The Receipt That Closes the Case

In April 2024, the Israeli-Palestinian magazine +972 and its Hebrew-language sister site Local Call published an investigation by the journalist Yuval Abraham. The investigation drew on the testimony of six Israeli intelligence officers, granted anonymity, who had served in operational roles with two artificial-intelligence-driven targeting systems used in the Gaza war: a target-generation system called Lavender, and a location-tracking system called Where’s Daddy.

Lavender ingested mass-surveillance data on the entire population of the Gaza Strip — group memberships, frequency of cell-phone changes, contact graphs, address histories — and assigned each person a score from one to one hundred, indicating likelihood of being a militant. The Israel Defense Forces adopted a threshold above which a marked individual was eligible for inclusion in a kill list. Lavender marked approximately thirty-seven thousand Palestinians for assassination.

A human officer reviewed each marked target before the kill order was authorized. The officer’s review, by the testimony of the six sources, averaged twenty seconds. The review consisted, in many cases, of confirming that the marked individual was male. The known false-positive rate of Lavender was approximately ten percent. Of the thirty-seven thousand targets generated, roughly three thousand seven hundred were, by the system’s own internal metrics, mistakes.

Where’s Daddy was the location-tracking system. It alerted operators when a Lavender-marked individual entered his family home. The IDF’s preferred operational doctrine was to authorize the strike at the moment of family-home entry, because that doctrine maximized the probability of confirmed elimination. The consequence of that doctrine was that the strike, typically an unguided “dumb bomb,” killed the target’s entire household.

Lavender and Where’s Daddy together constituted one of the deadliest documented combinations of artificial intelligence and conventional munitions yet deployed in war.

This was the case the +972 / Local Call investigation documented in April 2024. The first book in this series, The Secret Life of Evil Robots, devoted a chapter to Lavender (Chapter 8). The chapter ended on what was then the open question: whether the casualty estimates produced by external observers — the United Nations Office for the Coordination of Humanitarian Affairs, the Lancet, the World Health Organization — were accurate, contested, or politically motivated.

The chapter was completed before August 2025.

In August 2025, +972 and The Guardian jointly published a second investigation, also by Abraham, with the British investigative reporter Emma Graham-Harrison. The second investigation disclosed the existence of an internal IDF Aman intelligence database. The database, the reporters’ sources confirmed, was the authoritative IDF record of suspected Hamas and Palestinian Islamic Jihad militants. Its contents, as of the disclosure, were specific: forty-seven thousand, six hundred fifty-three names.

The reporters cross-referenced the IDF’s own list of suspected militants against the total documented deaths from IDF action in Gaza since October 7, 2023. The arithmetic produced a single number.

By the IDF’s own internal classification: eighty-three percent of the Palestinians killed by the IDF in Gaza were civilians.

Not the United Nations’ figure. Not the Lancet’s figure. Not +972’s editorial framing. Eighty-three percent of the people the Israel Defense Forces had killed were people the Israel Defense Forces had not, on the public record of its own targeting database, identified as militants.

The IDF has not, in the months since publication, disputed the document itself.

This is the receipt that closes the case.

For two years prior to August 2025, the question of whether AI-driven targeting in Gaza was producing disproportionate civilian casualties had been argued as a contested empirical claim. Each side cited different data. The IDF cited its own published low-confidence civilian-to-militant ratios. International monitors cited mortality counts from Gaza’s Health Ministry, validated against satellite imagery and forensic burial data. Academic critics cited Lancet methodology. Defenders cited unverifiable counter-claims. The dispute had the structure of a dispute that could not be resolved because the two sides drew on different data sets.

In August 2025, +972 and The Guardian settled the dispute by publishing the IDF’s data.

Eighty-three percent.

By their own count. Against their own list.

The IDF’s argument, if it cared to make one, would now have to take the form of an objection to its own database. That objection has not been made.

