SEPT 2016 Vol 2

Thr eat Tactics Report Thr eat Tactics Report

Compendium Compendium

BBookk oo HHaarraamm,, IIrraann,, aanndd SSyyrriiaa

Includes a sampling of Threat Action Reports and Red Diamond articles

TRADOC G-2 ACE Threats Integration

DISTRIBUTION RESTRICTION: Approved for public release; distribution is unlimited.

Threat Tactics Report Compendium, Vol 2

Introduction

TRADOC G-2 ACE Threats Integration (ACE-TI) is the source of the Threat Tactics Report (TTR) series of products. TTRs serve to explain to the Army training community how an actor fights. Elements that contribute to this understanding may include an actor’s doctrine, force structure, weapons and equipment, education, and warfighting functions. An explanation of an actor’s tactics and techniques is provided in detail along with recent examples of tactical actions, if they exist. An actor may be regular or irregular, and a TTR will have a discussion of what a particular actor’s capabilities mean to the US and its allies. An important element of any TTR is the comparison of the real-world tactics to threat doctrinal concepts and terminology. A TTR will also identify where the conditions specific to the actor are present in the Decisive Action Training Environment (DATE) and other training materials so that these conditions can easily be implemented across all training venues.

Volume 2: , , and

This compendium of Threat Tactics Reports, Volume 2, features the most current versions of three TTRs: Boko Haram (Version 1.0, published October 2015); Iran (Version 1.0, published June 2016); and Syria (Version 1.0, published February 2016). This volume also contains three recent Threat Action Reports (TARs): Al-Shabaab Janaale Attack (published December 2015); Battle for Sinjar, Iraq (published April 2016); and Pathankot, , Airbase Attack (published May 2016). In addition, several articles from the Red Diamond monthly newsletter, ranging from threat doctrine to threat equipment, are included in this volume. ACE-TI plans to publish two more TTRs later this year: Militant Groups Operating in Pakistan, and Hizballah. Each of these, once published, is eligible for update as appropriate so the product stays relevant.

Cover photos (clockwise from lower left): A destroyed tank lies in the street in Aleppo, Syria, Voice of America, 6 October 2012; Car : Maiduguri Market, Voice of America, 2 July 2014; Head officials of the government of Iran, Official website of Ali Khamenei, 29 December 2015; Sinjar Mountains, Phillip Melton, 8 November 2009. i UNCLASSIFIED

Threat Tactics Report Compendium, Vol 2

Contents

Threat Tactics Reports 1 Boko Haram, Version 1.0, October 2015 ...... 1 Iran, Version 1.0, June 2016 ...... 33 Syria, Version 1.0, February 2016 ...... 69

Threat Action Reports 101 Al-Shabaab Janaale Attack, December 2015 ...... 101 Battle for Sinjar, Iraq, April 2016 ...... 115 Pathankot, India, Airbase Attack, May 2016 ...... 127

Red Diamond Articles 153 INFOWAR: North Korean Capabilities, Part 2 of 2 (Jan 2015) ...... 157 Wadi al Deif and al Hamadiyah Military Base Attacks (Feb 2015) ...... 164 People’s Liberation Army: Challenges to US Warfighting Functions (Jun 2015) ...... 170 Fight for 2014 (Jul 2015) ...... 174 WEG: Chinese SLC-2 Artillery Locating Radar (Aug 2015) ...... 180 Threat Tactical Vignette: Recon and Raid (Sep 2015) ...... 184 Cartel Warfare: Analyzing Mexican Drug Trafficking Organizations (Oct 2015) ...... 195 Russian Tactics in Syria (Nov 2015) ...... 202 Mission Command Training Program: Warfighter Exercise (WFX) 16-2 (Feb 2016) ...... 207 DATE-Based Scenario Concepts for Training (Apr 2016) ...... 215 Hotel al Shabaab: Why and How the Group Targets Hotels (May 2016) ...... 223 JMRC DATE Rotation 16-04: Saber Junction 16-04 (May 2016) ...... 229 Antilanding Operations and Threats to Aircraft (Jun 2016) ...... 236 New Egyptian Plague: ISIL and the Sinai Province (Jun 2016) ...... 241 Threat 2025+: Hybrid Threat Blueprint Two (Jul 2016) ...... 250 Militia Battalions in the Ukrainian Conflict, Part 2: Pro- Units (Aug 2016) ...... 255

ii UNCLASSIFIED

THREAT TACTICS REPORT: BOKO HARAM

TRADOC G-2 ACE THREATS INTEGRATION

VERSION 1.0 OCTOBER 2015

Threat Tactics Report: Boko Haram

Executive Summary  Boko Haram is a relatively new organization, having begun serious military operations against the Nigerian government in 2009.  leads a confederation of sub organizations with commanders who mostly control their own day-to-day operations.  Shekau’s legitimacy comes from his position as deputy to the founder of Boko Haram, Mohammed Yusuf.  Boko Haram primarily conducts offensive raids, assaults, and ambushes against thinly-stretched and poorly-resourced Nigerian security elements and civilians in northeastern .  Influence from the Islamic State in Iraq and the Levant (ISIL), to whom Boko Haram recently swore allegiance, can be seen in an improved and increasing Boko Haram social media presence.  The Nigerian military counterinsurgency campaign begun in 2013 has reduced Boko Haram’s freedom of maneuver within Nigeria, causing it to setup safe havens in , , and Cameroon utilizing hundreds of unguarded border transit points.  Due to a campaign of violence against civilians and businesses, Boko Haram has lost both Nigerian civilian support and recruits, causing it to look to disaffected and poverty-ridden areas in border countries, particularly Cameroon.  Boko Haram’s violent attacks have alienated it from much of the Nigerian population.

This (U) Threat Tactics Report (TTR) was produced in accordance with (U) Intelligence Community Directive Number 203: Analytical Standards (Effective: Jan 2015). This TTR was coordinated with:

 National Ground Intelligence Center (NGIC)—Thomas Peters  HQDA DCS G-2—Tiffany Graham  Foreign Military Studies Office (FMSO)—Tom Wilhelm  Global Cultural Knowledge Network (GCKN)—Benjamin Okonofua  US Army Africa (USARAF)—Erica Hedrick Comments and feedback are welcome.

Jon S. Cleaves Director, TRADOC G-2 ACE Threats Integration

2 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Introduction

Nigeria’s economy is the largest in Africa, and is projected to be one of the ten fastest growing economies in the world in 2015, making the country a key to regional stability. Boko Haram,i a Nigerian home-grown paramilitary insurgency group, threatens both Nigerian and regional stability. Boko Haram’s attacks, both actual and threatened, caused Nigerian officials to postpone the 2015 presidential election by six weeks to allow a military offensive into northern Nigeria to secure safe voting areas. Boko Haram’s recruiting and attacks in and occupation of safe havens in border countries threaten these already volatile areas.1 The Threat Tactics Report (TTR): Boko Haram provides an overview of Boko Haram’s tactics, techniques, and capabilities. This report contains five sections. Section 1 is an introduction that provides an overview of Boko Haram. Section 2 is a discussion of Boko Haram’s tactics and techniques with specific graphical and narrative examples. Section 3 provides information on Boko Haram’s weapons and equipment. Section 4 details Boko Haram’s organization and military capabilities. Section 5 provides a conclusion and identifies where the characteristics specific to Boko Haram are present in the Decisive Action Training Environment (DATE) and other training materials so these conditions can be easily implemented in training.

Section 1: Introduction to Boko Haram

Nigeria is a country with abundant natural resources, but also a country with great internal turmoil and challenges. Endemic corruption has concentrated much of the national wealth in the hands of a few at the expense of the many. A definitive division between the predominately Muslim north and the predominately Christian south combined with hundreds of different ethnic groups make for religious and ethnic tension. A power-sharing agreement allowing for two presidential terms alternating between leaders from the Muslim North and the Christian South was disrupted when President Umaru Yar'Adua died in office in 2010 before completion of his term at which time his vice president, Goodluck Jonathan, assumed office.2 In the 2015 presidential election, Nigerians voted to elect a northern Muslim and former military dictator from the 1980s, Muhammadu Buhari.3 Buhari’s election was made possible in part by the deteriorating security situation due to the government’s slow response to Boko Haram as well as rising levels of poverty and corruption within the government. The electorate viewed Buhari, a former general, as a leader who could address one of Nigeria’s greatest internal threats, Boko Haram. Persistent ethnic, regional, and religious divisions; corruption; and poverty gave rise to Boko Haram, one of the most dangerous threats to the Nigerian government and regional stability. Jama’atu Ahlis Sunna Lidda’awati wal-Jihad (People Committed to the Propagation of the Prophet’s Teachings and Jihad)— more commonly known as Boko Haram in the local Hausa language from which it came—emerged in the 1990s from a loose-knit Islamist movement centered on its founder, Mohammed Yusuf. Yusuf was an

i Some sources are emerging indicating the name Boko Haram may be changing to the Islamic State West Africa Province in deference to its allegiance to the Islamic State. 3 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Islamic scholar who preached in Maiduguri, , Nigeria.4 Yusuf died while in police custody in July 2009 in a crackdown that also resulted in the death of hundreds of his followers. Boko Haram launched military operations in 2009 with the eventual goal of creating an Islamic State in Nigeria. This goal is aimed at returning to a pre-colonial Islamic state that was in place before British colonialists established Nigerian borders, a potentially less radical goal than might be imagined. After Yusuf’s death, the Nigerian government wrongly declared Boko Haram finished. Instead, the group rallied around his deputy, Abubakar Shekau, and steadily increased the intensity and violence of its attacks. Its first coordinated attacks occurred against the Federal Police headquarters in June 2011 and headquarters in Abuja in August 2011. These were planned by al-Qaeda- and al Shabaab- trained Cameroonian Mamman Nur. Nur led a Boko Haram offshoot called Ansaru, and was responsible for more than twenty suicide attacks in northwestern Nigeria throughout 2012 and 2013 while Shekau directed other attacks in northeastern Nigeria.5 In 2013, the United States declared Boko Haram a terrorist group.6 Boko Haram declared a caliphate in the areas under its control in 2014.7

Strategy and Goals

The primary goal of Boko Haram is to institute an Islamic state throughout Nigeria based on a fundamentalist interpretation of Islamic law with an inevitable regional expansion. The founder and spiritual leader of Boko Haram, Muhammed Yusuf, and his followers originally believed in a peaceful transition and made what the current Boko Haram leadership considered illegitimate concessions to and compromises with secular and government leaders. The group has since adopted a takfirist ideology— the belief that less than a strict adherence to Salafist Islam makes a Muslim an “apostate” equal to infidels and, therefore, a legitimate target. Boko Haram has targeted and killed a number of prominent Muslim leaders who have been critical of the organization. Boko Haram considers any support of Western or secular ideas, such as schools based on Western influence, heretical and worthy of attack.8 The movement is not without provocations which have contributed to the escalation of its use of violence in pursuit of its goals. Decades of resentment against corruption, poverty, and perceived inequality have given Boko Haram its trajectory toward becoming an ever more violent organization. The reintroduction of sharia criminal courts in northern Islamic states failed because of the general perception of unfairness by the population. Police brutality, extrajudicial killings by security forces, and disappearances of people taken into custody have bred general distrust, animosity, and resistance to the Nigerian government that has not fully investigated and prosecuted offenses. Despite being Africa’s largest economy with great natural resource wealth, it has one of the poorest populations with a large percent of people living on less than $1 a day. The disparity in distribution of that wealth is stark in its inequitable concentration with 72 percent of the North’s population living in poverty compared with 27 percent in the South and 35 percent in the Niger Delta.9 The population in the North is caught between two violent and contesting forces, Boko Haram and the Nigerian security forces. Key Alliances

Boko Haram has historically interacted with multiple groups outside of Nigeria. Evidence points to Boko Haram fighters supporting the Movement for Unity and Jihad in West Africa (MUJAO), al-Qaeda in the Islamic Maghreb (AQIM), and Ansar Dine in 2012 and 2013 in Mali. Boko Haram fighters have come from

4 UNCLASSIFIED

Threat Tactics Report: Boko Haram

the border states Niger, Chad, and Cameroon. As many as one-third of Boko Haram members fled Nigeria during the 2009 Nigerian government crackdown on Boko Haram. According to relatives of former Boko Haram leader and founder Muhammed Yusuf, in 2011 as much as 40% of its funding came from outside Nigeria. Boko Haram has used Niger, Chad, and Cameroon to hide, train, plan, recruit, and transit, historically focusing attacks on Nigeria to avoid crackdowns in countries where it has safe havens. Yusuf found refuge in Saudi Arabia in 2004 and there have been historic relationships with groups in that country. Boko Haram has also taken inspiration from the Taliban, with some of its fighters having trained in Afghanistan.10 In March 2015, Boko Haram leader Abubakar Shekau swore allegiance to al Baghdadi and ISIL. The move away from al-Qaeda to ISIL was an evolutionary process. Yusuf considered Osama bin Laden, the founder of al-Qaeda, to be one of the four Salafist purists all Muslims should follow.11 In 2002, bin Laden sent emissaries to hand out three million dollars in local currency to Salafist groups in Nigeria, one of whom was Boko Haram. That relationship was severed when Shekau threw his support to ISIL. An integral reason for Ansaru’s separation from Boko Haram was both ideological and tactical. Ansaru adhered to al-Qaeda’s rejection of the takfiri ideology of accusing other Muslims of apostasy and killing of Muslims. Ansaru separated itself geographically as well, focusing attention on northwestern and central Nigeria, while Boko Haram has focused on northeastern Nigeria. Ansaru maintained network relationships with the Salafist Group for Preaching and Combat (GSPC), which became AQIM, as well as other loosely aligned groups. Many within these groups became disaffected from al-Qaeda in favor of ISIL. Ansaru’s recent reintegration into Boko Haram brought these ISIL supporters with it, laying the foundation for ISIL’s acceptance of Boko Haram into its caliphate.12 Organizational Size and Structure

Boko Haram is believed to have between 4,000 and 6,000 fighters. Abubakar Shekau is the recognized leader of the group, but he leads a factionalized organization. Relations between Shekau and other leaders have fluctuated due to personal rivalries and ideological differences. The organization is a confederation with many of the day-to-day decisions made by local leaders.13 Current Locations

Boko Haram has been strongest in Nigeria’s three northeastern provinces of Borno, Yobe, and Adamawa, leading former Nigerian president Goodluck Jonathan to declare a state of emergency in those provinces in May 2013. Nigerian military operations have pushed Boko Haram into the Sambisa forest and the Lake Chad region, from which Boko Haram launches operations against a wide variety of targets, to include schools, religious and government leaders, other civilians, infrastructure, and security forces. While it released statements in 2013 and 2014 threatening to launch attacks in southern Nigeria, except for a few attacks it has not been able to follow through on the threats. It has found safe havens in the border countries of Niger, Chad, and Cameroon, even finding fertile recruiting pockets in disaffected and poverty-ridden areas of Cameroon.14

5 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Section 2: Boko Haram’s Tactics and Techniques Offense Boko Haram prefers the offense; however, it has only in a few instances been able to take and hold ground against Nigerian military formations. This overmatch drives Boko Haram to primarily conduct raids, assaults, and ambushes against mostly poorly-defended targets. Targets include civilians deemed collaborators or critics, security personnel, government and religious leaders, critical infrastructure, and banks and businesses for re-supply purposes. Attack objectives include punishing and intimidating civilians, breeding distrust of the Nigerian government within northern Nigerian populations, obtaining survival resources, and defeating the counterinsurgency. While Boko Haram has conducted operations in other parts of Nigeria such as Abuja and a suspected attack in Lagos, attacks have been primarily focused on northeast Nigeria, with safe havens and minimal attacks conducted in Nigeria’s neighbor countries: Niger, Chad, and Cameroon.15 The following are examples describing how Boko Haram conducts offensive operations in Nigeria. Raid TC 7-100.2, Opposing Force Tactics, states that hybrid threat raids are characterized by damaging and/or destroying key systems, facilities, and infrastructure; securing hostages and prisoners; and supporting information warfare (INFOWAR) plans.16 This description is indicative of Boko Haram’s raids, in which regular attacks on villages include burning and destroying houses and other village infrastructure and taking hostages. Boko Haram uses these attacks to support its INFOWAR campaign to intimidate local populations and encourage compliance with Boko Haram’s mandates. A notable example of a Boko Haram raid occurred in Chibok village, a primarily Christian village with a Muslim minority in Borno state.17 Located in the village is the Chibok Girls Secondary School. Schools are a common target for Boko Haram’s campaign against Western education and its particular opposition to girls attending school. The school had been closed since March 2014 because of threats from Boko Haram; however, it was briefly reopened in April 2014 for the girls to take the West Africa Examination Council exams. It was during this time that Boko Haram attacked the school. Boko Haram’s raid on the Chibok Girls Secondary School is well known because of the international media attention it received. As with many other similar raids, Boko Haram made no secret of its intentions to attack Chibok. The Nigerian military had intelligence well ahead of the attack. Local leaders unsuccessfully pleaded with regional authorities at least four hours before the attack to send reinforcements to the fifteen soldiers on duty in the town.19 Villages such as Chibok are vulnerable and targeted by Boko Haram because of limited support from Nigerian security forces who are stretched thin in a hostile region of Nigeria.20 The Chibok raid began on 14 April 2014 at about 2145 hours, while the female students were asleep in their dormitory.21 The Boko Haram support element began the raid by attacking the small security unit located on the school campus. The Nigerian security element was quickly overwhelmed, members being either killed or chased away. A Boko Haram typical follow-on technique manifested in Chibok was burning of buildings and infrastructure. The razing of buildings is intended to intimidate and communicate its authority to other villages. Boko Haram leader Shekau uses these attacks in YouTube videos to further his INFOWAR campaign.

