When a Signal Becomes a Verdict: Jordan, Syria, and the Dangerous Seduction of Partial Intelligence

Dr. Shehab Al-Makahleh

The attack on St. George’s Greek Orthodox Church in Hammoud last October was an atrocity that demands justice, not shortcuts. Nine worshippers killed during a funeral. Dozens wounded. A community shattered. Jordan has every right—and every obligation—to pursue those responsible with the full weight of its security and judicial apparatus.

The Anatomy of an Overreach

The SIGINT narrative follows a familiar arc: a 14.4% increase in communications activity at 02:10 GMT, rising to 33.3% by 02:50. A post-attack collapse of 56% below baseline. A brief 45% spike, then an 80% surge from Karak lasting two minutes before vanishing.

These are measurements. What they are not—what they cannot be—is proof of operational coordination, authorization, or command responsibility.

Consider what the account actually establishes: that communications volume changed in a monitored area at particular times. That is the first and most basic level of inference. It does not establish who was communicating, what was said, whether the parties discussed an attack, or whether any authority ordered it.

Yet the account leaps from correlation to conclusion, treating a statistical anomaly as a definitive operational signature. A pre-attack surge could reflect a final coordination signal—or ordinary civilian activity, local security operations, or a technical artifact of measurement. A post-attack decline could indicate a destroyed cell—or a network shift, a technical interruption, or communications migrating to another platform. A brief spike from Karak could be a confirmation signal—or any of a dozen benign explanations.

The chronology itself remains unresolved. The attack occurred October 23, but the account does not clearly specify whether every timestamp refers to the same day. It does not explain the relationship between GMT and Jordanian local time. It does not describe how the baseline was established. These are not pedantic concerns. They are the difference between analysis and assertion.

The Four Levels of Inference

Intelligence professionals distinguish between detection, linkage, attribution, and responsibility. The first does not automatically establish the other three.

Detection: Communications activity changed at a particular time and place.

Technical linkage: Communications occurred between identified devices or network points.

Intelligence attribution: Evidence-based case that particular individuals or groups participated in planning or executing an attack.

Establishment of responsibility: Sufficient evidence to link individuals or entities to the attack under applicable investigative or legal standards.

The Daraa account operates almost entirely at the first level while claiming the fourth. Even if data demonstrate communications between Daraa and Karak, that alone does not prove the communications concerned the attack, that users belonged to a terrorist cell, or that any political or military authority directed the operation.

This is not a technicality. It is the difference between an intelligence indicator that can guide an investigation and evidence that can justify cross-border military action.

Daraa’s Geography Is Not a Guilt Sentence

Daraa occupies a sensitive position in Jordan’s security calculus. Southern Syria has experienced years of conflict, armed actors proliferating, territorial control shifting. Credible evidence that Syrian territory was used to plan attacks against Jordan would carry profound security and political implications.

But moving from Daraa’s geographical importance to assigning responsibility to the de facto authorities in Damascus requires independent evidence. Communications activity in a particular area does not prove that the authority controlling that area directed it, knew about it, or deliberately permitted it. Establishing that a local individual or network participated in an operation does not automatically make the government exercising authority over that territory responsible for every activity within its reach.

Three possibilities must be distinguished: an independent cell operating inside Syrian territory; a local network exploiting gaps in security control; or support and direction from an organized entity. Each requires different evidence. They cannot responsibly be treated as interchangeable conclusions.

The appropriate questions for Syria’s transitional authorities should focus on their responsibility to prevent territory from being used to attack neighboring states, investigate available evidence, cooperate with Jordanian security and judicial agencies, and clarify the extent of their effective control over border areas. These are questions that demand answers based on evidence, not assumptions based on geography.

The Legal Threshold That Cannot Be Skipped

Jordan has a duty to protect its citizens. The attack killed nine people during a funeral. The government has every right to investigate, to pursue suspects, to prevent further violence.

But even an urgent security imperative does not exempt cross-border military action from international law. The existence of intelligence data does not, by itself, settle the legality of using force inside another state’s territory.

The assessment depends on facts, evidence, and applicable legal circumstances: the legal basis invoked; whether requirements for self-defence, if relied upon, were met; the necessity and proportionality of force used; the distinction between military objectives and civilians; the precautions taken to avoid civilian harm.

Nor does tactical success settle the legal or strategic assessment. An airstrike may disrupt an armed network while also causing civilian casualties, creating diplomatic tensions, and undermining trust between neighboring states. A comprehensive evaluation must consider the threat targeted, the evidence connecting that threat to selected locations, the operation’s actual results, and the alternatives available.

The Larger Danger

The Hammoud Church attack raises fundamental questions about the ability of Jordan and Syria to prevent border regions from becoming operating spaces for transnational armed groups. It also highlights the growing role of technical intelligence in shaping security decisions—from communications monitoring to target identification.

But the strength of an intelligence assessment is not measured by the confidence of its language. It is measured by whether the underlying data can be examined, the analytical method explained, competing interpretations tested, and the limits of conclusions acknowledged.

If authenticated data establish coordination between individuals in Daraa and those who carried out the Karak attack, that evidence would be significant for the investigation and for determining responsibility. If the available information consists only of increases and decreases in communications volume, it remains a set of indicators requiring further corroboration—not conclusive proof of planning, authorization, or political responsibility.

The most important question for authorities in Amman and Damascus is not simply whether communications signals changed before and after the attack. It is whether those indicators can be converted into a credible, transparent investigation that protects civilians, establishes responsibility on the basis of evidence, and prevents further attacks—without allowing incomplete information to become the foundation for a new escalation in a region that can ill afford further instability.

The Standard That Must Be Met

In the aftermath of atrocity, the pressure for decisive action is immense. Communities demand justice. Governments face political pressure to demonstrate resolve. Intelligence agencies, operating under uncertainty, may be tempted to present partial findings as complete assessments.

But the cost of overreach is measured not only in legal challenges or diplomatic disputes. It is measured in the credibility of the institutions that claim to protect us. Every time intelligence is presented as more conclusive than it is, every time correlation is dressed as causation, every time a signal footprint is treated as a footprint of responsibility—the foundation of public trust erodes.

Jordan deserves better than that. Syria deserves better. The victims of Hammoud Church deserve an investigation that meets the highest evidentiary standards, not one that shortcuts them in the name of urgency.

The signal footprint may be real. But responsibility requires more than a spike in communications activity. It requires evidence that can withstand scrutiny, methods that can be examined, and conclusions that acknowledge their own limits.

That is the standard. Nothing less should be accepted.