There is no analogous receipt for any other AI-targeting system. Maven — the U.S. Department of Defense’s flagship target-recommendation platform, now a program of record with a one-point-three-billion-dollar ceiling — has no published operator-level disclosure. Atlantic Bastion, the U.K. equivalent, has none. The People’s Liberation Army’s parallel programs have none. Russian autonomous-drone targeting has none. Ukrainian Brave1 has none.

Lavender remains, as of this writing, the only AI-driven targeting system in the world for which a primary-source operator account has been published. It is the only one for which the targeted state’s own internal record has been cross-referenced against its own casualty count. It is the only one for which the question what did the system actually do? can be answered with documents the targeting state has not, on the public record, disputed.

There is one more receipt worth noting. In September 2025, one month after the Aman disclosure, Microsoft Corporation announced that it was terminating specific Azure cloud services that had been provided to Unit 8200, the Israeli signals-intelligence agency that operates Lavender. Microsoft’s stated reason for the withdrawal was the disclosure of the use of Microsoft services in operations the company had not been aware its services were enabling. The Associated Press, in a separate February 2025 investigation, documented that Israeli military use of OpenAI and Microsoft cloud products increased by approximately two hundred times between September 2023 and March 2024. The ramp coincided exactly with the IDF’s operational tempo during the most intense period of the Gaza bombing. The data was sourced to the cloud providers’ own usage logs, obtained by AP through a combination of confidential sources and analysis of provider-published statistics.

Two hundred times. The infrastructure ramp during the bombing.

Each of these receipts is in the public record. Each was published by the institution responsible: by +972 in collaboration with The Guardian, by the AP, by Microsoft itself. None of them was leaked, exfiltrated, or fabricated. The IDF disclosed its own database to its own intelligence officers, who then disclosed it to reporters. Microsoft disclosed its own service termination in a press release. The AP obtained its usage data from cloud provider records.

The institutions did not intend to confess. They published what they were structurally required to publish.

The confession is in the cross-reference.

The receipt closes the case about classification. It does not, by itself, settle the question of how many people are dead. That count has its own paper trail, and the paper trail is worth laying out because the standard objection to any figure from Gaza is that the figure comes from Hamas. The objection is not without force. The Gaza Ministry of Health is administered by the entity the IDF is at war with. Its tallies have, at various points, been revised. A serious account has to hold the count at arm’s length and ask what survives independent of the source that reports it.

So here are the numbers, side by side, attributed to whoever produced them.

Start with the number that cannot be waved away as enemy propaganda, because it comes from the IDF. In late 2025 the Israeli military acknowledged that it believed approximately seventy thousand Gazans had been killed in the war. That is the floor, conceded by the party doing the killing. The UN Office for the Coordination of Humanitarian Affairs, running its own count, puts the toll in the same range and rising: between October 7, 2023 and February 11, 2026, on the order of seventy thousand killed and roughly a hundred seventy thousand injured. The Gaza Health Ministry’s own tally sits just above the IDF’s acknowledgment, at around seventy-two thousand, a figure the IDF’s own number approaches rather than disputes. The Ministry is administered by the entity the IDF is at war with, and its count is the one the standard objection is aimed at; it is offered here only as attributed context, not as the load-bearing fact. The load-bearing facts are the IDF’s own acknowledgment and the UN’s independent count, and they agree on the scale.

And the independent estimates run higher than the Ministry’s, not lower. That is the problem with the objection. In January 2025, The Lancet published a capture-recapture analysis, a standard epidemiological technique for estimating an undercount by measuring the overlap between independent lists of the dead. The study cross-matched hospital records, an online survey, and social-media obituaries, and concluded that the true number of traumatic-injury deaths through June 30, 2024 was approximately sixty-four thousand, two hundred sixty, against roughly thirty-seven thousand, eight hundred seventy-seven then officially recorded for the same window. The official count, by this method, was undercounting by about forty-one percent. A population-representative household survey published in The Lancet Global Health in February 2026 reached the same conclusion by a different road: the official count, it estimated, fell short of the survey figure by about a third. Of the dead in OCHA’s October 2025 breakdown, thirty percent were children and sixteen percent were women.