6 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Figure 1: Raid on Chibok Girls Secondary School

While the support element fixed the Nigerian military, the assault element, wearing military uniforms, entered the dormitory where the students slept. This element moved the girls to waiting vehicles under the guise of helping them escape Boko Haram. Security elements, positioned to interdict Nigerian military reinforcements that did not appear, covered the exfiltration of the convoy filled with the girls. During the convoy movement, some of the girls escaped. One senior military source believed the girls were split up and placed in different Boko Haram camps in places like the Sambisa Forest, around Lake Chad, and in the Gorsi mountains.23 The raid’s effect was magnified when international social media campaigns called on the Nigerian military to act more aggressively to find the girls. Protests erupted within Nigeria and around the world demanding the return of the girls with a social media campaign branded with the slogan “#BringBackOurGirls.” The inability of the Nigerian military to find the girls quickly weakened its and the Nigerian government’s legitimacy and credibility. Boko Haram’s leader, Shekau, was emboldened and claimed responsibility in videos and other media and announced his intention to continue kidnapping girls whom he claimed should not be wasting their time in school.18

7 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Assault The assault is the basic form of hybrid threat tactical offensive combat as found in TC 7-100.2, Opposing Force Tactics.19 An assault is an attack that destroys an enemy force through firepower and the physical occupation and/or destruction of its position. Boko Haram utilizes the assault as a fundamental element of its attacks as illustrated by the January 2015 Boko Haram assault on Baga. 20

Figure 2. Assault on Baga

Baga has been targeted a number of times, in part because it is the location of the former headquarters of the Multinational Joint Task Force (MNJTF), located five kilometers to the southwest along the main road to Baga, until it was moved to N’Djamena, Chad in June 2015. Current counter-Boko Haram operations are either conducted in loose bilateral agreements, or conducted individually. However, an MNJTF including Nigeria, Niger, Chad, Benin, and Cameroon is currently organizing to combat Boko Haram and is anticipated to replace the current operational structures in place.21 Baga lies beside Lake Chad in northeastern Nigeria close to the Chad and Cameroon borders and has been the target of multiple Boko Haram attacks. It and Doron Baga, five kilometers to the northeast of Baga, are fishing communities with populations around 10,000 people each. Fighting between the militant group and security forces in April 2013 left dozens dead and hundreds of homes destroyed. At 8 UNCLASSIFIED

Threat Tactics Report: Boko Haram

least four dozen fishermen were killed in a suspected Boko Haram ambush in November 2014. The group also sent a threatening intimidation letter to the town in 2014.22 In January 2015, the area was vulnerable as both Niger and Chad had just pulled their forces out of Baga, leaving the MNJTF base manned only by the Nigerian military. During the pre-dawn hours of Saturday, 3 January, Boko Haram began its advance against Baga. Traveling in a convoy of trucks, motorcycles, and an armored personnel carrier (APC)—likely stolen from Nigerian security forces—hundreds of militants attacked the MNJTF base outside Baga. Using IEDs, RPGs, and small arms, Boko Haram fighters employed a security element with support elements attacking from multiple directions, fixing the Nigerian defenders, while the assault element captured the base. The besieged troops and the local Civilian Joint Task Force (CJTF)—local civilians organized and armed with the blessing of the Nigerian government for the purpose of protecting their towns from Boko Haram attacks—fought for hours, but were eventually forced to flee to Baga. Militants then set fire to parts of the base and raised their flag above it. Once Boko Haram secured the MNJTF base, fighters moved northeast toward Baga, killing those fleeing the base and civilians in their path. At about 0545 hours, the initial assault on Baga from the west was repelled by the CJTF, soldiers, and other men from the village, some fighting with machetes. Boko Haram fighters temporarily retreated into the bush, a momentary success for the citizens of Baga. A few hours later, Boko Haram attacked in approximately 20 vehicles with ten to fifteen armed men to a vehicle. Attacks from multiple directions quickly overwhelmed the outmanned and outgunned defenders of Baga.23 The attackers began killing people on sight, as well as looting and burning homes and businesses. Local residents, who fled in all directions, were purposefully targeted and killed. Multiple reports stated that Nigerian soldiers in the town stripped off their uniforms to avoid being targeted by the advancing militants. Residents that fled toward Lake Chad, to the east, attempted to cross the lake by boat. Some succeeded in crossing the lake to nearby Chad, while others drowned or were shot by the attackers. Having created chaos, fear, and mayhem in Baga, Boko Haram easily exploited the situation to continue the attack on Doron Baga and several surrounding villages, easily taking control of the area. With no defense, area residents and security forces hid in the bush or attempted to cross Lake Chad. Boko Haram fighters combed the bush seeking those hiding and many were drowned when their overloaded canoes tipped in Lake Chad. Beginning on the evening of Tuesday, 6 January, and continuing into the next day, the militant group began segregating the population. Fighters went house to house, rounding up any remaining residents they could find. They reportedly killed the men and kept the younger women, but allowed older women, the elderly, and small children to go free. Young men, in particular, were considered members of the CJTF and killed. The group also burned buildings that had survived the initial assault. Hundreds of people—and possibly as many as 2,000—were killed during the extended attack (the official Nigerian government casualty figure is only 150), with witnesses reporting bodies lying on the ground throughout the area. Thousands more have become either refugees in Chad or internally displaced persons (IDPs) in Maiduguri. Based on satellite imagery, Amnesty International estimates that around 3,700 buildings were destroyed in Baga and Doron Baga during the attack. At least 16 towns, villages, and settlements were attacked and destroyed during the five-day period.24

9 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Ambush Hybrid threat actors, like Boko Haram, use ambushes to control the time and place of an attack to destroy or capture personnel and supplies, harass and demoralize the enemy, delay or block movement of personnel and supplies, and canalize enemy movement by making certain routes useless for traffic. (TC 7-100.2, Opposing Force Tactics).25 With an increased Nigerian military counterinsurgency effort, Boko Haram has amplified its use of ambushes against a variety of targets.

Figure 3. Ambush against the Nigerian military near Chibok

Following the Chibok Girls Secondary School kidnappings, the Nigerian government felt increasing pressure to find the girls. The military conducted multiple patrols throughout Borno State. Soldiers sent to the north to face Boko Haram are often demoralized, feeling they are outgunned by the insurgents, 26 frequently not paid in full, and left without enough ammunition or food. Frequent Boko Haram ambushes have added to the psychological strain on Nigerian soldiers.27

On 13 May 2014, soldiers in the Chibok area were ordered to move at night based on what some believed was faulty and unverified information from locals.28 Soldiers pleaded with their commander to spend the night in one of the villages to avoid moving over dangerous roads in the dark. Overruled by their commander, the soldiers’ fears were realized when Boko Haram ambushed the convoy, killing between four and twelve soldiers. The ensuing fight left an unknown number of Boko Haram fighters

10 UNCLASSIFIED

Threat Tactics Report: Boko Haram

dead as well. The convoy was able to push through and arrived at the Maimalari Barracks in Maiduguri that night. Evidence of the cumulative psychological effect and success of ongoing ambushes against the Nigerian military can be found in what happened when the bodies of the soldiers killed in the ambush arrived at the Maimalari Barracks.29 The arrival of the bodies coincided with the visit of the 7th Division commander, Major General Ahmadu Mohammed, who had come to pay his respects to the dead soldiers. When soldiers saw the general’s vehicle, some fired on it. The general was uninjured, but his bodyguards received minor wounds.30 In late 2014, a military court convicted 18 soldiers in the incident; 12 were sentenced to death, five were discharged from the military, and one was sentenced to 28 days with hard labor. Major General Mohammed, the target of the mutiny, was immediately reassigned after the shooting.31 Defense Boko Haram’s strength and training are generally inferior to that of massed Nigerian security forces, although the group is collecting an arsenal of weapons that, in some instances, is greater than resource- deprived outposts. It has difficulties surviving direct confrontations with large Nigerian military forces. When attacked, Boko Haram fighters maintain a defensive position long enough to exfiltrate to safer locations. Boko Haram tends to withdraw into another area not likely included in the Nigerian military’s offensive, or to disperse until the offensive is over rather than attempt to attack the flanks or rear of the offensive.32 (See Training Circular 7-100.3, Irregular Opposing Forces) Tactical defensive actions will most likely use either a simple battle position or complex battle positions.33 (See Training Circular 7-100.2, Opposing Force Tactics) The following describes an example of a Boko Haram defense in a complex battle position. Complex Battle Position In May 2015, largely in response to political and public pressure to find and return the Chibok Girls School girls, the Nigerian military began an offensive into the Sambisa Forest. The Nigerian Defense Headquarters stated that on 16 May 2015, its military captured ten Boko Haram defensive positions in the Sambisa Forest using regular army units, special forces, and air assets for surveillance and attack. The attacks resulted in confiscation of vehicles mounted with anti-aircraft weapons and armored Figure 4. Example of a Boko Haram withdrawal video vehicles. Boko Haram

11 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Figure 5. Defense (Complex Battle Position) fighters were not able to carry away all of the many women and girls it had captured, so some were simply left behind with stories of mistreatment and brutality.34 Boko Haram had anticipated an eventual offensive against its positions within the Sambisa forest and prepared for the attack. The Nigerian army discovered an outer belt of mines before the attack began when one soldier was killed and another wounded. This and combat security outposts (CSOP) designated as disruption elements provided early warning of an impending attack. The main defense element was responsible for defeating the attack, covering a withdrawal, and protecting the support element that consisted of the command and control personnel. Once the attack began in earnest, it was apparent that Boko Haram would not be able to defeat the attackers. The main defense element covered the exfiltration, after which it withdrew. Some of the withdrawing Boko Haram fighters ran into ambushes along their exfiltration routes and were killed. The Nigerian air force provided surveillance of some of the fleeing Boko Haram fighters.35 Techniques Improvised Explosive Devices (IED) Boko Haram has shown an increasing capability and use of improvised explosive devices (IED) since its first vehicle-borne IED (VBIED) in June 2011. On 26 August 2011, Boko Haram attacked the UN headquarters in Abuja with a suicide vehicle-borne IED (SVBIED), killing 23 and injuring more than 76 people. Since then, targets of Boko Haram IED attacks expanded to include Christians, market centers, 12 UNCLASSIFIED

Threat Tactics Report: Boko Haram

bus stations, Nigerian security and police, the media, schools, politicians, and Muslims who were deemed collaborators or who spoke out against Boko Haram.36 One report suggests while IEDs are widespread across Nigeria, explosive materials and Boko Haram’s bomb-making skills remain unsophisticated. Boko Haram constructs IEDs from materials such as commercial-grade explosives purchased on the black market or stolen from mining companies. Explosives used in recent bomb attacks have been of the quality used for blasting rocks in mining operations. Boko Haram also uses fertilizer to create homemade explosives (HME).37 What Boko Haram lacks in sophistication, however, it has made up for in volume. Bombings in recent months continue to steadily increase, causing large numbers of casualties across Nigeria. Boko Haram controls much of northeast Nigeria, particularly the area between Borno State and northern Cameroon, where it has found success in launching attacks against Nigerian government officials, military personnel, and civilians. Boko Haram has conducted successful attacks elsewhere including the south. A coordinated attack, likely executed by a female SVBIED, on a fuel tanker at Apapa port in Lagos (southern Nigeria) by an affiliated Boko Haram faction on 25 June 2014, signaled the opening of a new threat. Nigerians in the south had felt relatively safe and distanced from Boko Haram’s reach despite three published statements by the current Boko Haram leader, Abubakar Shekau, threatening to attack targets in southern Nigeria. These attacks have been limited, but demonstrate Boko Haram’s potential to expand beyond its historical areas of operation.38 Of particular concern is the increasing number of suicide bombings, using both vehicles and explosives strapped to individuals. Between 27 and 30 July 2014, female suicide bombers conducted separate attacks against a university campus, petrol station, and shopping center in Kano state. Less than two months prior, the first known female suicide bombing occurred against a military barracks in Gombe. The use of females creates a new security concern and heightened anxiety about how to detect and prevent suicide attacks.39 The following is a sampling of recent IED attacks in Nigeria:40  14 February 2014: A car bomb at a market in Maduguri killed at least 19 people.  12 May 2014: A roadside bomb killed three soldiers travelling in a convoy in Gwaram Local Governance Area (LGA), Jigawa.  18 May 2014: A suicide bomber killed four civilians in the Sabon Gari area of Kano.  23 June 2014: A bomb at the School of Hygiene killed eight people in Kano city.  23 June 2014: A car bomb killed three soldiers at a checkpoint in Gwoza, Borno.  25 June 2014: Tewnty-two people died when a bomb exploded at the Banex plaza shopping center in Abuja.  23 July 2014: Two killed around 40 people close to a square where a prominent Islamic cleric was speaking to a crowd in Kaduna city. The cleric is a critic of Boko Haram.  27 July 2014: Five civilians and one soldier died when a bomb was thrown at people leaving church in Kano city, Kano.  31 July 2014: Two people died when a suicide bomber, alleged to be a child, detonated her explosives outside Kano State Polytechnic in Kano, Kano.  28 November 2014: Boko Haram attacked the Mosque of the Emir of Kano during weekly prayers with two suicide bombers and gunmen killing at least 120 people and wounding another 270 people.

13 UNCLASSIFIED

Threat Tactics Report: Boko Haram

 10 January 2015: A bomb at Monday Market killed at least 12 people in Maiduguri, Borno. The bomb may have been carried by a girl.  11 January 2015: Two female suicide bombers detonated twin bombs at the GSM market, close to Brima Primary school, killing eight people in Potiskum, Yobe.  1 February 2015: A suicide bomber killed himself and seven others outside a politician’s home in Potiskum, Yobe.  2 February 2015: A bomb exploded in a parking lot outside a stadium in the northeastern Gombe where Nigerian President Goodluck Jonathan was speaking at a re-election campaign.  22 February 2015: A bomb carried by a girl exploded and killed five at GSM Market in Potiskum, Yobe.  24 February 2015: A bomb attack killed 10 at a crowded bus station in Potiskum, Yobe.  26 February 2015: A suicide bomber killed 18 people at Tashar Gandu bus station in Biu, Borno. Kidnapping Boko Haram has increased its use of kidnapping, particularly women and children, for purposes as diverse as slavery and creating dissatisfaction with the Nigerian government. Boko Haram kidnappings began in 2011 and 2012 after the Nigerian government detained more than 100 wives and children of Boko Haram leaders, including members of Shekau’s family. In January 2012, Shekau stated in a 40-minute video Figure 6. Shekau takes credit for Chibok kidnapping video message his intention to kidnap the families of government officials, ostensibly in retaliation for the detention of Boko Haram family members.41 A year later, in May 2013, Shekau made good on his promise when he kidnapped a dozen government officials along with their families, taking credit for the kidnappings in a video.42 Boko Haram kidnapped twelve Christian women and children in a May 2013 raid on a battalion barracks in Bama town.43 Shekau released a video message after the kidnapping stating the hostages would become his slaves if the Nigerian government did not meet certain requirements, including the release of the Boko Haram family members detained by the government.44 Boko Haram takes the women and girls to temporary camps and then later to houses in towns and villages where it has safe houses for indoctrination.45 What may have started as an act of revenge has developed into a standard raiding technique. Shekau, in multiple video messages, declared that captured females will be married to Boko Haram fighters, forced to convert to Islam, and/or sold into slavery.46 During her three-month captivity, a girl from Gwoza in Borno State stated in an interview that the Boko Haram fighters forced her to cook and clean, convert to Islam, as well as lure government soldiers into ambushes.47 The kidnappings have generated fear

14 UNCLASSIFIED

Threat Tactics Report: Boko Haram

throughout the Nigerian population, causing many to leave their homes for safer areas and others to live in constant fear for their safety. Beyond the human tragedy, the kidnappings greatly reduce the trust of Nigerians in their government to protect them. While only one of many such kidnappings, the Chibok Girls Secondary School kidnapping received international attention, significantly amplifying Boko Haram’s message of government incompetence. While there are complex reasons for Goodluck Jonathan’s defeat in the 2015 presidential election, a slow recognition of and response to the Chibok kidnappings was at least a component in his not being re-elected. Protests against the government’s handling of the Boko Haram security threat continue to plague the government. In videos, Shekau cites the Chibok raid and other kidnappings to point to his successes and the government’s failure, further eroding the general public’s confidence in the Nigerian government.48 Exclusive of all of the other reasons for Boko Haram’s kidnappings, targeted kidnappings for ransom now serve as a readily available revenue stream. Boko Haram received $3 million in ransom payment for releasing seven members of a French family kidnapped over the border in Cameroon on 19 February 2013. Most kidnappings, however, are not so lucrative; kidnapping victims tend to be mid-level officials or their relatives, unable to afford personal security, but who can pay modest ransoms of about $10,000 for the return of the kidnap victim.49 Assassination Assassinations are deliberate actions to kill specific individuals with the intent to have a significant psychological impact on the relevant population. This technique intimidates and causes anxiety and fear and can coerce the passive support of a population.50 In 2009, Boko Haram began targeted assassinations against not only security personnel, but also against anyone deemed a threat, including local and regional government officials, Muslim clerics who speak negatively against it, and civilians suspected of collaborating with the Nigerian government.51 Boko Haram conducts the assassinations through a variety of methods including convoy ambushes, suicide bomber Figure 7. Boko Haram’s attack targets detonations, and attacks on places that a target might frequent such as their homes, markets, mosques, etc.

