the-human-rights-situation-in-lebanon-23-04-2026.pdf

[11] N. Sawaya and M. Spagat, “Patterns of civilian harm, displacement, and institutional targeting by Israel of Lebanon, October 2023 to June 2026: a data-driven assessment of the war’s human impact,” Action on Armed Violence, 10 June 2026, https://aoav.org.uk/2026/patterns-of-civilian-harm-displacement-and-institutional-targeting-by-israel-of-lebanon-october-2023-to-june-2026-a-data-driven-assessment-of-the-wars-human-impact/

[12] The Times of Israel, “Hezbollah confirms it fired rockets at Israel as ‘revenge’ for Khamenei,” 2 March 2026, https://www.timesofisrael.com/liveblog_entry/hezbollah-confirms-it-fired-rockets-at-israel-as-revenge-for-khamenei/

[13] J. Rovner, R. Cormac and L. Maschmeyer, “Sand in the gears: sabotage in world politics,” European Journal of International Security 11 (2026), pp. 541–560, https://doi.org/10.1017/eis.2025.10025

[14] National Law Review, “Cyber Resilience Act: 11 September 2026 key starting point for reporting obligations,” 2026, https://natlawreview.com/article/cyber-resilience-act-11-september-2026-key-starting-point-reporting-obligations

[15] Federal Register, “Protecting against national security threats to the communications supply chain through the equipment authorization program,” 4 December 2025, https://www.federalregister.gov/documents/2025/12/04/2025-21928/protecting-against-national-security-threats-to-the-communications-supply-chain-through-the

[16] Federal Register, “Supply chain risk management reliability standards revisions,” 23 September 2025, https://www.federalregister.gov/documents/2025/09/23/2025-18394/supply-chain-risk-management-reliability-standards-revisions-equipment-and-services-produced-or

[17] M. P. Fischerkeller and R. J. Harknett, “Deterrence is not a credible strategy for cyberspace,” Orbis 61, no. 3 (2017), pp. 381–393, https://doi.org/10.1016/j.orbis.2017.05.003

[18] P. P. Sarker, U. Das, N. Varshney, S. Shi, A. Kulkarni, F. Farahmandi and M. Tehranipoor, “When everyday devices become weapons: a closer look at the pager and walkie-talkie attacks,” arXiv preprint arXiv:2501.17405 (2025), https://arxiv.org/abs/2501.17405 [unrefereed preprint]

[19] A. Cohen and Y. Shany, “‘Well, it depends’: the explosive pagers attack revisited,” Lieber Institute, West Point, 2025, https://lieber.westpoint.edu/well-it-depends-explosive-pagers-attack-revisited/

[20] Voice of America, “Taiwan closes exploding pagers case, says not made by Taiwanese firms,” 11 November 2024, https://www.voanews.com/a/taiwan-closes-exploding-pagers-case-says-not-made-by-taiwanese-firms/7859489.html

[21] The Times of Israel, “Closing case, Taiwan prosecutors say Hezbollah exploding pagers not made by local firms,” 11 November 2024, https://www.timesofisrael.com/closing-case-taiwan-prosecutors-say-hezbollah-exploding-pagers-not-made-by-local-firms/

[22] J. D. Fearon, “Signaling foreign policy interests: tying hands versus sinking costs,” Journal of Conflict Resolution 41, no. 1 (1997), pp. 68–90, https://doi.org/10.1177/0022002797041001004

[23] The National, “Israeli military orders displacement of all southern Lebanon,” 27 May 2026, https://www.thenationalnews.com/news/mena/2026/05/27/israeli-strikes-kill-31-in-lebanon-as-troops-advance-beyond-yellow-line/

[24] OHCHR, “Exploding pagers and radios: a terrifying violation of international law, say UN experts,” 18 September 2024, https://www.ohchr.org/en/press-releases/2024/09/exploding-pagers-and-radios-terrifying-violation-international-law-say-un

[25] OHCHR, “Lebanon: UN experts call for international independent investigation into Israel’s killing of journalists,” April 2026, https://www.ohchr.org/en/press-releases/2026/04/lebanon-un-experts-call-international-independent-investigation-israels

[26] M. Finnemore and K. Sikkink, “International norm dynamics and political change,” International Organization 52, no. 4 (1998), pp. 887–917, https://doi.org/10.1162/002081898550789

[27] T. Boelt Back, “Weaponising ‘apparently harmless portable objects’: emerging categorisations of trust and risk in post-‘pager attacks’ Lebanon,” Small Wars & Insurgencies 36, no. 6 (2025), pp. 1025–1048, https://doi.org/10.1080/09592318.2025.2507223

[28] R. Jervis, “Cooperation under the security dilemma,” World Politics 30, no. 2 (1978), pp. 167–214, https://doi.org/10.2307/2009958

[29] B. Buchanan, The Cybersecurity Dilemma: Hacking, Trust, and Fear Between Nations (Oxford: Oxford University Press, 2016).

[30] S. Lawson, “Beyond cyber-doom: assessing the limits of hypothetical scenarios in the cyber domain,” Journal of Information Technology & Politics 9, no. 3 (2012), pp. 311–325, https://doi.org/10.1080/19331681.2012.664568

[31] C. Sheng, W. Ma, Q.-L. Han, W. Zhou, X. Zhu, S. Wen, Y. Xiang and F.-Y. Wang, “Pager explosion: cybersecurity insights and afterthoughts,” IEEE/CAA Journal of Automatica Sinica 11, no. 12 (2024), pp. 2359–2362, https://doi.org/10.1109/JAS.2024.125034

[32] Al Jazeera, “Lebanon says four months needed for second phase of Hezbollah disarmament,” 17 February 2026, https://www.aljazeera.com/news/2026/2/17/lebanon-says-four-months-needed-for-second-phase-of-hezbollah-disarmament [33] Al Jazeera, “Lebanese cabinet approves ‘objectives’ of US plan to disarm Hezbollah,” 7 August 2025, https://www.aljazeera.com/news/2025/8/7/lebanese-cabinet-holds-more-talks-on-disarming-hezbollah-under-us-pressure