The Office of the UN High Commissioner for Human Rights ran its own verification, requiring each death to be confirmed against three independent sources before it was counted. The OHCHR figure that survived that filter is the one that bears most directly on the targeting systems: of Palestinians killed in residential buildings or similar housing, seventy percent were women and children. That is not a count of the dead. It is a description of where the deaths happened and who was in the room. The room was a home, and the people in it were the family.

This is the number Where’s Daddy was built to produce. The doctrine was to authorize the strike at the moment of family-home entry. The OHCHR figure is what that doctrine looks like after the fact, counted by a body that demanded three sources for each name.

And on the gross figure there is no live dispute. The IDF’s own acknowledgment of roughly seventy thousand dead, the UN’s independent count, and the Lancet estimates all sit at or above the Ministry’s tally. What the IDF disputes is the ratio of civilians to combatants. It does not dispute the scale. The argument is not about how many are dead. It is about who they were, and on that question the IDF’s own internal database had already returned a verdict the IDF has not contested.

The causal claim, that the AI targeting stack as such produced this pattern, is contested. The IDF and the analysts who defend the systems argue that Lavender and Habsora and Where’s Daddy are decision-support tools, that the responsibility lies with the human operators and the command policy, and that a database is not a trigger. That is a coherent position. It is the position the Lieber Institute at West Point takes, and the position behind the Royal United Services Institute’s methodological pushback on the +972 reporting. A tool that recommends is not a tool that fires.

The narrower claim survives the steel-manning intact. Roughly forty-five percent of the munitions used in Gaza were unguided bombs, by CNN’s April 2024 reporting: ten to fifteen thousand dumb bombs dropped on one of the most densely populated places on earth. Seventy percent of those killed in housing were women and children, by OHCHR’s triple-sourced count. And the IDF’s own targeting database classified the overwhelming majority of the dead as people it had not marked as militants. You can dispute whether the AI pulled the trigger. You cannot, on this record, dispute that the human in the loop had about twenty seconds, that the bomb was usually unguided, and that the house was usually full.

The legal system is supposed to be the place where a receipt this clean becomes a consequence. It has not, so far, been that place, not because the law is silent but because the law is slow. Slowness is its own kind of answer.

The International Court of Justice has had the case since December 29, 2023, when South Africa filed an application alleging that Israel had violated its obligations under the Genocide Convention. The court has issued provisional measures three times — in January 2024, ordering Israel to prevent acts of genocide; in March 2024, ordering it to ensure food supplies; and in May 2024, in language widely understood to order a halt to the Rafah offensive. South Africa filed its memorial in October 2024. Israel, granted two extensions, filed its counter-memorial in March 2026. The judgment on the merits, the actual ruling on whether genocide occurred, is expected, by court-watchers, in late 2027 or early 2028. South Africa’s filings cite the +972 Lavender investigation by name. Whether the court engages substantively with AI targeting in its reasoning is one of the open questions of the next two years.

The International Criminal Court moved faster and bound less. On November 21, 2024, the ICC’s Pre-Trial Chamber I unanimously issued arrest warrants for Prime Minister Benjamin Netanyahu and former Defense Minister Yoav Gallant. The Chamber found reasonable grounds to believe both bore criminal responsibility, as co-perpetrators, for the war crime of starvation as a method of warfare and the crimes against humanity of murder, persecution, and other inhumane acts, over the period from at least October 8, 2023 to May 20, 2024. The warrants were challenged. In April 2025 the Appeals Chamber granted a partial reprieve on jurisdictional questions; in May 2025 the warrants were upheld and the investigation continued. The charges concern starvation and attacks on civilians. They do not name Lavender or Habsora or Where’s Daddy. The targeting systems are part of the factual matrix; they are not separately charged.

A warrant is a finding of reasonable grounds, not a conviction. An unenforced warrant where it counts is closer to a statement than a sanction. Netanyahu has continued to travel; the states that would have to make the arrest have, for the most part, declined. The warrant is real. Its teeth are notional.