15 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Boko Haram has a particular sensitivity to criticism, manifested in its targeting of openly critical Muslim leaders. In March 2011, Imam Ibrahim Ahmed Abdullahi died outside his mosque in Maiduguri after gunmen jumped from a sport utility vehicle, opened fire, and then escaped into the city.52 On 13 July 2012, a suicide bomber detonated himself outside a Maiduguri mosque following Friday prayers in an attempt to assassinate the Shehu of Borno, the highest traditional leader in that state, killing five other people.53 In January 2013, Boko Haram attempted to assassinate Emir al Haji Ado Bayero of Kano, considered the second-most important Nigerian Muslim leader. He survived the attempt, but his bodyguards and driver died protecting him. On 1 February 2014, Boko Haram fighers killed Muslim cleric Sheik Adam, his wife, and son as he drove home from preaching at a mosque in Zaria, Kaduna State.54 Gunmen shot the emir of Gwoza, Alhaji Idrissa Timta, in his car in May 2014 while en route to a funeral. The emirs of Uba and Askira, traveling in the same convoy with Timta, escaped unharmed.55 Boko Haram also targets Christian ministers as evidenced by the killing of the pastor for the Redeemed Christian Church of God in Dille Village, Askira-Uba, Borno State in August 2014. Boko Haram fighters shot the minister in the head and chest as he fled his house during an attack on his village.56 Other targets include government officials and security personnel. On 28 January 2011, Boko Haram members assassinated both Madu Fannami Gubio, a candidate for governor, and the cousin of the Borno State governor.57 Boko Haram killed a federal legislator outside his home in October 2011.58 In September 2012, Boko Haram gunmen shot and killed the Borno State attorney general.59 While not assassinations in the strictest terms, Boko Haram targets security personnel in police stations, military barracks, convoys, and patrols.60 Deception Boko Haram employs deception primarily for purposes of infiltration prior to an attack. The technique allows Boko Haram fighters to position themselves inside a village prior to attacking. On 14 February 2014, Boko Haram fighters exploited the hope that the Nigerian military would answer repeated calls to send soldiers to protect the village of Izghe in Borno State village. Boko Haram militants showed up in Nigerian military uniforms, carrying weapons, driving pickup trucks, and initially saying they were there to protect them. Once inside the village, the Boko Haram fighters rounded up the villagers and killed at least 106 people.61 Boko Haram used a similar technique when they kidnapped the Chibok girls, discussed previously. The assault element, dressed as Nigerian soldiers, encouraged the girls to follow them by saying they were there to protect them from Boko Haram. The deception allowed the Boko Haram fighters to gain momentary trust and facilitated moving the girls to the vehicles for transport. False checkpoints set up by Boko Haram fighters in military uniforms is another variant of this technique. In September 2013, Boko Haram militants dressed in military uniforms set up a false checkpoint in the Benisheik area in Borno State, shooting Nigerians in their cars and as they attempted to flee on foot after voluntarily stopping for what they thought was an official checkpoint.62 Boko Haram also uses deception techniques other than military uniforms to precede an attack. On 31 August 2013, Boko Haram gunmen, dressed as traders, attacked a market in Gajiran, killing 15 people. On 6 April 2015, Boko Haram fighters dressed as Islamic religious leaders pretending to preach Islam in the rural village of Kwajafa in Borno State. After a crowd gathered to listen, the false preachers opened fire, killing 24 and wounding others. Boko Haram’s use of government military uniforms, religious garb, or local clothing allows Boko Haram militants to gain the trust of the local population and closer

16 UNCLASSIFIED

Threat Tactics Report: Boko Haram

proximity to those it intends to attack. Boko Haram members will also dress as women or preachers as a means of escape from Nigerian security forces.63 To this point, there are no open-source reports that Boko Haram is using captured vehicles as a means of deception. As the Nigerian military increases pressure and Boko Haram evolves over time, it is likely Boko Haram will follow the lead of other insurgent groups and use captured military vehicles to its tactical advantage. ISIL, for example, successfully uses captured military vehicles, packed with explosives, to get closer to its enemies before it detonates (most recently seen in Ramadi, Iraq).64 Coupled with captured military uniforms, Boko Haram could potentially deliver fighters and/or explosives to unsuspecting Nigerian military installations via captured military vehicles in the future.

Section 3: Boko Haram’s Weapons and Equipment

Weapons in the Boko Haram inventory are difficult to definitively determine. Boko Haram has been successful in capturing weapons and ammunition during attacks on military facilities. The group can be assumed to have any number of heavy weapons and equipment as well as small arms and ammunition included in the Nigerian military inventory. Boko Haram also has access to a robust arms-smuggling network and unregulated and unguarded cross-border transit routes. It has not been able to fully capitalize on weapons it now holds, however. The newly-formed relationship with ISIL will open up new opportunities for training on weapon systems and improved tactics in response to an intensified Nigerian military counterinsurgency. Improvement in the use of air defense weapons will be particularly challenging for the NAF’s current air superiority.

Boko Haram’s Weapons and Equipment Armored Equipment AT Weapons Anti-Air Systems65

T-55 Rocket Propelled Guns ZU-23-4 Anti-Aircraft Gun SA-7 MANPADS Panhard ERC-90

Section 4: Boko Haram’s Organization Recruitment and Retention Boko Haram lacks the sophistication of either ISIL or al-Qaeda. Its narrow focus on overturning the Nigerian government and opposing Western ideas in Nigeria is overshadowed by the regularity of violent attacks on civilian targets and forced recruitment. Teenage boys are increasingly targets since the Chibok Girls School kidnapping. Boys are sent to re-education camps, often in Cameroon, where they are indoctrinated or killed if they refuse to comply. 66 Women and girls are also increasingly being used in operations, including wives of slain and imprisoned fighters and beggars. In June 2014, six female suicide bombers, all under 16 years of age, were involved in attacks at universities, fueling stations, and military barracks. One 10-year-old girl was caught with a

17 UNCLASSIFIED

Threat Tactics Report: Boko Haram

suicide vest.67 Kidnapped women and girls are used as slaves, intelligence gathers, and to lure targets into a kill zone. Non-forced recruiting is being carried out mostly in Cameroon, not Nigeria, because of the violent attacks in northern Nigeria and the mass migration of men out of areas of Boko Haram violence. The region where Boko Haram operates in Cameroon is an area of endemic poverty with as much as 60% of the population living in terrible economic conditions, making them easy targets for recruitment. Police are also easily bribed and coopted by Boko Haram. In January 2015, a senior inspector of police in Balaza was arrested and accused of issuing Cameroonian ID cards to Boko Haram militants.68 Recruitment and retention will continue to be problematic for Boko Haram as it seeks replacements for its fighters. The group is not winning friends in northern Nigeria where Muslims and Christians alike fear its arbitrary violence. The loyalty of those forced into fighting will always be viewed with a degree of suspicion by Boko Haram. Increasing use of women, girls, and heavy recruitment of non-Nigerians to fight for a Nigerian insurgency point to Boko Haram’s potential limitations. Financing Boko Haram is a well-financed organization, but determining the specifics of that financing is difficult. After the 2001 bombing of the twin towers in the US, al-Qaeda began funding Boko Haram and other groups in the region. There is some evidence that Boko Haram historically received funding from al Shabaab and other al-Qaeda affiliates. Boko Haram has found new financiers in Borno and in Cameroon’s northern region. These funders are often ethnic Kanuris like Yusuf, Shekau, and a large majority of Boko Haram members. These benefactors provide weapons and become intermediaries in negotiating with the Cameroonian government for ransom payments.69 Boko Haram’s recent pivot from al-Qaeda to swearing allegiance to ISIL may have as much to do with practical financing concerns as a major shift in ideology.70 The most identifiable and possibly the most lucrative funding sources are Boko Haram’s criminal activities. Beginning in February 2013, Boko Haram began kidnapping as a means of increasing revenues, creating distrust of the government, and discouraging Western business interests in Nigeria. The April 2014 kidnapping of 270 school girls from the northern town of Chibok gained international attention, but is only one of many kidnappings happening regularly in Nigeria. Seven members of a French family kidnapped just over the border in Cameroon on 19 February 2013 were reportedly worth $3 million to Boko Haram. Most kidnappings, however, tend to be more modest.71 During attacks on villages, women and girls are often taken to be used as slaves or sold in human trafficking networks.72 Boko Haram benefits from Nigeria’s geographic positioning as a hub for drug trafficking. About a quarter to two-thirds of the cocaine transiting from South America to Europe passes through the West African countries of Cape Verde, Mali, Benin, Togo, Nigeria, Guinea-Bissau, and Ghana. Increasingly, Boko Haram is becoming a player in Nigerian drug smuggling.73 Potentially the most devastating of Boko Haram’s revenue-generating activities is pillaging and robbing villages. Boko Haram has targeted banks as a means of getting quick cash.74 Other means include taxes; extortion; stealing; and looting of villages, military facilities, and other civilian infrastructure during attacks. Attacks, while usually punitive, also have the added benefit of providing ongoing resources.

18 UNCLASSIFIED

Threat Tactics Report: Boko Haram

However, in an area that is already economically devastated by general poverty and mass migrations to safer locations, this is the least sustainable means of revenue for Boko Haram.75 Capitalizing on its geographic location along drug and arms smuggling routes as well as other criminal activities, Boko Haram has a sustainable way to continue its operations. The somewhat less sustainable, but well-established, pillaging, taxing, extorting, and kidnapping of members of local communities provides quick cash. Nigeria’s corrupt government infrastructure provides a framework where all of these operations can thrive. International Expansion Boko Haram has, primarily, focused on the goal of establishing a Sharia law-based government in Nigeria; however, current circumstances are shifting those goals. A counterinsurgency campaign begun in 2013 pushed Boko Haram into safe havens in Niger, Chad, and Cameroon. Poverty and dissatisfaction make areas within these other countries fertile recruiting grounds for Boko Haram fighters. This expansion of its reach beyond the borders of Nigeria will likely cause its vision to expand as well. As its ranks are filled with fighters from Niger, Cameroon, and Chad with a list of grievances against their governments, Boko Haram will have an easy transition to a regional jihad. Well-developed safe havens embedded in areas of discontent within these neighboring countries will provide ample places from which to launch attacks against governments and security forces. Boko Haram’s newly-established relationship with ISIL will encourage this expansion. Its regional positioning within ISIL’s vision of a world-wide caliphate, with its accompanying prestige and funding, will be hard for the Boko Haram leadership to resist.76 Evidence of Boko Haram’s recent regional expansion can be seen in an Amnesty International report which documents at least 380 civilians and dozens of security personnel killed by Boko Haram fighters in northern Cameroon since January 2015. Boko Haram is expanding techniques it has used in Nigeria such as suicide bomb attacks in civilian areas, summary executions, torture, hostage taking, abductions, child soldier recruitment, looting, and destruction of public, private, and religious property and infrastructure. Boko Haram operations have caused the displacement of at least 81,000 Cameroonians. In one attack against the village of Amchide, hundreds of fighters overwhelmed the community, killing both civilians and security forces. As in Nigeria, security force heavy-handedness against civilians in response to increased Boko Haram violence is causing discontent among civilian populations caught between. As Boko Haram continues to see success against regional security forces, finds safe havens in areas of discontent, and receives support from ISIL and other organizations, it will continue increase its disruptive and violent regional operations.77

Military Capabilities

Command and Control While nominally under the control of its emir, Abubakar Shekau, and a hierarchical bureaucracy, the realities on the ground point to a more disparate and fragile organization. Centralized control of Boko Haram has been weak from the beginning. In 2002 Shekau and Aminu Tashen-Ilimi briefly broke away from Boko Haram founder Yusuf. Upon Yusuf’s death, Shekau emerged as the leader of Boko Haram, but

19 UNCLASSIFIED

Threat Tactics Report: Boko Haram

without the full loyalty of other senior leaders. Shekau has some control of Borno State, where he declared a caliphate in 2014, but leaders in other regions have significant autonomy. There are at least six other subcommands that loosely align under Shekau. Some analysts believe that his ruthlessness stems from insecurities related to his weak hold on the insurgents and a desire to consolidate power under himself.78 Despite Boko Haram’s claims to religious and political authority, particularly in Borno State, nothing about it resembles a cohesive government. After Boko Haram founder Mohammed Yusuf died in police custody, the group splintered into at least five factions.79 Shekau works through intermediaries, with many of the day-to-day operational decisions made by semi-autonomous commanders. Shekau’s coalition is often held together by fear of violent reprisals.80 Shekau is a divisive leader; however, he retains legitimacy because of his early relationship with Yusuf. Most of those surrounding him are loyal, as most of his opposition has either defected or been killed.81 Maneuver Boko Haram relies on moving fast against weaker opponents. It attacks using raids, ambushes, and assaults and then moves into areas of safety in mountainous terrain within Nigeria, blends in with the population, or occupies safe havens in border countries. Its knowledge of the terrain and the population allows it to use the hybrid threat principles of initiative, deception, surprise, protection, mobility, adaptability, concentration, and perseverance.82 Fighters operate commercial trucks and captured armored personnel carriers to maneuver to and in attacks.

INFOWAR Boko Haram’s social media capacity and capabilities have not yet risen to the level of sophistication of ISIL or al-Qaeda; however, there is ample evidence that the group is learning and improving. Adapting from hand- carrying videos to journalists within Nigeria via couriers, Boko Haram now uploads videos directly to YouTube. Early versions of these videos consist of Shekau speaking, often in Figure 8. Shekau mocks the #BringBackOurGirls video rants, for extended periods of time in his native Hausa language. Newer videos include subtitles in both Arabic and English. This may be an attempt to capitalize on the social media exposure Boko Haram received during the international social media campaign advocating the return of the Chibok Girls School kidnapping victims. 83 In January 2015, an Arabic-language feed claiming to be from the official outlet for a new Boko Haram media group, Al-Urwah al-Wuthqa, was launched, a sign that the group is continuing to adopt

20 UNCLASSIFIED

Threat Tactics Report: Boko Haram

best practices from ISIL and al-Qaeda and is looking to capture the attention of a larger audience.84 Twitter shut down the account after only 19 tweets. The account posted messages in English, Arabic, and Hausa and included videos hosted on Sendvid and images hosted on Justpaste.it. The account was used to send images of its attack on Gombe town. Its last tweet claimed victory in Baga in Borno State.85 Despite Twitter’s attempts to regulate illegal or terrorist content, Boko Haram will likely open a new account under a different name and continue to improve its ability to communicate to a larger audience. There is limited evidence that ISIL may be at least indirectly influencing Boko Haram’s social media improvements. The Boko Haram Twitter feed was promoted by a pro-ISIL operative known on Twitter as Abu-Malik Shaybah al-Hamad, who has claimed to be in contact with the Boko Haram leadership.86 The jihadist site Afriqiyah Media, an ISIL adherent, has tweeted Boko Haram’s messages. The video released after the Baga, Borno State attack in early 2015 showed improved high-definition quality with advanced graphics, audio effects, gratuitous violence, scripted choreography, and lens angles suggestive of ISIL productions.87 Boko Haram has also included excerpts from ISIL videos in its videos.88 With its inclusion within the ISIL caliphate fold, Boko Haram will continue to evolve its social media sophistication. RISTA Boko Haram uses the physical environment and natural conditions to neutralize or offset the technological advantage of counterinsurgent forces. It operates in adverse weather, limited visibility, rugged terrain, and urban environments that shield it from the effects of technological overmatch. Boko Haram fighters can blend in with local populations and it uses cultural standoff to protect its simple and complex battle positions.89 The most effective RISTA tools for Boko Haram are not sophisticated. Knowledge of the local population and key leaders, intimidation, fear, and local alliances are ways in which Boko Haram is able to conduct reconnaissance, gather intelligence, conduct surveillance, and acquire targets. Cell and satellite phones, Internet, and couriers are low technology tools available to Boko Haram. Fire Support Fire Support is not currently a Boko Haram capability, however, with an ever-growing arsenal of weapons and pressure from a multi-national counterinsurgency campaign it will likely develop this capability in the future. Protection Boko Haram safe havens are regionally-based due to the group’s primary focus on transforming the Nigerian government. Despite an increased military presence in northeastern Nigeria beginning with an intense counterinsurgency campaign in 2013, Boko Haram enjoys a degree of maneuverability that continues to frustrate efforts to completely eradicate it. Since the Nigerian military went on the offensive, Boko Haram has been pushed into the Sambisa Forest, a former colonial game reserve covering approximately 60,000 square kilometers, from which it launches attacks and into which it withdraws.90 Until recently, the forest had not been penetrated by Nigerian military forces. Additional areas where Boko Haram has hideouts are the Gwoza Hills and Mandara Mountains.91 Boko Haram uses Niger, Chad, and Cameroon for refuge, training, transit, attack planning, and recruiting, but has not conducted significant attacks within those countries. Border countries are not

