What Syria’s secret police saw as the regime crumbled

Elite troops sent to bolster Aleppo’s defenses had been forced to retreat as the regime’s army withdrew “in a crazy and spontaneous way." Soldiers fled “in a hysterical manner," leaving weapons and military vehicles behind, read the postmortem from a senior military-intelligence officer in the city dated Dec. 2.

By then, fighters for Hay’at Tahrir al-Sham, or HTS, already had a second city in their sights. As they gained ground in following days, reports rolled into the eight-story concrete headquarters of Branch 215, a feared part of Syrian dictator Bashar al-Assad’s vast security apparatus, in central Damascus. The reports detailed the speed and direction of rebel advances—and increasingly frantic plans and orders aimed at slowing their progress.

The trove of thousands of pages of top-secret intelligence documents—discovered in the building by reporters for The Wall Street Journal in December—chronicles the remarkably rapid unraveling of the despotic regime that had ruled Syria with an iron fist for decades.

As HTS sped across Syria, the government, in its public pronouncements, played down the extent of rebel advances and sought to project an air of confidence. Internal communications among the forces trying to protect the regime, however, were marked with escalating alarm.

In the end, the officers and men of Branch 215 abandoned their posts, too, leaving behind a pile of uniforms, weapons and ammunition along with empty whiskey bottles, stubbed-out cigarettes and reams of intelligence reports, some annotated in binders, others just heaped in stacks. When the Journal visited Branch 215’s offices, a mosaic of President Bashar al-Assad had his eyes and mouth gouged out.

“They kept operating until the last second," said Nanar Hawach, a senior analyst for Syria at the International Crisis Group. “They are the main pillar of the former Syrian regime."

The surprising success of HTS’s offensive, and the stunning collapse of the regime’s army, represented an epic intelligence failure in Syria and outside it. Until that moment, it was widely believed that Assad had prevailed after 13 years of civil war. Backed by Russia and Iran, Syrian government forces had retaken control over most of the country, with rebels largely confined to a pocket in the northwest.

That changed in November, when HTS leaders noticed that Iran, Hezbollah and others helping defend Assad were facing setbacks and Russia was increasingly preoccupied with its war in Ukraine. HTS launched a surprise attack, advancing quickly toward Aleppo.

As rebels approached the city on Nov. 28, a circular sent from a headquarters to all branches of the intelligence apparatus there raised combat readiness to 100%, suspending holidays until further notice. Two days later, the rebels were inside.

The dispatch documenting the army’s collapse begins by noting the arrival of an Ilyushin military transport plane from Damascus with 250 military-intelligence personnel, including members of Branch 215, armed with rocket-propelled grenades and heavy machine guns in a last-ditch effort to hold the city. Within hours of deploying on Nov. 29, they came under attack from drones.

Brig. Gen. Nicolas Moussa, the intelligence officer who wrote the report, said that repeated efforts to rally army units failed as soldiers fled, abandoning weapons and military vehicles. Lack of air support and artillery cover added to the panic, he wrote.

“The wounded lay on the ground with nobody to treat or evacuate them," the report said.

In unusually blunt language, the report called attention to rot within Assad’s military. A failure of military leadership had led to “slackness" in the ranks and security breaches, the report said. Critical information about troop positions was leaked during the attack, it said. “Officers and personnel have been distracted by material concerns and pleasures," the report said. Military personnel had resorted to “illegal methods" to repair equipment and secure their livelihood, citing a lack of resources and a dire economy.

The diagnosis echoed what analysts have observed for years. With the economy ravaged by war and sanctions, Assad had also furloughed some soldiers, cut rations for conscripts, and came to rely heavily on local militias and foreign fighters mobilized by Iran. Inflation had eroded the value of regular soldiers’ salaries, and corruption was rife.

The fall of Aleppo made clear that the rebel assault posed a serious challenge to Assad’s grip on power.

A report on Nov. 30 warned: “We have received information about contacts and coordination between terrorist groups in northern Syria and terrorist sleeper cells in the southern region and Damascus environs" and called for tighter surveillance and security measures.

Branch 215 was ordered to deploy armed rapid response units to the gates of the capital.

After taking Aleppo, the rebels launched an assault on the city of Hama, threatening the next in a spine of cities that had been at the center of Assad’s strategy for holding on to power even as he ceded control of other parts of the country.

As the rebels advanced, one intelligence report suggested the Syrian army launch a surprise assault on HTS’s rear, hitting their nearby home base of Idlib, taking advantage of its sparse defenses. The operation could sow chaos and ease pressure on Syrian forces around Hama, it said.

No such action appears to have been taken.