The UN’s human-rights machinery has reached the harshest conclusions and carries the least binding force. In September 2025, the Independent International Commission of Inquiry on the Occupied Palestinian Territory concluded that Israel had committed four of the five acts specified in Article 2 of the Genocide Convention. The Special Rapporteur Francesca Albanese had reached a “reasonable grounds” finding on genocide as early as March 2024, in a report titled Anatomy of a Genocide, and in June 2025 named Elbit Systems, Lockheed Martin, Google, Microsoft, and Amazon as corporate participants in what she termed a “genocide economy” — companies that had supplied, in her language, “armaments, biometric surveillance systems, predictive analysis through artificial intelligence, and critical cloud services for military operations.” The Special Rapporteur on counter-terrorism, Ben Saul, put the AI question most directly: if the reports about Israel’s use of AI were true, he said, then many of its strikes “would constitute the war crimes of launching disproportionate attacks.”

These are the strongest words any official body has produced, and they are the words with the least power to compel. A Commission of Inquiry reports. A Special Rapporteur recommends. Neither arrests anyone.

The one forum that could rule on the systems themselves — an Israeli court, on the legality of Lavender or Habsora or Where’s Daddy — has not. Civil-society groups inside Israel, Adalah and the Association for Civil Rights in Israel among them, have filed petitions on adjacent questions: facial recognition, surveillance, the treatment of detainees. No Israeli court has ruled on the targeting stack as such, on the public record, through May 2026. The system that has been described from the inside more thoroughly than any other AI weapon in the world has never been adjudicated in the country that built it.

So the legal track, two years on, has produced provisional measures, two arrest warrants, a Commission of Inquiry finding, a Special Rapporteur’s conclusions, and not one judgment on the merits. The receipt is in the record. The verdict is not. The court that holds the document the IDF has not disputed will not rule on it until 2027 at the earliest.

While the law waited, the market moved, because the market does not wait.

The thing the Gaza war demonstrated was not a theory. It was a product line, tested at scale, in the only operational environment where AI targeting has a documented inside account. And the companies that make the product line are exporters. Israel’s Defense Export Control Agency reported total arms exports of fourteen and three-quarter billion dollars in 2024 — a fourth consecutive record year, more than half of it to Europe. In 2025, by Haaretz’s reporting, Israel granted air-defense export licenses to twenty countries, up from seven the year before.

The companies have names. Elbit Systems makes the Hermes 900 drone, used over Gaza since 2014, and supplies surveillance hardware to Frontex, the European Union’s border agency, for patrolling the Mediterranean. It presented an AI-based surveillance system at the DSEI arms fair in 2025. Israel Aerospace Industries leases its Heron surveillance drones to the same European border agency. The Gaza-tested eye, in other words, is now watching the boats off Lampedusa. NSO Group, maker of the Pegasus spyware, was found liable by a US court in December 2024 for attacks on roughly fourteen hundred WhatsApp users. It was ordered in May 2025 to pay damages later reduced, and enjoined in October 2025 from ever again targeting WhatsApp. It remains, as of this writing, on the US Commerce Department’s Entity List despite a sustained lobbying campaign to get off it. Rafael and IAI ran their operations on Amazon’s cloud, by The Intercept’s October 2025 reporting. Cellebrite’s phone-cracking tools, sold to Colombia and others, were used in the United Kingdom to process the devices of Palestine-solidarity activists.

The American technology firms are in the supply chain too. Their own filings and leaks place them there. Project Nimbus, the one-point-two-billion-dollar contract under which Google and Amazon supply cloud services to the Israeli government, survived Google’s February 2025 removal of its 2018 pledge against building AI for weapons or surveillance. It survived the firing of about fifty employees who staged sit-ins in April 2024. Files leaked to The Intercept contradicted Google’s public claim that the contract did not serve the Israeli military. Palantir signed its Strategic Partnership with the Israeli Ministry of Defense in Tel Aviv in January 2024. And Microsoft’s Azure servers in the Netherlands held roughly eleven thousand five hundred terabytes of intercepted Palestinian phone calls by July 2025. About two hundred million hours of audio. Microsoft was the company that, in September 2025, blinked.