21 UNCLASSIFIED

Threat Tactics Report: Boko Haram

actively hosting Boko Haram fighters, but are de facto safe havens due to poor border policies and enforcement. This has allowed an uneasy and fragile equilibrium between Boko Haram and its neighbors.92 Niger’s Diffa regional capital of Diffa, just across the border from Nigeria's Borno State, is a center of activity. The cross-border movement is aided by common languages, ethnicities, and familial ties. Nearly 60,000 people have fled northeast Nigeria for other countries, most moving into Niger, offering opportunities for Boko Haram infiltration and movement. Cameroon has also been a launching point to attack Nigerian border towns. Nigerian officials closed part of the border with Cameroon to try and mitigate attacks. Lacking resources to adequately root out Boko Haram from their countries, Niger, Cameroon, and Chad will continue to serve as easily-accessed and unwilling safe havens for the group.93 While Boko Haram has relationships with other countries, it has not used safe havens extensively in countries beyond those with whom it shares a border. Mohammed Yusuf found refuge in Saudi Arabia in 2004 and there have been historical relationships with groups in that country. As many as one-third of Boko Haram members fled Nigeria in 2009 for Somalia and other areas, where they received training by al-Qaeda, al Shabaab, and other groups.94 Boko Haram has also taken inspiration from the Taliban; some of its fighters having trained in Afghanistan.95 If Boko Haram chooses to conduct significant and ongoing attacks within Niger, Chad, and Cameroon, disrupting its current relative security, safe havens farther afield would likely be considered and developed. Logistics Boko Haram is an organization made up of semi-autonomous cells. Due to this organizational reality, much of the day-to-day supply needs are satisfied through attacks on civilian businesses and government and military facilities. On 4 November 2015, Boko Haram fighters robbed a bank, blew up a police station, burned a political party office in Nafada, Gombe State, and stole dynamite and pickup trucks from a cement factory 20 kilometers away in Ashaka. After this attack, Boko Haram fighters did not attempt to hold the towns and no one was hurt during the attacks; fighters simply departed with the stolen materials. Boko Haram has also attacked military facilities where it has taken vehicles, including armored personnel carriers, as well as weapons and ammunition. Boko Haram is able to strike when and where it desires, taking advantage of a Nigerian military stretched thin and poorly provisioned.96 The porous border between Nigeria and adjoining countries provides easy regional access for moving resources in and out of Nigeria. The country has over 1,499 illegal and 84 legal points of entry from its neighbors.97 These transit routes are mostly unguarded and unregulated and are often only simple footpaths crisscrossing the borders.98 Means of moving arms, weapons, drugs, etc. into Nigeria include cows, camels, and donkeys sometimes carrying specially-made smuggling bags. Other ways of getting resources across the border include empty fuel tankers, vehicle engines, and grain bags. Boko Haram is also aided by a corrupt customs system that is sometimes complicit in the smuggling.99 Boko Haram also uses tunneling as a means of moving resources and hiding. In July 2013, security forces discovered an extensive network of tunnels connecting bunkers and houses in Bulabulin, Borno State, some of which could accommodate up to 100 people.100 In April 2015, Nigerian security forces retook a village in Damboa, Borno State, where Boko Haram fighters had constructed a tunnel that could hold up to 3,000 fighters and 200 vehicles.101

22 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Boko Haram’s well-developed logistics system allows its fighters to live off the land as robbing marauders, in many cases. A corrupt customs infrastructure adds options to the hundreds of illegal transit points. While Nigerian security forces will continue to root out tunnels and other logistics infrastructure, Boko Haram will have more options than the Nigerian government has resources. Air Defense A definitive advantage for the Nigerian military is its ability to conduct air strikes against Boko Haram. This advantage may be limited in the future as Boko Haram is not only acquiring air defense weapons, but will learn how to use them. Nigerian aircraft have not been shot down by Boko Haram fire yet. The Nigerian air force Hind and Alpha jets have been hit by up to 30-mm caliber weapons, requiring pilots to fly higher and aircraft to be fitted with longer-range rockets.102 Currently, Boko Haram anti-aircraft weapons are mounted on the backs of flat-bed trucks and used for ground attacks on villages and military facilities.103 In the medium- to long-term, Boko Haram will likely advance its air defense capabilities; increasing the threat to Nigerian air operations. UAVs Use of UAVs is not a current Boko Haram capability, but one easily acquired.

Conclusion

Abubakar Shekau is the inspiration and driving force behind a confederation of faithful adherents to a violent movement intent on replacing the secular Nigerian government with an Islamic fundamentalist government. Most of the day-to-day operational and tactical decisions are made by local commanders. A decentralized command structure gives flexibility for local commanders to attack where Nigerian security forces are weakest. Boko Haram’s control of the time and place of attacks is unsettling and demoralizing for Nigerian security forces and is evidence to northern Nigerians, in particular, that the government and military are incapable of protecting them. Boko Haram’s use of raids, assaults, and ambushes plays to its strengths, allowing it to control the time and place of attacks. Since the Nigerian counterinsurgency began in 2013, Boko Haram has not had unfettered control of its traditional areas of operation. In response, it launches attacks from and retreats into areas within the Nigerian borders, such as the Sambisa Forest, and safe havens in the bordering countries of Niger, Chad, and Cameroon where it has also found willing recruits. Despite capturing Nigerian military weapons and equipment, Boko Haram has not fully capitalized on them. As the Nigerian military intensifies its counterinsurgency operations, Boko Haram will respond by improving its training, tactics, and techniques. This will be particularly true of its anti-aircraft and anti- armor capabilities. Additionally, using smuggling networks and multiple transiting points into and out of Nigeria, Boko Haram will be able to resupply itself with weapons, ammunition, and equipment from other areas in Africa.

23 UNCLASSIFIED

Threat Tactics Report: Boko Haram

REAL-WORLD CONDITIONS APPLIED TO TRAINING Conditions in DATE and Doctrine The TC 7-100 Hybrid Threat series and the Decisive Action Training Environment (DATE) provide training resources for applying real-world conditions to training. Boko Haram tactics and techniques are readily accessible through these resources as referenced throughout this report. Boko Haram uses the principles of offense and defense at the detachment, battalion, and below level present in the TC 7-100 Hybrid Threat series when employing its fighters. The operational environment outlined in the DATE also provides a Boko Haram-inclusive framework. Replication in Training The DATE contains a number of insurgent groups that can be used to replicate particular elements of Boko Haram. The Provisional Army of Lezgin (PAL), for example, is an insurgent group operating in Southern Erdabil and western Sirvaki provinces in Atropia. PAL targets include Atropian government facilities and leaders. A reference chart with insurgent, criminal, religious, and guerrilla threat actors and their operational environments, activities, and targets is included in the DATE beginning on page 1-I-17. Tactics graphically depicted in this report can be found in TC 7-100.2 Opposing Force Tactics and in TC 7- 100.3 Irregular Opposing Forces. For more information on how to replicate these actions, refer to these TCs. For information on how to build a force structure to conduct these actions, refer to TC 7-100.4 Hybrid Threat Force Structure Organization Guide (Chapter 3, Section VIII “Building an OPFOR Order of Battle”). The table below contains excerpts from TC 7-100.2 that define the tactical actions discussed in this report.

TC 7-100.2 Tactics

3-105. OPFOR commanders of detachments, battalions, and below select the offensive action best suited to accomplishing their mission. Units at this level typically are called upon to execute one combat mission at a time. Therefore, it would be rare for such a unit to employ more than one type of offensive action simultaneously. At the tactical level, all OPFOR units, organizations, elements, and even plans are dynamic and adapt very quickly to the situation.

3-174. A raid is an attack against a stationary target for the purposes of its capture or destruction that culminates in the withdrawal of the raiding force to safe territory. Raids can also Raid be used to secure information and to confuse or deceive the

enemy. The keys to the successful accomplishment of any raid are surprise, firepower, and violence. The raid ends with a planned withdrawal upon completion of the assigned mission. 3-106. An assault is an attack that destroys an enemy force through firepower and the physical occupation and/or Assault destruction of his position. An assault is the basic form of OPFOR tactical offensive combat.

24 UNCLASSIFIED

Threat Tactics Report: Boko Haram

3-133. An ambush is a surprise attack from a concealed position, used against moving or temporarily halted targets. Such targets could include truck convoys, railway trains, boats, individual vehicles, or dismounted troops. In an ambush, enemy action determines the time, and the OPFOR sets the place. Ambush Ambushes may be conducted to—  Destroy or capture personnel and supplies.  Harass and demoralize the enemy.  Delay or block movement of personnel and supplies.  Canalize enemy movement by making certain routes useless for traffic. 4-105. OPFOR detachments, battalions, and companies generally participate as part of a maneuver or area defense organized by a higher command, as opposed to conducting one independently. Commanders of OPFOR detachments, battalions, or companies select the defensive action they deem to be best suited to accomplishing their mission. OPFOR detachments and below are typically called upon to execute one combat mission at a time. Therefore, it would be rare for such a unit to employ more than one of these methods simultaneously. As part of either an area defense or maneuver defense, such units often conduct tactical defensive actions employing simple battle positions (SBPs). Alternatively, as part of an area defense, they may employ complex battle positions (CBPs). 4-108. A complex battle position (CBP) is a defensive location designed to employ a combination of complex terrain, C3D, and engineer effort to protect the unit(s) within them from detection and attack while denying their seizure and occupation by the enemy. CBPs typically have the following characteristics that distinguish them from SBPs:  Limited avenues of approach. (CBPs are not necessarily tied to an avenue of approach.) Defense  Any existing avenues of approach are easily (Complex Battle Position) observable by the defender.  360-degree fire coverage and protection from attack. (This may be due to the nature of surrounding terrain or engineer activity such as tunneling.)  Engineer effort prioritizing C3D measures; limited countermobility effort that might reveal the CBP location.  Large logistics caches.  Sanctuary from which to launch local attacks.

Additional considerations for replicating Boko Haram in training environments involve using its capabilities in three key areas. These areas are logistics, INFOWAR, and RISTA. These areas provide Boko Haram with advantages that allow it to stay in the fight and challenge US overmatch. The chart below details how training centers could replicate a capability comparable to Boko Haram’s.

25 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Capability (What) Actor/Order of Battle (Who) Tactic (How)

Insurgent groups in the DATE can be TC 7-100.3 Irregular Opposing Forces constructed to be self-sustaining with Chapter 2 populace and regional safe-haven support TC 7-100.2 Opposing Force Tactics Chapter Logistics and commandeered materiel. 14 To replicate Boko Haram: Highlight self- sustaining means of logistics.

The DATE insurgent groups can be used to TC 7-100.3 Irregular Opposing Forces train elements of INFOWAR such as Chapter 2, Appendix A deception, perception management, and TC 7-100.2 Opposing Force Tactics Chapter 7 physical destruction. FM 7-100.1 Opposing Force Operations INFOWAR Chapter 5 To replicate Boko Haram: Highlight low-tech INFOWAR techniques that attack critical C2, blur the battlefield picture, and affect local populations.

RISTA concepts can be integrated into TC 7-100.3 Irregular Opposing Forces, training by constituting DATE insurgent Chapter 2 groups with population-centric TC 7-100.2 Opposing Force Tactics Chapter 8 capabilities. RISTA FM 7-100.1 Opposing Force Operations Chapter 6 To replicate Boko Haram: Focus on the insurgent’s advantage in using and exploiting the local population.

Related Products

 Decisive Action Training Environment (DATE) 2.2  TC 7-100 Series  Threat Report: Nigerian UN Building Bombing (September 2011)  Red Diamond: Nigerian UN Building Bombing (September 2011)  Threat Report: Boko Haram (March 2012)  Red Diamond: Boko Haram (March 2012)  Threat Report: Kidnapping in Katsina (February 2013)  Red Diamond: Boko Haram Techniques (November 2014)  Red Diamond: Boko Haram Baga Attack (February 2015) See also the Red Diamond Newsletter, which contains current articles on a variety of topics useful to both soldiers and civilians ranging from enemy TTP to the nature and analysis of various threat actors.

26 UNCLASSIFIED

Threat Tactics Report: Boko Haram

For detailed information on weapons and equipment, see the Worldwide Equipment Guide. To see more products from TRADOC G-2 ACE Threats Integration, visit the Army Training Network (ATN) with CAC access: https://atn.army.mil/dsp_template.aspx?dpID=377

POCs

Author Rick Burns (BMA Ctr) 913-684-7987 (COMM) 552-7907 (DSN)

TRADOC G-2 ACE Threats Integration (ACE-TI) 803 Harrison Drive, BLDG 467 Fort Leavenworth, KS 66027

Jon Cleaves, ACE-TI Director Jennifer Dunn, ACE-TI Deputy Director Jon Moilanen, ACE-TI Operations Angela Wilkins, ACE-TI Product Integration

Note: Not all references listed in this publication are readily available to the public; some require a government common access card (CAC) to view.

References

BBC News Africa. “Boko Haram Militants ‘Seize Nigerian Town of Chibok.” 14 November 2014. BBC News. “Boko Haram Crisis: Nigeria Begins Sambisa Ground Offensive.” 22 April 2015. BBC News. “Nigeria Abductions: Timeline of Events.” 12 May 2014. Hains, Rebecca. “Boko Haram: Three Ways to Fight Human Trafficking.” The Christian Science Monitor. 6 May 2014. IRIN. “Arms smuggling to Boko Haram threatens Cameroon.” 21 February 2014. Kalu, Uduma. “How Nur, Shekau Run Boko Haram.” Vanguard, 3 September 2011. Kerry, John. “Recent Attacks by Boko Haram.” US State Department, 23 February 2014. Marama, Ndahi. “Inside Boko Haram’s Hideout: The Story of Sambisa Forest.” Vanguard. 27 April 2014. Onuoha, Freedom. “Porous Borders and Boko Haram’s Arms Smuggling Operations in Nigeria.” Aljazeera Center for Studies. 8 September 2013. Power, Samantha, “Statement by Ambassador Samantha Power, U.S. Permanent Representative to the United Nations, on Security Council Action to Sanction Boko Haram.” United States Mission to the United Nations. 22 May 2014. US State Department. “Terrorist Designations of Boko Haram Commander Abubakar Shekau, Khalid al-Barnawi and Abubakar Adam Kambar.” 21 June 2012. Winsor, Morgan. “Boko Haram Rescue: Pregnant Women, Girls Among Those in Sambisa Forest by Nigerian Army.” International Business Times. 4 May 2015.

27 UNCLASSIFIED

Threat Tactics Report: Boko Haram

Zenn, Jacob. “Boko Haram’s Emerging Caliphate in Nigeria: Will Maiduguri Fall?.” The Jamestown Foundation. 26 September 2014.

Figure Credits

Figure 1. Raid Diagram, ACE Threats-Integration, 2015. Figure 2. Assault Diagram, ACE Threats-Integration, 2015. Figure 3. Ambush Diagram, ACE Threats-Integration, 2015. Figure 4. Defense Complex Battle Position Diagram, 2015. Figure 5. Example of a Boko Haram withdrawal video, YouTube, 3 May 2015. Figure 6. Shekau takes credit for Chibok kidnapping, YouTube, 5 May 2014. Figure 7. Boko Haram Recent Attacks, START: National Consortium for the Study of Terrorism and Responses to Terrorism, Department of Homeland Defense, May 2014. Figure 8. Shekau mocks the #BringBackOurGirls video, YouTube, 13 July 2014.

Endnotes

1 Calestous Juma, “Why Nigeria Matters to the World,” Belfer Center for Science and International Affairs: Harvard Kennedy School, 27 February 2015; Alexis Okeowo, “An Election Postponed in Nigeria,” The New Yorker, 9 February 2015. 2 Scott Stearns, “Nigerian president Deat at 58,” Voice of America, 4 May 2010. 3 Charlotte Alfred, “Who Is Nigeria’s Next President Muhammadu Buhari?,” The World Post, 31 March 2015. 4 Jane’s World Insurgency and Terrorism, “Boko Haram,” 2 March 2015. 5 Jacob Zenn, “A Biography of Boko Haram and the Bay’a to Al Baghdadi,” Combatting Terrorism Center, 19 March 2015. 6 US Department of State, “Background Briefing on Designation of Boko Haram and Ansaru as Foreign Terrorist Organizations and as Specially Designated Global Terrorists,” 13 November 2013. 7 BBC News, “Nigeria’s Boko Haram Leader Abubakar Shekau in Profile,” 9 May 2014. 8 Jane’s World Insurgency and Terrorism, “Boko Haram,” 1 May 2015. 9 Mohammed Aly Serbie and Toni Johnson, “Boko Haram,” Council on Foreign Relations, 5 March 2015; Amnesty International, “Nigeria: Crimes under International Law Committed by Boko Haram and the Nigerian Military in north-east Nigeria: Amnesty International Written Statement to the 29th Session of the UN Human Rights Council (15 June – 3 July 2015),” 3 June 2015. 10 Jacob Zenn, “Boko Haram’s International Connections,” Combatting Terrorism Center, 14 January 2013. 11 Eli Lake, “Boko Haram’s Bin Laden Connection,” , 11 May 2014; Jacob Zenn, “A Biography of Boko Haram and the Bay’a to Al-Baghdadi,” Combatting Terrorism Center, 19 March 2015. 12 Jacob Zenn, “A Biography of Boko Haram and the Bay’a to Al-Baghdadi,” Combatting Terrorism Center, 19 March 2015. 13 , “Boko Haram Has up to 6,000 ‘Hardcore’ Fighters, Claims US Intelligence,” 6 February 2015; Jane’s World Insurgency and Terrorism, “Boko Haram,” 1 May 2015. 14 Jane’s World Insurgency and Terrorism, “Boko Haram,” 1 May 2015. 15 Matthew Henman, “Analysis: Boko Haram’s History of Violence Provides Clues to Group’s Next Moves,” HIS Jane’s 360, 25 June 2014; Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. . TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. 16 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. . TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. 17 Adam Nossitermay, “Tales of Escapees in Nigeria Add to Worries about Other Kidnapped Girls,” New York Times, 14 May 2014; Adam Nossitermay, “Nigerian Girls Seen in Video from Militants,” The New York Times, “12 May 2014. 18 Amy Goodman, Omoyele Sowore, and Ijeoma Uduma, “Bring Back Our Girls: Nigerians Caught Between Deadly Boko Haram Attacks & Military Reprisals,” Democracy Now, 6 May 2014. 19 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011.