Reports cautioned that rebels would disguise themselves as regime forces by carrying portraits of Assad and raising the Syrian flag. Others warned the rebels were rigging ambulances with explosives. One on Dec. 4 warned that HTS’s elite Red Brigades would infiltrate Hama that night.

The rebels seized the city the following day. The victory was a tipping point, leaving just one major population center, Homs, between the rebels and the capital. Meanwhile, other rebel groups across the country joined the fight, with opposition groups from the south pushing north toward Damascus.

As the rebels pressed on, the intelligence services increasingly focused on security in the capital, dwelling even on what seemed like minutiae.

One intelligence branch reported that several individuals had recently moved from rebel-held territory in the northwest to a suburb of Damascus, warning they might be sleeper cells. HTS had instructed agents in rural Damascus to be ready to activate, according to another report.

In the city center, “unusual activity" was reported among bearded men wearing black leather jackets on the upscale Shaalan Street. Agents monitoring a public square flagged as suspicious a group of shoe shiners as well as an unfamiliar woman selling vegetables who wore heavy makeup under her veil and spoke with an accent indicating she was from eastern Syria.

“Request CCTV footage from commercial store owners to review any suspicious movement," recommended the memo.

Some in the regime tried to marshal forces to defend the capital. An order issued at midnight on Dec. 5 in the name of the president commanded an armored unit to return to Damascus from Deir Ezzour in the east.

Abdurrahman al-Shweinikh, a low-ranking officer in the unit who was two months into a stint of mandatory military service, said in an interview he realized the rebels wouldn’t be stopped. “I decided to flee," he said.

As the rebels closed in, informants provided a deluge of intelligence on their supposed whereabouts. One pinpointed a chicken farm where there were 20 “terrorists" and two tanks. Another source said a cave in rural Idlib was being used as a headquarters by HTS.

It isn’t clear if the information was accurate or whether it was acted upon.

Fear of foreign intervention ran high as the regime’s grip weakened. The intelligence services’ Palestine Branch, notorious among Syrians for its torture of detainees, warned that terrorists near Syria’s border with Israel intended to launch an attack “with the support of the Zionist enemy."

A source among U.S.-backed rebels based near the Jordanian border informed Syrian intelligence the U.S. had instructed them to advance on the eastern Daraa countryside and the historic city of Palmyra, according to a report sent on Dec. 5.

Turkish forces were escorting trucks loaded with equipment and heavy weapons across the border into the Syrian rebels’ base of Idlib, according to a source code-named BD2-01.

As the rebels advanced from the north, other armed opposition groups closed in from the south. A report sent to the operations room said small groups riding motorcycles had taken control of military checkpoints, seizing an infantry fighting vehicle and two vehicles mounted with heavy machine guns.

“The situation in Deraa province is disturbed," the report assessed on Dec. 6.

An intelligence officer posted in Deraa told the Journal that there was growing disorder as reports poured in about rebel gains. Even before the offensive, the regime’s control over the south was tenuous, he said. Military checkpoints and outposts were little more than a symbolic statement of the regime’s presence—and a source of income for personnel who could extract bribes to supplement their meager salaries.

Most of his colleagues were from the regime’s loyalist heartland along Syria’s coast and began to leave days before Damascus fell. “They were all thinking of their home—not here," said the officer, who stayed until the day before Assad escaped to Moscow.

On the ground, the army continued to crumble. “Everyone wanted to flee—even the officers," said First Warrant Officer Ahmad al-Rawashideh, whose unit operated a Russian-made jamming station on the front line near Homs. After six years of compulsory service, he said he had little interest in obeying orders to fight.

The 37-year-old soldier waited for sundown then shed his army uniform and rifle and joined a group of other soldiers who went to hide in a nearby village until the fighting was over.

Just days before Damascus fell on Dec. 8, there were orders to move troops and equipment to keep up the fight. The third tank division was to transport 400 automatic rifles, 800 magazines and 24,000 bullets to a battalion in the Tartus region on the coast, home to a key Russian naval base and a stronghold of the Assads’ Alawite sect. Reinforcements for the 14th Special Forces Division’s base west of Damascus were due to depart at midday on Dec. 7.

On the eve of the regime’s collapse, a report with a reference to its source covered up with whiteout addressed the rebels’ expected approach toward Damascus, predicting they would reach the suburbs in two days and capture Saydnaya prison, where political dissidents were jailed and tortured. The timing was wrong, but the latter prediction proved prescient. Rebel forces stormed into the prison and freed detainees hours after Assad fled the country.

The document ended with a signoff the intelligence officers used right through their very last messages, one that that showed their determination to keep the regime going:

“Review and do what is necessary."