The regulatory architecture that is supposed to govern this trade does not reach it. Israel is not a member of the Wassenaar Arrangement, the multilateral export-control regime. So Wassenaar cannot touch Israeli arms exports. The European Union’s dual-use export controls bind EU-headquartered companies; they do not constrain an Israeli firm selling to a European customer. The US Commerce Department’s Entity List caught NSO Group. It has held it there. It is the exception that measures the rule: one company, one spyware product, one listing, against a fourteen-billion-dollar export sector the control regimes were not built to see.

The product was tested in the one place it could be tested with a documented inside account. It works well enough that twenty countries wanted the air-defense version this year. And the controls that would slow its spread were written for a world of tanks and missiles. Not a world of Ontologies and surveillance LLMs that cross a border as a software license.

There is one thing in this record that points the other way.

In September 2025, Microsoft terminated a specific set of Azure services to Unit 8200, the Israeli signals-intelligence agency that operates Lavender. Microsoft’s president, Brad Smith, said the company had “ceased and disabled a set of services to a unit within the Israel Ministry of Defense” and stated that “we do not provide technology to facilitate mass surveillance of civilians.” It was the first publicly known case of a US technology company withdrawing services from the Israeli military since October 2023.

The withdrawal was partial. It addressed the specific Unit 8200 services that the surveillance reporting had exposed. It did not address the rest of Microsoft’s contracts with the Israeli Ministry of Defense, which the company confirmed continued. It was not retroactive. The eleven thousand terabytes of intercepted calls were already on the servers, and the model trained on them, if it was still training, did not need the cloud it had been built in. In scale, the gesture was a gesture.

In structure, it was the first time a major vendor had acted as though the downstream operational use of its product was the vendor’s problem and not only the customer’s. Every other firm in this chapter has held the opposite line. The product does not know what it is being used for. The customer signs for the use. The vendor sells the capability and disclaims the application. That is the doctrine that has governed the entire trade, from Foundry to Pegasus to Project Nimbus: the seller builds the tool; the buyer owns the consequence. Microsoft, for one set of services, for one unit, for one month, broke it.

The question is whether that break propagates.

There is reason to think it might. Inside the same companies, the pressure is no longer only external. A former Google employee filed a confidential federal whistleblower complaint in early 2026 alleging that Google had breached its own AI Principles by helping an Israeli military contractor analyze drone footage. Google DeepMind staff have unionized over the military contracts. The Air Force reservists who signed the April 2025 letter, some nine hundred seventy of them, included signatories from Unit 8200 itself. The people closest to the machine are, in small and scattered numbers, beginning to decline to operate it.

And there is reason to think it will not. The market is at a record. The contracts are growing, not shrinking. Maven became a program of record; Anduril consolidated the Army’s software under one roof; the air-defense licenses doubled. Microsoft’s withdrawal cost it one unit’s worth of one product, and changed the gross trajectory of the trade by nothing measurable. A doctrine does not exist because one company observed it once. A doctrine exists when the second company has to explain why it didn’t.

No second company has yet had to explain.

So the chapter closes where the record closes, which is on a question rather than a verdict. The receipt is real. The forty-seven thousand, six hundred fifty-three names are the IDF’s own. The document has not been disputed. The casualty counts, by every independent method, run at or above the count the objection was aimed at, and seventy percent of the dead in the homes were women and children. The court that holds the document will not rule until 2027. The warrants are unenforced. The export market is at a record high. And one vendor, for one month, acted as though the use of its product was its own responsibility — and then the question went quiet, the way questions do when there is no one left whose job it is to answer them.

Whether the September 2025 gesture becomes a doctrine, or stays a gesture, is not something the public record can yet tell us.

The book does not predict it. It writes down the number, and waits.