28 UNCLASSIFIED

Threat Tactics Report: Boko Haram

20 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. 21 Africa 24, “Nigeria to Lead New Regional Force Against Boko Haram,” 12 June 2015; Thomas Fessy, “Boko Haram: Can Regional Force Beat Nigeria’s Militant Islamists?,” BBC News, 3 March 2015. 22 Voice of America, “Boko Haram Seizes Baga Military Base,” 4 January 2015. 23 Thomas Fessy, “Boko Haram Attack: What Happened in Baga?,” BBC News Africa, 2 February 2015. 24 Amnesty International, “’Our Job is to Shoot, Slaughter, and Kill:’ Boko Haram’s Reign of Terror in North-East Nigeria,” 2015. 25 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. 26 Associated Press, “Nigerian Soldiers Fighting Boko Haram Sentenced to Death for Mutiny,” 16 September 2014. 27 Urhobo Today, “Angry Soldiers Shoot GOC on Sighting Corpses of Soldiers Killed in Chibok’s Ambush,” 14 May 2014. 28 Dare Lawal, “Our Soldiers Are Angry: More Details on the Mutiny at the Maimlari Barracks; Military Set to Probe,” The Scoop, 15 May 2014. 29 Chris Olukolade, “Four Soldiers Die in Ambush in Chibok As Soldier Shoot Inside Barrack in Borno,” Nigeria Politics Online, 14 May 2014. 30 Damien Gayle, “Nigerian Soldiers Fire on Own Commander after Being Ordered into Boko Haram Ambush as Government Rules Out Swapping Prisoners for Captive Girls,” Daily Mail, 14 May 2015. 31 Yetunde Bamidele, “12 Soldiers Who Attacked GOC Sentenced to Death,” Naij, October 2015. 32 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. 33 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. . TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. 34 Nigerian Defence Headquarters, “10 More Terrorists Fall as Many of Them Die in Sambisa Forest,” 17 May 2015. 35 Nigerian Defence Headquarters, “10 More Terrorists Fall as Many of Them Die in Sambisa Forest,” 17 May 2015. 36 Counterterrorism Guide, “Terrorist Groups: Boko Haram,” National Counterterrorism Center, November 2013. 37 Moki Edwin Kindzeka, “Chinese Workers Abandon Cameroon Construction Sites,” Voice of America, 23 June 2014. 38 IHS Jane’s 360, “Boko Haram Militants’ Evolving Strategy in Nigeria Opens up New Fronts, As Risk of Suicide. Bombings Rise,” 3 August 2014; Jane’s World Insurgency and Terrorism, “Boko Haram,” 1 May 2015. 39 IHS Jane’s 360, “Boko Haram Militants’ Evolving Strategy in Nigeria Opens up New Fronts, As Risk of Suicide Bombings Rise,” 3 August 2014 40 Amnesty International, “’Our Job is to Shoot, Slaughter, and Kill:’ Boko Haram’s Reign of Terror in North-East Nigeria,” 2015; AFP, “Taking on Boko Haram-a Timeline,” 4 February 2015; AFP, “Upsurge in Boko Haram Violence: A Timeline,” 2 February 2015; IRIN, “Updated Timeline of Boko Haram Attacks and Related Violence,” 12 December 2013; NaijaGists.com, “Latest Boko Haram Attacks/Suicide Car Bombings in Nigeria,” 9 April 2012; Timetoast.com, “Boko Haram History,” 2014; NaijaGists.com, “Boko Haram History in Nigeria: Leaders and Attacks Timeline,” 2012; IRIN, “Timeline of Boko Haram Attacks and Related Violence,” 20 January 2012; , “Boko Haram Militants Disguised as Preachers Kill Dozens in Nigeria,” 6 April 2015; Ahmed, Ibrahim and Mike Eckel, “In the Home of Peace, A Siege of Fear: Major Boko Haram Attacks,” Voice of America; Zenn, Jacob, “A Biography of Boko Haram and the Bay’a to Al-Baghadadi,” 19 March 2015. 41 Jon Gambrell and Sunday Alamba, “Nigeria Sect Leader Threatens New Attacks,” Associated Press, 27 January 2015. 42 BBC News, “Nigeria’s Boko Haram Releases Hostage Video,” 13 May 2013. 43 Kingsley Omonobi and Nnamdi Ojiego, “Bama Attack: Boko Haram Plans to Overrun Barracks – Army,” Vanguard, 9 May 2013. 44 YouTube, “Nigeria Islamist Video Claims Attacks, Shows Hostages,” 13 May 2013. 45 Amnesty International, “Nigeria: Abducted Women and Girls Forced to Join Boko Haram Attacks,” 14 April 2015. 46 Reuters, “Boko Haram Leader: ‘We Will Sell the Girls on the Market,” 6 May 2014; David Blair, “Nigeria’s Boko Haram Isn’t Just Kidnapping Girls: It’s Enslaving Them,” 13 January 2015. 47 Jacob Zenn and Elizabeth Pearson, “Boko Haram and the Kidnapping of Women: A Troubled Tactic,” War on the Rocks, 11 March 2014. 48 , “A Clueless Government,” 10 May 2014. 49 Jacob Zenn, “Boko Haram’s Evolving Tactics and Alliances in Nigeria,” Combatting Terrorism Center, 25 June 2013; Heather Murdock, “Boko Haram’s Funding Remains ‘Illusive,’” Voice of America, 22 May 2013; Peter Weber, “Who’s Financing Boko Haram?,” The Week, 12 May 2014.

29 UNCLASSIFIED

Threat Tactics Report: Boko Haram

50 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. 51 Human Rights Watch, “Spiraling Violence: Boko Haram Attacks and Security Force Abuses in Nigeria,” 2012. 52 Njadvara Musa, “Nonviolent Muslim Cleric Killed in Nigeria,” Associated Press article in The Washington Post, 13 March 2011. 53 Human Rights Watch, “Spiraling Violence: Boko Haram Attacks and Security Force Abuses in Nigeria,” 2012. 54 Jane’s World Insurgency and Terrorism, “Boko Haram,” 1 May 2015. 55 Threat Matrix, “Boko Haram Kills Local Muslim Leader in Nigeria,” The Long War Journal, 30 May 2015; Lanre Ola, “Suspected Boko Haram Gunmen Kill Emir, Policemen in Nigeria,” Reuters Africa, 30 May 2014. 56 Manuel Ndimele, “RCCG Pastor Hacked Down by Boko Haram, Location of Wife, Three Kids Unknown,” Naij, August 2014. 57 Jane’s World Insurgency and Terrorism, “Boko Haram,” 1 May 2015. 58 Human Rights Watch, “Spiraling Violence: Boko Haram Attacks and Security Force Abuses in Nigeria,” 2012. 59 Human Rights Watch, “Spiraling Violence: Boko Haram Attacks and Security Force Abuses in Nigeria,” 2012. 60 START: National Consortium for the Study of Terrorism and Responses to Terrorism, “Boko Haram Recent Attacks,” Department of Homeland Security, May 2014. 61 Associated Press, “Boko Haram Slaughters Hundreds While Disguised as Soldiers,” 5 June 2014. 62 Atlanta Black Star, “Boko Haram ‘Ambush’ in Borno Nigeria Claims at Least 87 Lives,” 20 September 2013. 63 John Hall, “Boko Haram Terrorists Caught after Disguising themselves as Women…But Not Shaving Their Beards off,” Daily Mail, 24 February 2015; Reuters, “Boko Haram Disguised as Preachers Kill at Least 24 in Nigeria,” 6 April 2015; Jack Moore, “Boko Haram Militants Disguised as Women Caught by Nigerian Military,” Newsweek, 24 February 2015. 64 Margaret Coker, “How Islamic State’s Win in Ramadi Reveals New Weapons, Tactical Sophistication and Prowess,” The Wall Street Journal, 25 May 2015. 65 Allen Grane, “The Boko Haram War Machine,” Council on Foreign Relations, 8 October 2014. 66 Jacob Zenn, “Boko Haram: Recruitment, Financing, and Arms Trafficking in the Lake Chad Region,” Combating Terrorism Center, 31 October 2014; Human Rights Watch, “Nigeria: Boko Haram Abducts Women, Recruits Children,” 29 November 2013. 67 Jacob Zenn, “Boko Haram: Recruitment, Financing, and Arms Trafficking in the Lake Chad Region,” Combating Terrorism Center, 31 October 2014. 68 Ngala Killian Chimton, “Cameroon in for Long Fight as its Youth Join Boko Haram,” CNN, 3 March 2015. 69 Jacob Zenn, “Boko Haram: Recruitment, Financing, and Arms Trafficking in the Lake Chad Region,” Combating Terrorism Center, 31 October 2014. 70 Terrence McCoy, “Paying for Terrorism: Where Does Boko Haram Get its Money From?,” The Independent, 6 June 2014; Heather Murdock, “Boko Haram’s Funding Remains ‘Illusive,’” Voice of America, 22 May 2013. 71 Jacob Zenn, “Boko Haram’s Evolving Tactics and Alliances in Nigeria,” Combatting Terrorism Center, 25 June 2013; Heather Murdock, “Boko Haram’s Funding Remains ‘Illusive,’” Voice of America, 22 May 2013; Peter Weber, “Who’s Financing Boko Haram?,” The Week, 12 May 2014. 72 Louise I. Shelley, “ISIS, Boko Haram, and the Growing Role of Human Trafficking in 21st Terrorism,” The Daily Beast, 26 December 2014; Keshar Patel, “Boko Haram: Spotlight on Human Trafficking,” World Policy Blog, 22 May 2014. 73 Africa Economic Development Institute, “West Africa and Drug Trafficking,” 2015; Ntaryike Divine Jr., “Drug Trafficking Rising in Central Africa, Warns Interpol,” Voice of America, 8 September 2012; Dr. Freedom C. Onuoha and Dr. Gerald E. Ezirim, "’Terrorism’ and Transnational Organised Crime in West Africa,” Ajazeera Center for Studies, 24 June 2013. 74 Heather Murdock, “Analysts: Nigeria’s Boko Haram Funding Vast, Varied,” Voice of America, 20 March 2014. 75 Human Rights Watch, “Nigeria: Boko Haram Abducts Women, Recruits Children,” 29 November 2013. 76 Erin Banco, “Boko Haram Militants Expanding Beyond Nigeria into Chad, Niger, Cameroon,” International Business Times, 13 February 2015. 77 Amnesty International, “Cameroon: Human Rights under Fire: Attacks and Violations in Cameroon’s Struggle with Boko Haram,” 15 September 2015. 78 International Crisis Group, “Curbing Violence in Nigeria (II): The Boko Haram Insurgency,” 3 April 2014; Jane’s World Insurgency and Terrorism, “Boko Haram,” 1 May 2015. 79 Council on Foreign Relations, “Background Briefing: What is Boko Haram?,” PBS News Hour, 25 February 2014. 80 Daniel Solomon, “Boko Haram’s Predatory State within a Predatory State,” Aljazeera America, 11 September 2014; START: National Consortium for the Study of Terrorism and Responses to Terrorism, “Boko Haram Recent Attacks,” Department of Homeland Defense, May 2014. 30 UNCLASSIFIED

Threat Tactics Report: Boko Haram

81 Jacob Zenn, “Leadership Analysis of Boko Haram and Ansaru in Nigeria,” Combatting Terrorism Center, 24 February 2014. 82 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. . TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. 83 Jack Moore, “Twitter Shuts Down Boko Haram Account,” Newsweek, 25 February 2015. 84 Kylie Bull, “Boko Haram Expands, Launches ISIS-Style Social Media Presence,” Homeland Security Today, 18 February 2015; BBC Monitoring, “Is Islamic State Shaping Boko Haram Media?” 4 March 2015. 85 Ogala Emmanuel, “Boko Haram Twitter Account Suspended,” Premium Times, 8 June 2015. 86 BBC Monitoring, “Is Islamic State Shaping Boko Haram Media?” 4 March 2015. 87 Tim Lister, “Boko Haram + ISIS = Marriage from Hell,” CNN, 25 February 2015. 88 BBC Monitoring, “Is Islamic State Shaping Boko Haram Media?” 4 March 2015. 89 Headquarters, Department of the Army. Training Circular 7-100, Hybrid Threat. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2010. 90Chris Stein, “Forest Stands Between Nigeria, Victory over Boko Haram,” Voice of America, 21 April 2015; Bodunrin Kayode, “Inside Nigeria’s Sambisa Forest, the Boko Haram Hideout Where Kidnapped School Girls Are Believed to Be Held,” The Guardian, 29 April 2014. 91 Martin Roberts, “Reported Boko Haram Attacks Indicate Retained Ability to Target Nigerian and Allied Forces in Border Areas,” IHS Jane’s 360, 27 April 2015. 92 Jacob Zenn, “Boko Haram’s International Connections,” Combatting Terrorism Center, 14 January 2013. 93 Anne Look and Moki Edwin Kindzeka, “Are Nigeria’s Safe Havens for Boko Haram?,” Voice of America, 25 March 2014. 94 Jacob Zenn, “Boko Haram’s International Connections,” Combatting Terrorism Center, 14 January 2013. 95 Jacob Zenn, “Boko Haram’s International Connections,” Combatting Terrorism Center, 14 January 2013. 96 Agency Staff, “Boko Haram ‘Logistics’ Raid Targets French-Owned Cement Works,” Business Day Live, 5 November 2014. 97 Dr. Freedom Onuoha, “Porous Borders and Boko Haram’s Arms Smuggling Operations in Nigeria,” Center for Studies,” 8 September 2013. 98 Sagir Musa, “How al-Qaeda, Boko Haram Smuggle Arms into Nigeria,” Vanguard, 11 May 2013. 99 Sagir Musa, “How al-Qaeda, Boko Haram Smuggle Arms into Nigeria,” Vanguard, 11 May 2013. 100 Freedom C. Onuoha, “Porous Borders and Boko Haram’s Arms Smuggling Operations in Nigeria,” Aljazeera Center for Studies, 8 September 2013. 101 Nigeria Watch, “Army Captures Borno Village in Which Boko Haram Built Tunnel to House 3,000 Men,” 5 April 2015. 102 Chris Pocock, “Nigerian Airpower Hindered in Boko Haram Fight,” AIN Online, 2 February 2015. 103 The Independent Advisory Group on Country Information, “Country Information and Guidance Nigeria: Fear of Boko Haram,” Home Office, June 2015.

31 UNCLASSIFIED

THREAT TACTICS REPORT: IRAN

TRADOC G-2 ACE THREATS INTEGRATION

VERSION 1.0 JUNE 2016

Threat Tactics Report: Iran

Executive Summary  The US State Department has “long-standing concerns over Iran’s nuclear program, sponsorship of terrorism and human rights record.”1  Iran would likely use an adaptive hybrid threat consisting of regular, irregular, and criminal elements to defend its territorial assets and national interests.  Iran’s military presents a threat that uses both high- and low-tech threat capabilities to challenge a potential technologically-superior adversary.  Iran is geographically positioned on a major strategic chokepoint (Strait of Hormuz).  Iran conducts well-organized and effective information warfare (INFOWAR) operations, sometimes in the form of military exercises that demonstrate the potential and intent to disrupt maritime operations in the Strait of Hormuz.  Iran’s operatives continue to support groups such as Lebanese , Palestinian , Badr Group, and Iraqi militias.  Iran continues to support Assad’s regime in Syria.  “Iran’s destabilizing activities” are a continued “problem” for the US.2  The Iranian military consists of two elements: The Artesh composes the conventional military that resembles the pre-1979 force before the Islamic Revolution. The 1979 revolution created the Islamic Revolutionary Guard Corps (IRGC) that primarily protects the Islamic regime.  The IRGC espouses an unconventional military doctrine.  The IRGC has projected Iran’s agenda via terrorist operations in Azerbaijan, Georgia, India, and Thailand in 2012.3

This (U) Threat Tactics Report (TTR) was produced in accordance with (U) Intelligence Community Directive Number 203: Analytical Standards (Effective: January 2015). This TTR was coordinated with:

 National Ground Intelligence Center (NGIC)—Mr. James Bellette  HQDA DCS G-2—Mr. Dana R. Dillon  FMSO—Mr. Tom Wilhelm  ASCC—ARCENT ACE (available on SIPR) Comments and feedback are welcome.

Jon S. Cleaves Director, ACE Threats Integration

34 UNCLASSIFIED

Threat Tactics Report: Iran

Introduction

TRADOC G2 ACE Threats Integration (ACE-TI) is the source of the Threat Tactics Report (TTR) series of products. TTRs serve to explain to the Army training community how an actor fights. Elements that contribute to this understanding may include an actor’s doctrine, force structure, weapons and equipment, education, and warfighting functions. There will be a discussion of the actor’s tactics and techniques, and recent examples of tactical actions will be described. An actor may be regular or irregular, and a TTR will have a discussion of what a particular actor’s capabilities mean to the US and its allies. A TTR will also identify where the conditions specific to the actor are present in the Decisive Action Training Environment (DATE) and other training materials so that these conditions can easily be implemented across all training venues.

Section 1: Introduction to Iran

This is version 1.0 of the TTR Iran series that focuses on the Iranian military and how it can be translated to the Training Circular (TC) 7-100 series. This product was produced for an unclassified venue for the US training community. Iran as a state actor has numerous internal and external factors that influence its military spectrum and affect everything from equipment procurement to overall military strategy. Issues within the Iranian operational environment, compounded by current sanctions (that are in the process of being reduced), the controversial nuclear program, and the ongoing support to terrorist organizations, have created divides between religious/political conservatives and moderates within the country, as well as criticism from state and non-state actors globally.4 In recent years, the Iranian leadership’s stance on its nuclear program has heightened tensions between Iran and the rest of the world.5 Iran’s lethal aid support to proxy actors worldwide, especially in Bahrain, Yemen, and Syria, continues to agitate regional tensions with the focus to disrupt Saudi Arabia’s interests.6 The five permanent members of the UN Security Council plus (P5+1) talks have temporarily defused the Iranian nuclear issue; however, the country’s nuclear ambitions still have the potential for being a future flashpoint.7 Strategy and Goals

The Iranian leadership’s hierarchy is complex, intertwined, and sometimes inconsistent, which at times hinders the country’s overarching strategic objectives.8 Factors that influence the paradigm of Iran’s military strategies are manifested in the ongoing tentative balance between religious, political, and historical rivalries (both real and perceived); the current fragile economy; and the geopolitical characteristics that are consistent with the Iranian operational environment.9 These variables converge to shape the strategic, operational, and tactical echelons within the armed forces’ structure, which is further translated into their capabilities, tactics, and equipment.

