Counterintelligence — 2026-08-01

Israeli Ambulance Driver Charged With Espionage for Iran, Allegedly Surveilled President Herzog and Finance Minister Smotrich

BLUFIran's escalation from intelligence collection to kinetic tasking through a socially engineered civilian with routine hospital access exposes a vetting gap replicable at any facility hosting wartime officials.

Israeli authorities on Thursday filed an indictment in Haifa District Court against Amir Hisham Muhammad Titi, 34, a private-company ambulance driver from the Galilee village of B'ana, accusing him of transmitting intelligence to Iranian handlers since October 2024 12. The Shin Bet and Israel Police said Titi used hospital access from his job to document emergency protocols and, during the recent Iran war, underground facilities and protected areas at multiple hospitals, and separately reported in real time on a visit by President Isaac Herzog and Finance Minister Bezalel Smotrich to Galilee Medical Center in Nahariya, including a photo of Herzog's security detail 123. He is also accused of photographing Hostages Square in Tel Aviv, the Amikam community where former defense minister Yoav Gallant resides, and the Horev Mall/Center in Haifa, and of mapping camera systems at the Haifa Museum of Art 12. Prosecutors say Titi, arrested in late June by undercover Border Police, received tens of thousands of shekels routed through relatives' bank accounts and a cryptocurrency wallet, including 10,000 shekels for casualty data from the March-April 2026 war with Iran, and that in May 2026 a handler offered him 50,000 shekels for an unexecuted "find and hit" mission 1.

Analysis
The recruitment method, social-media impersonation of a sitting minister to cultivate a low-level access agent rather than a trained operative, matches a pattern Shin Bet has documented across dozens of cases in two years, and Titi's hospital access let handlers map wartime medical vulnerabilities and track officials' movements in real time, exposing a vetting gap for contractors holding facility access at sensitive sites during active conflict. The unexecuted "find and hit" tasking marks an escalation toward attempted kinetic targeting through a recruited citizen, and the method converges with Russia's use of AI-generated imagery to recruit the Obolienskyi assassination suspect the same week: two services independently exploiting digital deception to cultivate civilian agents for intelligence and kinetic tasks. Reporting rests on three converging primary outlets plus secondary confirmation, though Titi's own account suggests he suspected but did not confirm his handler's Iranian identity until the final interrogation, leaving open that prosecutors' narrative overstates a recruit who believed he was corresponding with a domestic official.

4 sources

WATCH: Ambulance driver arrested, accused of spying for Iran, providing footage of hospitals - The Jerusalem Post
From ambulance driver to alleged Iranian spy: Israeli indicted in major espionage case - i24NEWS
Israeli Ambulance Driver Charged With Spying for Iran, Filmed Herzog Hospital Visit - Haaretz
Ambulance driver charged with Iran espionage, allegedly spied on Herzog and Smotrich - Times of Israel