35 UNCLASSIFIED

Threat Tactics Report: Iran

These factors drive Iran’s decisionmaking process with regard to military equipment/weapons acquisition (purchased or developed organically) and how these systems are employed on the battlefield in training or in conflict. Further muddling Iran’s strategy and goals are the two unique and, at times, competing military entities. The joint headquarters has command authority over both the Guard Corps (IRGC) and the Artesh (regular military), even though below this command level the chain of command for both the IRGC and the Artesh usually plan and conduct operations separately.

Figure 1. Iranian leadership

Iran’s military espouses four major intertwined strategic imperatives:10  Modernizing the military11  Exporting the evolution paradigm (military projection)  Defending Iran’s sovereignty and territorial assets  Becoming the dominant regional military power and being regarded as a global power Military Modernization As mentioned above, Iran has engaged in a logical sequence of imperatives in order to support its overarching strategic goals. The first imperative consists of Iran’s military modernization initiative. Iran’s military is currently experiencing a considerable modernization and rearmament effort that by itself is a strategic objective intertwined with implications on the other three lines of effort.12 The IRGC and

36 UNCLASSIFIED

Threat Tactics Report: Iran

Artesh (ground and air) have an aging fleet. Iranian modernization emphasizes Iranian-based weapons development, updating, and reverse-engineering that permits Iran to become self-sufficient even with past sanctions.13 Iran is upgrading its mechanized forces but still is dependent on an aging armor fleet; however, the country is beginning to produce its own mechanized vehicles based on older models/chassis within its inventory. The focus has shifted to less armor and more fast-attack vehicles, such as motorcycles or speedboats, to align with pieces of Iran’s adaptive doctrine. The air force’s aging inventory presents challenges to mission readiness with regard to air power. Iran’s military industry has primarily focused on development and expansion within the following categories: cruise and ballistic missiles, unmanned aerial vehicles (UAVs), and cyber warfare.14 Exported Revolution Paradigm (Military Projection) Iran has been listed since January 1984 as a state sponsor of terrorism according to the United States Department of State, and has supported multiple acts of terrorism in recent years.15 In the future, Iran will likely continue to keep exporting its ideologically-charged Shia-based revolution with the use of

Figure 2. Iranian/proxy terror attacks

37 UNCLASSIFIED

Threat Tactics Report: Iran

smaller clandestine units within the IRGC’s Quds forces. The IRGC’s Quds forces advise, train, and equip anti-Western factions in Syria, Yemen, Gaza and Lebanon.16 The majority of Iran’s lethal aid support is geared toward Shia-based militias; however, Iran also supports Sunni groups, such as is the case with Hamas.17 The IRGC’s export of lethal aid to terror groups has a multi-pronged benefit for Iran’s military complex. This force projection is intended to disrupt US interests and/or other potential adversaries, confirm Iran’s role as a regional power, and create an outlet for a recurring financial gain through the sale of lethal aid.18 The IRGC’s relationships with terror groups are vital to its ability to supply lethal aid, conduct clandestine direct action missions, and support Iran’s intelligence-gathering apparatus. The IRGC has projected its influence in the form of terrorist operations in Azerbaijan, Georgia, India, and Thailand in 2012 alone.19 The key appendage for the Iranian military’s projection is the IRGC and in particular the Quds forces.20 The conventional (Artesh) Iranian military has a limited reach capability as related to forced entry operations. The IRGC, especially the Quds forces, has links to terror and criminal organizations with a potential global strike capability, including targets within the United States.21 Defend Iran’s Sovereignty and Territorial Assets The primary mission of the Artesh is to protect the territorial sovereignty of the Islamic Republic of Iran and that of the IRGC is to protect the regime. Iran has developed a flexible military doctrine and often uses aggressive information warfare (INFOWAR) campaigns in order to defend the country’s Figure 3. Snapshot of the Iranian military interests. The Iranian government, in the past, has used hostile INFOWAR messages with the repetitive theme of disrupting maritime operations in the Strait of Hormuz, which is a transit point for 30% of all seaborne- traded oil.22 A recent example of INFOWAR arose in late December of 2011, when the US threatened to restrict Iran’s oil exports. At the time, Iran’s Vice President Mohammad Reza Rahimi stated, “If Iran oil is banned, not a single drop of oil will pass through Hormuz Strait.”23 The Strait of Hormuz consists of a constricted channel that provides an entrance into the Persian Gulf from the Gulf of , making it a natural chokepoint.24 The Strait of Hormuz’s narrowest point is 21 miles wide. The shipping lane in each direction is two miles wide, with a two-mile buffer zone. The IRGCN incorporates the natural chokepoint into its military wargaming and defensive protocols.25 The Iranian military developed these tactics based on the lessons from the Iran- (1980–1988)— which also encompassed the Tanker Wars (1984–1987)—and now includes its learned experiences in its adaptive tactics.26 Key Alliances

In the past, , Russia, and North Korea have supplied Iran with military technology and have maintained some type of diplomatic relationship. The connections have fluctuated over the years

38 UNCLASSIFIED

Threat Tactics Report: Iran

depending on the strategic environment. This project acknowledges the importance of these bonds; however, it will not examine these particular relationships. This portion focuses instead on Iran’s major exports of lethal aid to terror organizations. Lebanese Hezbollah Iran has an extensive history and played a critical role in the creation and development of Lebanese Hezbollah (LH) dating back to 1982. In the past, Iran has used LH as a proxy and to support lethal aid shipments.27 Iran supplied weapons and equipment to LH during the 2006 conflict with , during which reports indicate that Hezbollah launched 10,000 Iranian rockets at Israeli cities.28 The 2006 Hezbollah conflict supports Iran’s military doctrinal theory of how a hybrid threat using adaptive tactics can defeat a technologically-superior adversary. Hezbollah links to the IRGC are also playing a large role in the Syrian conflict.29 Syria Historically, Iran’s closest Arab supporter has been the Syrian political regime. Iran is providing a considerable amount of resources in the form of funding, weapons, and advisors to the against the Sunni-led insurgents.30 If the Syrian regime were to be defeated by the rebels it would be a substantial setback for Iran’s strategic influence and would greatly disrupt Iran’s lethal aid logistical network.31 The Iranians have used Syria has a distribution point for lethal aid shipments in support of Hezbollah, among other terror organizations. A Congressional Research Service (CRS) report in 2012 stated that “the fighting in Syria also reflects the regional tensions between Sunni and Shia Muslims, Arabs and Kurds, and Arabs and Iranians that have shaped events in Iraq, Lebanon, and Bahrain in recent years.”32 The conflict in Syria is divided along sectarian lines and has the potential to spread to other locations with similar demographics such as, but not limited to, Yemen, Bahrain, and Iraq. These potential sectarian proxy conflicts could be fueled by supporters loyal to Iran’s Shia population or Saudi Arabia’s Sunni-based majority. Hamas Iran remains flexible in its foreign policy and is willing to support either Shia or Sunni terror organizations when it suits the country’s geostrategic needs, in spite of its repeated INFOWAR messages focused on exporting Shia-based ideology. An example that personifies the willingness of the Iranians to ignore the Shia-Sunni divide was reported in the US State Department’s 2014 Country Report on Terrorism, which specified that Hamas received “funding, weapons and training from Iran.”33 Iran’s support to the Syrian regime with regard to the ongoing civil war diminished its relationship with Hamas. CRS reports that, as of late 2012, Iran had made multiple attempts to restore the damaged connection with Hamas using “missile technology” as one source of leverage.34 The same report also states that Iran has supported Hamas with the Fajr-5, a short-range missile that can reach Israel. Hamas has reversed-engineer the Fajr-5 to create its own variant, which was used in the November 2012 conflict between Israel and Palestinian militant groups.35 Another example of Iran’s lethal aid logistical support to Hamas was reported on 5 March 2014 by CBS News, which stated that the Israeli navy seized a ship on the with a cargo of M-302 rockets destined for Gaza militants.36

39 UNCLASSIFIED

Threat Tactics Report: Iran

Iraq Strategically, the removal of Iran’s longtime rival Saddam Hussein in Iraq from his position as dictator by coalition forces greatly benefitted Iran’s interests.37 The two regimes had an historical tension that predated the Iran-Iraq War. Sixty to sixty-five percent of the population in Iraq is Shia, heavily congregated in the southern provinces neighboring Iran.38 This virtually ensured that Iran, through its influence of Shia political parties, would have a significant impact on the Iraqi operational environment. The remodeling of the Iraqi political system led to further isolation of the Sunni minority. Iran is currently supporting the Iraqi military as well as the Shia-based militias.39 Kataib Hezbollah (KH) is an example of a militia group that is militarily engaging the Sunni-based and the Levant (ISIL) in an attempt to halt the latter’s progress in Iraq. The US State Department has designated KH as a foreign terrorist organization that has “exacerbated sectarian tensions in Iraq and have committed serious human rights abuses against primary Sunni civilians.”40 Organizational Size and Structure

The Iranian military is comprised of two main components that consist of the Artesh and the IRGC, both of which consist of a ground force, navy, and air force. The IRGC was originally created in 1979 to protect the newly-founded religious- based Islamic regime from potential threats, including the Artesh.41 The IRGC elements are providers of lethal aid to radical Islamic terror groups worldwide in exporting of the Islamic Revolution’s vision. The IRGC has an adaptive and unconventional-based doctrine derived from firsthand experiences, such as the Iran-Iraq War, extracting lessons learned from historical conflict, and monitoring current military engagements. Iran views the US as a major threat and is attentive to the US military’s activities, including the past/current involvement in Iraq and Afghanistan. Iran also extracts lessons learned from the ongoing Israel/Hezbollah conflicts, including important lessons from the 2006 conflict. The Iranian military has developed a defensive posture and a flexible, adaptive doctrine for its military forces. The Iranian Revolution Guard Corps The IRGC was originally created to protect the religious-based Islamic regime and has adapted the lessons from the Iran-Iraq War that formed the current unconventional doctrine. The IRGC is divided into 31 separate commands across the country, one for each 42 province. These units are semi-independent with a decentralized command structure that, in theory, would mitigate damage to Figure 4. IRGC and Artesh command and control (C2) if an invasion by a technologically- (ground) superior adversary were to become a reality. If provoked, the Iranian military could be described as a hybrid threat with regular, irregular, and criminal elements working in tandem to defend Iran’s borders and territorial assets. The IRGC’s units would likely organize into

40 UNCLASSIFIED

Threat Tactics Report: Iran

smaller hunter-killer type units fighting an irregular fight with emphasis on speed, mobility, and surprise. The Iranian doctrine emphasizes the use of fast-attack vehicles on land and sea that would put a premium on mobility, and decentralized command and control to ensure a flexible, more adaptive military force that takes advantage of the restrictive terrain within the country. The IRGC has become a powerful element within Iran and is entangled in the political, religious, and economic sectors. The dynamics of these relationships in many instances have translated into better funding, missions, and equipment for the IRGC. Artesh: Islamic Republic of Iran Ground Forces (IRIGF) The Artesh maintains a robust conventional military organization. The Artesh has a military force that consists of 350,000 soldiers divided into the army, navy, and air force.43 The ground forces possess six infantry divisions, four armor divisions, six artillery divisions, two commando divisions, one airborne 44 brigade, and one special forces brigade.

Figure 5. Iranian ground forces

41 UNCLASSIFIED

Threat Tactics Report: Iran

The primary mission of the Artesh is to protect the territorial sovereignty of the Islamic Republic of Iran. The Artesh IRIGF consists of 222,000 active duty soldiers (excluding the navy and air force). The following are significant weaknesses that would hinder the Artesh’s regular capabilities:  Antiquated and poorly maintained equipment  Primitive and localized C2 capabilities  A lack of highly-training technical professional soldiers  Insufficient replacement parts for equipment, especially air assets  The rugged terrain and Iran’s size create mobility gaps and challenges for defender or aggressor  Lack of logistical capabilities for long-term operations The Iranian Air Forces Iran’s military possesses two distinct air force organizational structures. The Islamic Republic of Iran Air Force (IRIAF) maintains many of the fixed wing aircraft and is similar to the air force’s structure before the 1979 revolution. The Islamic Revolutionary Guard Corps Aerospace Force (IRGC AF) has control of the controversial ballistic mission program, a UAV program, a large number of rotary wing aircraft, and a small number of fixed wing aircraft. The primary mission of the Iranian Air Forces (both IRGC and IRIAF) is to protect and defend Iran’s airspace and sovereignty. The IRIAF’s air inventory consists of a mixture of aircraft from a range of different ages and a multitude of different countries. However, the majority of the Iranian aging inventory consists of US-supplied aircraft predating the 1979 revolution.45 Overall, the Iranian air components do not comprise a formidable threat to a technologically-advanced air force. Many of Iran’s aircraft are still operational due to the efforts of its domestic military industry, which has worked on gaps caused by the lack of replacement aircraft parts due to past sanctions. The IRGC clandestine elements have attempted to purchase parts from the black market using witting and unwitting sources.46 Despite Iran’s creative problem-solving, the issues of operational readiness, sustainment, and training, as well as the overall air force as an organization, are problematic and contradictory to the vision of Iran’s modernization goal. Jane’s reports that China supplied at least 65 F-7 fighters—a Chinese-replicated MiG-21—to Iran.47 The American F-14 and the Russian MiG-29 remain the biggest air threats to Western forces. Air elements primarily support their ground forces. Iran’s military leadership would likely position the best air defense artillery (ADA) assets and prized aircraft near strategic sites, such as nuclear plants, in order to interdict and deter possible attacks. Overall, the Iranian air component does not comprise a formidable threat to a technologically-advanced air force. The IRIAF’s headquarters, training, sustainment, and air defense center is located in the capital of Tehran. The IRIAF is organized into three geographical commands: Western Area Command (WAC), Southern Area Command (SAC), and Eastern Area Command (EAC), with an estimated 30,000 personnel overall divided among the three separate commands.48 Reporting indicates that the WAC has the majority of the combat air power divided among the following bases: Mehrabad, Tabriz, Hamadan, Dezful, Omidiyeh, Shiraz, and Esfahan.49 The WAC has the key responsibility of monitoring the airspace along the Iraqi border and is tasked with securing Tehran’s airspace. The heavy support to the WAC illustrates the importance that the Iranian hierarchy has placed on its organizational responsibilities. The

42 UNCLASSIFIED

Threat Tactics Report: Iran

SAC has the mission to protect the airspace along the Persian Gulf with bases in Bushehr, Bandar Abbas, and Chah Bahar. The EAC main airbase in Mashhad is assigned to protect the Iran-Afghanistan border. Jane’s estimates that Iran could potentially possess 16 combat squadrons; however, the exact operational readiness number is still unknown. Open source reports greatly vary from source to source and compounding the problem is the mixing of IRGC air elements with the Artesh air assets.50 The IRGC has control over Iran’s extensive missile program, which has received support from China, Russia, and North Korea in the past.51 As an example, Iran’s Shahab 3 missile is a modified version of North Korean’s No Dong missile that can range targets out to 2,000 km.52 Single-source reporting from Jane’s states that the IRGC missile force consists of five brigades (BDEs):53  15th Ghaem Missile BDE, location unknown, with short-range missiles (Fajr)  5th Ra’ad Missile BDE northwest of Tehran in Karaj, with Shahab 3 & 4 missiles  7th Al-Hadid Missile BDE located in Karaj, with Shahab 1 & 2 missiles, has C2 over the Ali Missile Site in Khorrambab  19th Zulfeqar Missile BDE located in Karaj, also has short-range systems (Nazeat and Zelzal)  23rd Towhid Missile BDE located in Khorramabad

Figure 6. Overview of Iranian air and naval assets

The Iranian Naval Forces Iran has two distinct navies that consist of the Iranian Revolutionary Guard Corps Navy (IRGCN) and the Islamic Republic of Iran Navy (IRIN). The missions are similar for both organizations, which are to defend Iran’s littoral territories and protect Iranian interests. The IRGCN and the IRIN have different areas of operations. The IRGCN possesses a lighter fleet of ships and is charged with the vital close-in mission of coastal defense and the responsibility to protect the Persian Gulf and Strait of Hormuz.54 The IRGCN’s naval doctrine has adapted to use swarming and fast-attack tactics.55 The IRIN is considered the more 43 UNCLASSIFIED

Threat Tactics Report: Iran

conventional navy and possesses a longer force projection, considered the “blue water” mission; however, the IRIN ships and boats are suffering from antiquated equipment, which leads to questionable operational readiness. The Center for Strategic & International Studies (CSIS) noted that the overall IRIN remains “far less capable of fighting a conventional battle at sea than when it was decisively defeated by the US Navy in the ‘tanker war’ of 1987-1988.”56 Most of Iran’s military operates in defensive belts in order to deter an aggressor.57 As an example, if an opponent was to engage by sea, the IRIN would be the first entity to attempt engagement, while the IRGCN would be second and commit closer to the borders. The biggest threats posed by Iran’s navies would consist of swarming attacks by fast boats with missiles and vehicle borne improvised explosive devices (VBIEDs), submarines, and mining the Strait of Hormuz.58 Paramilitary Forces and Intelligence

The Iranian government tasks its paramilitary forces with the following missions: basic law enforcement, border control, and maintenance of public order.59 The paramilitary agencies within Iran are divide into the following organizations: the Ministry of Intelligence and Security (MOIS), the Law Enforcement Forces (LEF) under the Interior Ministry, and, in a separate chain of command, the IRGC, which includes the Basij militia. Jane’s estimates that Iran possesses at least 400,000 paramilitary personnel throughout the country.60 When viewed from the Western perspective, the multi-organizational paramilitary presents an illusion of chaos and disarray. The multifaceted institutional structure, however, is not in a state of constant anarchy, such as it might appear; rather, the smaller components collaborate in a semi-competent overlapping manner to support the regime’s overall agenda. In 2009, the US State Department reported that Iran’s security forces faced corruption issues and acted with impunity as they conducted serious human rights violations, especially in demonstrations after the 2009 elections.61 Law Enforcement Forces (LEF) According to Jane’s, the Iranian government formed the LEF in 1991 by unifying the police, gendarmerie, and the revolutionary committees.62 In 2007, the Iranian government announced a new program to improve the border regiment’s equipment. The government provided updated technology to strengthen border security as a method to combat smuggling and insurgency groups that pose a threat to the state. The LEF conducts law enforcement, border control, and maintains internal civil order. The Supreme Leader approves the LEF chief, who is recommended by the president even though the organization falls under the Ministry of Interior. Multiple units overlap, such as the Social Corruption Unit and the Public Establishment Office, which attempt to weed out unacceptable, lewd social behaviors such as questionable clothing or music and public interaction between males and females.63 The Basij: “Mobilization of the Oppressed” The IRGC has command of the Basij—another category of reserve military personnel or militia. Translated, the Basij means “Mobilization of the Oppressed.” The organization was established during the 1979 revolution, but gained prominence in the Iran-Iraq War. The Basij became infamous for military operations that consisted of young boys and/or older men that conducted human wave attacks against

44 UNCLASSIFIED

Threat Tactics Report: Iran

the Iraqi defensive lines.64 Human waves would advance into Iraqi defensive positions, including minefields, and in many cases be “martyred.” The Iranian government organized the Basij geographically around local cities or districts. Basij Ashura battalions contain only males while Basij al-Zahra battalions contain only females.65 The Iranian government subordinates the Basij units to the IRGC and would likely use their personnel to fill out the IRGC’s ranks in a large-scale conflict. The Basij organizational structure has three major categories:66  Regular Members consist of unpaid volunteers that can be mobilized during periods of internal civil unrest or conflict. The member is paid if he takes part in war-time duty.  Active Members receive compensation during periods of non-conflict and tend to be political and religious hardliners that go through extensive indoctrination.  Special Members are paid cadre that are dual members of the Basij and the IRGC’s ground forces. Actual Basij members are estimated at around 300,000 with the potential to mobilize 1,000,000 more, although Iran publicly claims numbers as high as twelve million.67 In addition to traditional military operations, Basij units perform civil support missions. In the past, Basij units assisted with public health activities, assisted in construction projects, guarded administrative centers, and assisted the police. The government considers the Basij as a critical section with regard to internal security, as witnessed during the 2009 elections. The government also considers the mobilization of the Basij as crucial if an aggressor threatens Iran. The Basij would fill the ranks of the IRGC, as was the case during the Iran-Iraq War. IRGC’s Quds Forces The IRGC’s Intelligence Directorate controls the Quds forces, which is a paramilitary elite entity that has the mission for extra-territorial covert operations including an unconventional warfare component. The organization is headquartered out of the southwestern city of Ahvaz. CSIS reports that the unit was 5,000 and was to increase to 15,000, including support elements.68 The missions consist of lethal aid, advising, financing, and building relationships with terror organizations like Hezbollah.69 These elements sometimes use diplomatic institutions like embassies as backstops to conduct operations. Ministry of Intelligence and Security (MOIS) Iran has a number of intelligence services including the Ministry of Intelligence and Security (MOIS), which handles the more traditional foreign and domestic intelligence responsibilities. MOIS belongs to the Ministry of the Government and has a close relationship with the president—unlike the IRGC, which is closer to the Supreme Leader. The main headquarters for MOIS is in Tehran. There are five directorates included in MOIS:70  The Directorate of Analysis and Strategy’s main function is to provide Iran’s leadership with intelligence analysis.  The Internal Security Directorate’s main function is to safeguard state institutions, including transit points such as airports, seaports, and border crossings.

45 UNCLASSIFIED

Threat Tactics Report: Iran

 The National Security Directorate has the mission of monitoring and conducting surveillance on opposition movements.  The Counterintelligence Directorate’s main purpose is to eradicate espionage within and outside the country.  The Foreign Intelligence Directorate’s mission is to collect, conduct research, and prepare analysis on foreign intelligence entities. The MOIS also has a subset of departments embedded in the five main directorates that differs in responsibilities, such as interior intelligence, foreign affairs, open source intelligence, religious studies, planning, attorney general, operations, training, administration, financial services, and stores.71

Section 2: Iranian Weapons and Equipment

The majority of Iran’s air/land weapons and equipment is antiquated. Iran’s military inventory presents challenges to mission readiness with regard to ground and air power. Its arsenal consists of systems from a myriad of different countries; however, a large portion of its inventory was supplied by the United States before the 1979 revolution. Iran’s military industry has focused on the development of UAVs, missiles (both cruise and ballistic), and extending cyber capabilities.72 This action is consistent with its defensive adaptive doctrine to deter attacks. Iran has focused a large amount of resources on an inventory of fast-attack vehicles that emphasize speed and mobility, like motorcycles and fast-attack boats. During the Prophet 9 exercise, motorcycles with Iranian soldiers armed with anti-tank weapons and boats with cruise missiles swarmed targets.73 This weapons/equipment procurement could be perceived as a cost-effective way to counter a heavy- mechanized adversary. Due to sanctions, Iran’s military industry has upgraded and reverse-engineered a number of systems in the mechanized arsenal. Iran claimed to produce its own mechanized vehicles, such as armor and armored personnel carriers; however, many of its claims with regard to these new vehicles are based on older chassis and models within the preexisting inventory.

ARMY

Armored Equipment in Service Zulfiqar 150 Chieftain Mk 3/5 150 BMP-2 400 T-72 / T-72S 480 M47M UNK Sarir UNK T-72M1 50 M48A5 150 Boraq Type-86 140 Safir-74 100 M60A1 150 BTR-50/60 300 Type 72Z UNK Tosan UNK M113A1 200 T-54/55 320 BRDM-2 UNK BMT-2 (Cobra) UNK Type 59 220 Scorpion 80 Rakhsh UNK T-62 75 EE-9 Cascavel 35 Type-80 UNK Type 69- II 200 BMP-1 / Boraq 140 Half-track UNK

46 UNCLASSIFIED

Threat Tactics Report: Iran

Artillery Systems in Service

155 mm / Raad-2 122 mm / D-30 / Shafie D- UNK 550 122 mm / Arash 50 (Thunder 2) 30 1 122 mm / Raad-1 (Thunder UNK 122 mm / Type 54 / M-30 100 240 mm / Fadjr-3 UNK 1) 203 mm / M110 30 75 mm / M116 115 330 / Fadjr-5 UNK 333 mm / Shahin 1 / 170 mm / M1978 (Koksan) 30 105 mm / M56 20 UNK Shahin 2 175 mm / M107 22 105 mm / M101A1 130 120 mm / M-65 200 155 mm / 2S1 (Gvozdika / 60 122 mm Type 60 / D-74 30 120 mm / DIO 500 M1974) 155 mm / M109 / 109A1 / 150 130 mm / Type 59-1 985 107 mm / M30 150 109A1B 155 mm / GH N-45 120 85 mm / D-44 80 37 mm UNK 203 mm / M115 20 107 mm / Type 63 UNK 81 mm 900 155 mm / M114A1 70 107 mm / Haseb (Fadjr 1) 600 81 mm / M-29 UNK 155 mm / HM41 UNK 122 mm / BM-21 100 60 mm / M19 500 AT/SAM Weapons in Service 9k111 Fagot (AT-4 Spigot) UNK RPG-7V 490 SPG-9 Kopye (73 mm) UNK 9k14/9k11 Malyutka (AT-3 4000 Saeghe UNK Misagh-1 UNK Sagger) 9M111 (AT-4 Spigot) 1 4500 Saeghe 2 (Dragon) UNK Misagh-2 UNK 9M113 (AT-5 Spandrel) 2 2400 Shahin 1 1000 FM-90 UNK FM-80 / Crotale / Shahab 9M114 (AT-6 Spiral) 3 500 SPG-9 Kopye (73 mm) UNK UNK Thaqeb Toophan /Toophan BGM-71A 250 2/3/4/5/6 UNK MIM-23 HAWK 120 (TOW / Improved TOW) Pantsyr-S1 / 96K6 SA-22 Entac 90 TOW 150 UNK (Greyhound) Konkurs / Towsan-1 FGM-77 / Dragon 30 UNK 57 mm / ZSU-57-2 80 (9K113) M18 (57 mm) 150 Strela-3 (SA-14 Gremlin) 200 23 mm / ZSU-23-4 100 Pantsyr-S1 96K6 SA-22 M20 50 10 14.5 mm / ZPU-2 / ZPU-4 UNK Greyhound M20 (75 mm) 200 Igla-S (SA-24 Grinch) UNK 23 mm / ZU-23-2 300 M40A1 (106 mm) 200 Tor-M1 (SA-15 Gauntlet) 29 85 mm / M1939 300 Nafez (40 mm) UNK FIM-92A (Stinger) UNK 57 mm / S-60 200 Strela-2M / 9K32M SA-7b Red Arrow UNK 250 40 mm / L/70 50 Grail RPG-22 Neto 200 HN-5A 190 35 mm / Skyguard 92

47 UNCLASSIFIED

Threat Tactics Report: Iran

ARMY AVIATION

Rotary Wing Aircraft in Service EC-635 4 Mi-171E 22 SA 342 Gazelle 6 Mi-17 16

AIR FORCE

Fixed Wing Aircraft in Service F-5 (and variants) 60 J-7 60 PC-6 8 C-130E Hercules 22 Boeing 707 6 P-3 Orion 4 Su-24 29 Boeing 747 11 Tazarve 25 Su-25 13 F27 Friendship 15 TB-21 8 Saeghe 3 Il-76 7 TB-200 4 F-14 Tomcat 44 Y-12 9 F33 Bonanza 34 F-4 Phantom II (and 54 Jetstar 1 EMB-312 15 variants) MiG-29 48 Falcon 50 3 PC-7 35 Mirage F1 20 Falcon 20 1 Rotary Wing Aircraft in Service CH-47 Chinook 2 6 2 2 Bell 214 19 Shahed 274 2 Sea King 2 Missiles in Service AIM-9P Sidewinder UNK PL-2 Atoll UNK AS-11 Kilter UNK AA-8 Aphid UNK PL-5 UNK AS-12 Kegler UNK AA-9 Amos UNK PL-7 UNK AS-14 Kedge UNK AA-10 Alamo UNK PL-9 UNK AS-16 Kickback UNK AA-11 Archer UNK Sattar-1 UNK YJ-6 (CAS-1) UNK AIM-7F Sparrow UNK Sattar-2 UNK C-801C Sardine UNK Fajr-e-Darya (CPMIEC C- AIM-54 Phoenix UNK AGM-65 Maverick UNK UNK 802K) MIM-23B Hawk UNK AS-10 Karen UNK RIM-66 Standard UNK R 550 Magic UNK

48 UNCLASSIFIED

Threat Tactics Report: Iran

NAVY

Vessels Swiftships 35 m 6 Type 2010 4 Seaspray 24 Al-Uboor 3 Type 200 2 Al-Shams 1 Predator 5 Defender 26

Table 1. Iran military equipment

Military Capabilities

Command and Control Iran possesses the only government in the world in which the executive branch does not control the military. Instead, the Supreme Leader, not the President or Prime Minister, serves as the military‘s commander-in-chief and maintains sole authority to declare war and peace.74 He controls the Islamic republic‘s intelligence and security directorates and sets the country‘s foreign and domestic goals. The Supreme Council for National Security (SCNC), under nominal control of the president, acts in an advisory capacity and its purpose lies in the preservation of the Islamic revolution, the protection of Iranian physical territory, and the maintenance of national sovereignty. The military‘s chain of command does not include the SCNC, but SCNC members include many of those commonly associated with national security issues.75 The SCNC membership includes the Iranian president; speaker of parliament; head of the judiciary; chief of the combined general staff of the armed forces; ministers of foreign affairs, intelligence, and interior; two additional representatives appointed by the Supreme Leader; and heads of the IRGC and Artesh.76 The Supreme Leader also embedded his personal representatives in the SCNC. Day-to-day functioning of the armed forces falls upon the joint headquarters, so named because both the IRGC and the Artesh are under its command.77 Iran lacks a robust, secure, interoperable ground communications system that can handle a high volume of message traffic.78 Iran experiences communications difficulties within the various military branches. The communication equipment includes HF, VHF, and UHF bands and encryption systems.79 Maneuver During the Iran-Iraq War, Iran used mass infantry assaults against Iraqi positions. The IRGC’s Basij attacked in human waves as light infantry, most of the time taking heavy casualties.80 The use of armor during this war was generally ineffective and Iran took heavy casualties to its armor forces.81 Both militaries took up defensive postures; however, Iran learned to seize the initiative and attack during the night or during inclement weather. Limited logistical support kept the mechanized force from seizing the initiative over large distances.82 During the Prophet 9 exercise, the IRGC used preparatory fires before motorcycles and armor maneuvered to engage. In a fight against a technologically-superior opponent, Iran’s IRGC would likely use its fast-attack vehicles, such as jeeps and motorcycles, as a major part of its maneuver fight.

49 UNCLASSIFIED

Threat Tactics Report: Iran

INFOWAR The Iranian government and military consider INFOWAR as a core competency for their organizations. Iran integrates INFOWAR at the tactical, operational, and strategic levels. The country remains cognizant of its growing conventional military weakness in comparison to the US and plans to mitigate its deficiencies with a national defense strategy based upon unconventional tactics.83 Iran involves itself heavily in all INFOWAR tools, with an emphasis on perception management, deception, and computer attack. Computer Attack: Iran has offensive and defensive cyber capabilities. The regime has created an intricate system within the country to track Internet traffic—targeting internal threats and criminal behavior—and most likely based from the Cyber Defense Center.84 The Iranian Cyber Army, which is thought to be linked to the IRGC, is the primary organization that conducts offensive cyberattacks.85 In December 2014, Iran’s offensive cyber elements were deemed responsible for cyberattacks that targeted the US military, transportation, public utilities, and other critical infrastructure networks.86 Iran has invested heavily in cyber capabilities in its programs. These programs will evolve, mature, and continue to maintain the ability to threaten Western targets in cyberspace.87 Perception Management: Iran uses perception management as a critical element to simultaneously rally the population against external threats and support the Islamic republic; to marginalize internal dissent; and to deter, dissuade, and defeat external actors that might attack Iran.88 An example can be drawn from the Prophet 9 exercise, when the IRGCN used a mock-up of a US aircraft carrier as the main target. A video was released on YouTube, with the INFOWAR theme targeted at internal and external audiences.89 Reconnaissance, Intelligence, Surveillance, and Target Acquisition (RISTA) Iran’s military has multiple means of collecting intelligence and conducting target acquisition and surveillance. From the air, it has UAVs and fixed-wing capability that can observe potential targets and collect target information. Pre-1979, the US shipped F-14As that were equipped with long-range AWG-9 radar systems.90 Iran is reported to have one Boeing 707-3J9C transport in service that has the capability of conducting signals intelligence missions.91 Field artillery and air defense elements have radars that collect on incoming air targets. Iran’s ground forces have a robust special forces and commando element that consists of three divisions and six brigades of troopers that can conduct RISTA.92 The mechanized force has common reconnaissance vehicles such as the BRDM-2, Scorpion, and EE-9 Cascavel.93 Fire Support Jane’s estimates that Iran now possesses 3,000 to 3,200 medium to heavy artillery weapons and rocket launchers.94 Iran’s fire-support arsenal continues to have a large number of US-supplied systems predating 1979; however, due to lack of mobility of the systems during the Iran-Iraq War, Iran invested in Russian self-propelled guns. Iran’s military industry is now producing systems that are most likely reverse-engineered copies. In theory, if Iran was attacked it would most likely disperse the weapons systems and rely heavily on cover, concealment, decoys, and tactical shielding to protect from air and counterbattery attacks. It is questionable how effective the coordinating efforts would be between the IRGC and Artesh elements with regard to fire support. Fire support coordination during the Iran-Iraq War was substandard.95 The

50 UNCLASSIFIED

Threat Tactics Report: Iran

decentralized commands that make up the Mosaic Defense would also possibly negatively affect fires coordination and increase the possibility of likely fratricide. During the Prophet 9 exercise, a video shows field artillery used as preparatory fires before the ground force assault.96 Protection Iran most likely can execute most of the 15 warfighting tactical tasks for protection if engaged in a major conflict. The proficiency level would be dependent on the type of unit and most likely be inconsistent across the spectrum of the IRGC or Artesh. However, from Iran’s perspective, conducting the tasks of “law and order” is the primary objective throughout the country. Of the 15 protection tasks, Iran is remarkably good at suppressing dissidents, who are perceived as criminals, as witnessed with the 2009 elections.97 Logistics Like Iran’s military doctrine, the logistical system is intended to support a defensive military posture.98 Iran’s military is not organized to support a long-range conventional force projection of power outside the country.99 The challenge presented by the mixture of equipment and weapons within the IRGC and Artesh compounds the logistical and resupply problems faced by the warfighting systems. The IRGC has provided lethal aid to a number of terror organizations. This allows for an irregular power projection with regard to logistics and lethal aid.100 Iran’s military industry produces, stores, and transports an extensive variety of munitions. Its air force can provide troop airlift resupply support with C-130s and Boeing 707s/747s; however, the fleet is aging and operation readiness is questionable.101 Iran’s navy has the capability to insert or resupply commandos using naval assets. Air Defense (AD) In 2007, Iran was promised the “highly capable S-300 air defense system” by the Russians.102 The shipments were not delivered for years; however, after the lifting of sanctions in 2015, Russian officials indicated they would proceed with the S-300 delivery. In a recent article by the BBC the Iranians showcased the S-300 tube and radar in a parade.103 In 2009, Iran established a new air defense command with responsibility charged to the Artesh. This command provides C2 and was designed to unite and consolidate equipment with regard to the country’s land-based air defense systems.104 This new command consolidation effort was in order to increase AD maneuverability and operability, and to consolidate intelligence collection efforts. This action was initiated due to the increased potential of an air attack on its nuclear facilities. Iran’s air defense apparatus consists of a headquarters in Tehran and five regional air defense sectors.105 The air defense assets generally follows the ring of air bases across the northern border and down the western section of the country, which Iran likely considered the most likely air avenue of approach. Interoperability and lack of quality maintenance for the aging equipment in the command creates difficulties in carrying out the mission.106 Iran has a wide territory to protect and will likely use a point defense strategy to protect key bases and facilities. The following are Iran’s major AD threats for an adversary:107  S-300 air defense system108  Surface to air missile systems: Hawk, SA-24, FM-80 (see ADA chart above)  Anti-aircraft artillery: 100 mm, 57 mm, 35 mm, 23 mm

51 UNCLASSIFIED

Threat Tactics Report: Iran

UAVs Iran’s research and development program on unmanned aerial vehicles dates back to around 1984, during the Iran-Iraq War. Iran learned the value and importance of timely intelligence as it related to UAVs during this war and made them a priority for the military industry. The Iranians will continue to improve their UAV technology through research and development. The military industry within Iran has an extensive production of surveillance and reconnaissance equipment with regard to UAVs. In 2010, Iran released an armed UAV named the Karrar. The news agency Fars reported that the Iranian military industry has designed and produced 40 categories of unique UAV systems.109 Chemical and Biological Weapons Official US intelligence reporting indicates that Iran is assessed as possessing a weapons of mass destruction program that includes offensive chemical and “probably” biological warfare agents.110 Even with these capabilities, the Congressional Research Report states “Iran is widely believed unlikely to use chemical, or biological weapons or to transfer them to its regional proxies or allies.”111

Section 3: Iranian Tactics and Techniques

Iran’s military posture is mostly defensive in nature despite INFOWAR and the IRGC’s force projection. Iran’s doctrine was created to deter potential attacks and/or fight a retrograde adaptive conflict that would trade time for casualties in order to allow a resolution in the political arena and/or a defeat of the invader’s national will. The following diagram illustrates a snapshot of sequences on how Iran’s coastal defenses would likely conduct anti-access tactics.112 Hypothetically, if an invader attacked Iran, the IRIN, IRGCN, and air forces would be the first opposing forces that would engage the invader with anti-access operations.113 Iran would use ballistic and cruise missiles to attack maritime ships. The IRGCN would then use swarming attacks and fast-attack ships to isolate and overwhelm potential targets. These tactics of fast-attack vehicles also translate to ground units that put a premium on mobility.114 An example was illustrated in February 2015, when the Iranian military showcased the IRGCN’s adaptive anti-access capabilities during the Prophet 9 annual exercise.115 The IRGCN exercise demonstrated the ability to deploy mines; operate fast-attack boats; and launch cruise/ballistic missiles from land, air, and sea.116 The IRGCN used fast-attack boats, some armed with C-802 anti-ship missiles, to conduct a swarming attack to overwhelm one potential target that was a mock-up of a US aircraft Figure 7A. Swarming attack carrier.117

52 UNCLASSIFIED

Threat Tactics Report: Iran

This was another example of ominous INFOWAR messages directed towards the US. These are four key observations extracted from the Prophet 9 exercise:  The IRGCN coastal defense fired cruise and ballistic missiles, hitting the target; however, this did not demonstrate an over-the-horizon missile capability. It is also worth noting that a US aircraft carrier would most likely not be traveling alone, but with convoy and air support, and would also return fire as well as employ defensive countermeasures.  The IRGCN used fast-attack boats with missiles to overwhelm and isolate targets with a swarm attacks.  The IRGCN used boats as VBIEDs.  A fired a cruise missile during the attack on the mock-up US aircraft carrier. This illustrates a fast-attack Figure 7B. Swarming attack missile threat from land, air, and sea. At a tactical level, the IRGCN armed its coastal defense force with the Ra’ad anti-ship missile that is likely based on the modified Chinese HY-2 Seersucker cruise missile.118 The IRGCN deployed the Ra’ad missiles to 5–7 locations along the Iranian coast, utilizing the natural terrain and narrow channel to its advantage.119 The Ra’ad is a subsonic cruise missile with a low flight altitude and a range of 150 km.120 The IRGCN can launch cruise missiles from land, sea, and air-based weapons platforms. The IRGCN’s tactics of fast-attack vehicles put a premium on speed and mobility. In a real-world scenario, the theory is that these fast boats could fire and maneuver quickly to safety, unlike larger naval platforms. IRGC’s elements, while conducting fast-boat swarming tactics, could simultaneously start operations with missiles that can range regional adversary’s bases. The use of UAVs, cyber operations, and clandestine/covert proxies or Figure 7C. Swarming attack

53 UNCLASSIFIED

Threat Tactics Report: Iran

terror sleeper cells could also be used as a means to attack targets. Sleeper cells and commandos could potentially be used to attack military installations worldwide.121 After anti-access operations, the Artesh would be the first major resistance encountered in most ground-based invasion scenarios.122 Theoretically, if a technologically-superior country invaded Iran, it would immediately be confronted with the Artesh’s ground forces, which consist typically of light and mechanized infantry.123 The Artesh would attempt to repel or destroy the invader with conventional force-on-force engagements. If this course of action failed to deter the aggressor, then the operational and tactical task would likely shift to delay for time, to allow the mobilization process and the “asymmetrical doctrine” to commence.124 The Artesh’s forces would rely heavily on cover, concealment, and deception. The Artesh would use key terrain and lines of communication, such as natural chokepoints and/or man-made infrastructure, to canalize enemy forces. Iran’s military during the Iran-Iraq War also realized the significance of using terrain to mask troop movements while forcing the aggressor to engage at a disadvantage in urban or canalized terrain, thus limiting a technologically-advanced enemy.125 A terrain analysis of Iran’s physical environment quickly explains the disposition of its military forces. The Zagros Mountains canalize movement from the northwest to the southeast.

Figure 8a. Artesh defense

54 UNCLASSIFIED

Threat Tactics Report: Iran

Overall, Iran’s size and terrain dictate its military defensive strategy, as adapted by Iranian doctrine. Iran’s ground forces would likely fight a retrograde delay similar to a maneuver defense as described in Training Circular 7-100.2. This tactical action would maximize the advantages of the restrictive terrain while falling back to preplanned battle positions.

Figure 8b. Artesh defense

This course of action would draw the invader further into the country and potentially overextend his logistical lines, making him vulnerable to raids, assaults, and ambushes. The Iranians would likely take advantage of interior lines of communication that would allow them to concentrate on the enemy at chokepoints, such as mountain passes, and put a premium on urban fighting. Simultaneously during the Artesh’s maneuver defense, the IRGC would begin its Mosaic Defense doctrine, consisting of a hybrid threat that would conduct irregular warfare.126 During this stage of the conflict, the Iranians—mostly the IRGC and Basij—would use small units, such as hunter-killer teams equipped with motorcycles and fast-attack vehicles, to conduct ambushes, raids, and assaults. Iran’s military learned the importance of these types of small unit tactical actions towards the end of the Iran-Iraq War. The IRGC started to empower junior leaders in order to seize the initiative on the battlefield at lower-level military echelons. The use of reconnaissance and assaults during bad weather in conjunction with night raids became a common variable for success against the Iraqi military. Iran’s military leadership started implementing a decentralized C2 with smaller units that conducted irregular warfare on targets of opportunity and high-value targets.127

55 UNCLASSIFIED

Threat Tactics Report: Iran

During the first stages of the Iran-Iraq War, the IRGC used human waves to conduct tactical assaults on Iraqi military lines. The first evolution of these assaults mostly took place during daylight without the use of reconnaissance to identify weakness within the Iraqi defenses. Even though the human wave tactic was not overly effective during the Iran-Iraq War, it still was psychologically damaging to the defenders and the Iranians did capitalize on the INFOWAR narrative. The IRGC’s Basij could potentially conduct human wave attacks against invaders’ military lines. The diagrams below are illustrative of examples taken from the Iran-Iraq War. This course of action is consistent with events during that war and could be seen again in a modern conflict. The Iran-Iraq War was Iran’s last major conflict and still heavily influences the country’s military doctrine. Many of its senior military leaders are veterans of that conflict. Many hardliners and veterans within Iran’s hierarchy have rationalized that innovative tactics, self-sacrifice, and the Iranian people‘s faith overcame a technologically-superior Iraqi force. This rationale is translated by the Iranians into future potential conflicts with other technologically-superior adversaries.

Figure 9a. Wave attack

56 UNCLASSIFIED

Threat Tactics Report: Iran

Figure 9b. Wave attack

Conclusion

The Government of Iran’s responses to its nuclear program and continued support for terror organizations increased regional and global tensions during 2014. The US should be concerned with Iran’s continued support in the form of lethal aid and advisors to terror organizations in Gaza, Lebanon, and Yemen. Iran has and will continue to support the Syrian regime’s civil war. The P5+1 talks reached an agreement for the future of the Iranian nuclear issue; however, this issue still has the potential to develop into a crisis. Iran uses a repetitive INFOWAR narrative of threatening to disrupt shipping in the Strait of Hormuz. If Iran’s INFOWAR narrative is physically translated and executed into a tactical action by the IRGCN, it may potentially hamper US and global interests. Iranian military doctrine focuses on an adaptive hybrid threat defensive posture against a modern industrialized enemy. The Quds forces and other intelligence organizations allow the Iranians the capability of military power projection. In the future, Iran will continue to support terror organizations with advisors and lethal aid and will increase influence in countries like Iraq and Yemen.

57 UNCLASSIFIED

Threat Tactics Report: Iran

REAL-WORLD CONDITIONS APPLIED TO TRAINING

The Training Circular (TC) 7-100 Hybrid Threat series, the Decisive Action Training Environment (DATE), and the Worldwide Equipment Guide provide training resources for applying real-world conditions to training. The tactics used by Iran’s military can be found as part of the composite threat model that exists in the Hybrid Threat Doctrine series. Iran’s Artesh and IRGC use principles of offense and defense very similar to those present in TC 7-100.2, Opposing Force Tactics and TC 7-100.3, Irregular Opposing Forces. Additionally, the operational environment outlined in DATE also includes characteristics of the Artesh, the IRGC, and the Iranian operational environment. Replication in Training Of the countries in DATE, the one that can most realistically replicate Iran is Ariana. Ariana possesses the second-strongest military within DATE. Like Iran, Ariana is a country intent on growing its national power through diplomatic and irregular force projection by military means. Ariana is not a complete representation of Iran due to military equipment and organizational readiness. In order to portray Iran in a training environment, Ariana’s military equipment would need to be downgraded to tier 3 or 4 systems with niche technology focused on missiles, cyber, and UAVs. All of the tactics in this report can be found in TC 7-100.2, Opposing Force Tactics. For more information on how to replicate these actions, reference the TC 7-100.2. For information on how to build a force structure to conduct these actions, reference TC 7-100.4, Hybrid Threat Force Structure Organization Guide (Chapter 3, Section VIII, “Building an OPFOR Order of Battle”). The table below contains excerpts from the TC 7-100.2 that define the tactical actions discussed in this report.

TC 7-100.2 & TC 7-100.3 Tactics TC 7-100.2 Para 3-74. Dispersed attack is the primary manner in which the OPFOR conducts offensive action when threatened by a superior enemy and/or when unable to mass or provide integrated C2 to an attack. This is not to say that the dispersed attack cannot or should IRGC/Basij Human Wave Attacks not be used against peer forces, but as a rule integrated attack will more completely attain objectives in such situations. Dispersed (Dispersed Attack) attack relies on INFOWAR and dispersion of forces to permit the OPFOR to conduct tactical offensive actions while overmatched by precision standoff weapons and imagery and signals sensors. The dispersed attack is continuous and comes from multiple directions. It employs multiple means working together in a very interdependent way. TC 7-100.2 Para 4-62. In situations where the OPFOR is not completely overmatched, it may conduct a tactical maneuver defense. This type of defense is designed to achieve tactical decision by skillfully using Artesh Defense fires and maneuver to destroy key elements of the enemy’s combat system and deny enemy forces their objective, while preserving the (Maneuver Defense) friendly force. Maneuver defenses cause the enemy to continually lose effectiveness until he can no longer achieve his objectives. They can also economize force in less important areas while the OPFOR moves additional forces onto the most threatened axes.

58 UNCLASSIFIED

Threat Tactics Report: Iran

TC 7-100.2 Para 4-85. In situations where the OPFOR must deny key areas (or the access to them) or where it is overmatched, it may conduct a tactical area defense. Area defense is designed to achieve a decision in one of two ways:  By forcing the enemy’s offensive operations to culminate Positional Defense before he can achieve his objectives. (Area Defense)  By denying the enemy his objectives while preserving combat power until decision can be achieved through strategic operations or operational mission accomplishment. TC 7-100.2 Pg 4-1. OPFOR defenses can be characterized as a “shield of blows.” Each force and zone of the defense plays an important role in the attack of the enemy’s combat system. TC 7-100.2 Para 4-107. A simple battle position (SBP) is a defensive Artesh Defense location oriented on the most likely enemy avenue of approach. SBPs are (Simple Battle Position) not necessarily tied to complex terrain. However, they often employ as much engineer effort and/or camouflage, concealment, cover, and

deception (C3D) measures as time allows. TC 7-100.2 Para 4-108. A complex battle position (CBP) is a defensive location designed to employ a combination of complex terrain, C3D, and engineer effort to protect the unit(s) within them from detection and attack while denying their seizure and occupation by the enemy. CBPs typically have the following characteristics that distinguish them from SBPs:

Artesh Defense  Limited avenues of approach. (CBPs are not necessarily tied to an avenue of approach.) (Complex Battle Position)  Any existing avenues of approach are easily observable by the defender.  360-degree fire coverage and protection from attack. (This may be due to the nature of surrounding terrain or engineer activity such as tunneling.)  Engineer effort prioritizing C3D measures; limited countermobility effort that might reveal the CBP location.  Large logistics caches.  Sanctuary from which to launch local attacks.

59 UNCLASSIFIED

Threat Tactics Report: Iran

TC 7-100.3 Para 6-51. Irregular forces use a wide array of tactics and techniques to apply terrorism. The TTP [tactics, techniques, and procedures] are intended to be flexible and adaptive approaches. Surprise, secrecy, and indirect methods of attack are fundamental to acts of terror. The tactical options are as broad and diverse as the resolve of the irregular force leader to improvise and/or innovate with available resources. TC 7.100-3 Para 6-54. Tactics, techniques, and procedures typical of irregular force actions and terrorism include— IRGC/Quds Terrorism Force Projection  (Terrorism Actions) Threat-Hoax.  Arson.  Sabotage.  Bombing.  Hijack-Seizure.  Kidnapping.  Hostage-taking.  Raid or ambush.  Assassination.  Weapons of mass destruction (WMD). FM 7-100.1 Para 1-61. Access limitation seeks to affect an extraregional enemy’s ability to introduce forces into the theater. Access-control operations do not necessarily have to deny the enemy access entirely. A more realistic goal is to limit or interrupt access into the theater in such a Anti-Access Operations in the Strait of Hormuz way that the State’s forces are capable of dealing with them. By (Access Limitation) controlling the amount of force or limiting the options for force introduction, the State can create conditions that place its conventional capabilities on a par with those of an extraregional force. Capability is measured in terms of what the enemy can bring to bear in the theater, rather than what the enemy possesses. Table 2. Excerpts from US Army doctrine Additional considerations for replicating Iran in training environments would be duplicating Iran’s capabilities. These areas are focused mostly on INFOWAR, terrorist acts via proxies, and direct fire support. The chart below details how training centers could replicate a capability comparable to Iran.

Capability (What) Actor/Order of Battle (Who) Tactic (How)

INFOWAR Ariana has an INFOWAR brigade (section TC 7-100.2, Opposing Force Tactics Chapter 7 2A-9 of DATE) that can be used for FM 7-100.1, Opposing Force Operations INFOWAR replication. Chapter 5 To replicate Iran: Highlight strategic INFOWAR operations discussed in the FM.

INFOWAR (Information Attack) Ariana has an INFOWAR brigade (section TC 7-100.3, Opposing Force Tactics Chapter 6 2A-9 of DATE) that can be used for FM 7-100.1, Opposing Force Operations Para INFOWAR replication. 5-48

60 UNCLASSIFIED

Threat Tactics Report: Iran

To replicate Iran: Place emphasis on proxy or small clandestine cells. TC 7-100.3; Para 6-108 an enemy can include―  Sabotage cyber networks.  Extort concession from an enemy.  Damage enemy or supporting activities and infrastructure.

Indirect Fire Support Ariana has a very powerful fire support TC 7-100.2, Opposing Force Tactics Chapter 9 capability that can be scale back by the FM 7-100.1, Opposing Force Operations exercise designer with niche technologies Chapter 7. to replicate Iranian surface-to-surface missiles (SSMs) and indirect fire assets. To replicate Iran: Highlight missile systems. Ariana’s units are equipped with tier 2 fire support as a default. The OPFOR doctrine stresses that fire support should combine air assets, SSMs, and artillery into an integrated attack of enemy targets throughout the area of responsibility.

Special Purpose Forces (SPF) Iran has placed great emphasis on growing TC 7-100.2, Opposing Force Tactics Chapter (proxies and clandestine terror its SPF and irregular forces capability. 15 cells) Ariana’s SPF has a BDE that can sufficiently FM 7-100.1, Opposing Force Operations represent Iran’s organizational network. Chapter 13 To replicate Iran: Highlight amphibious and airborne operations. Table 3. How to use doctrine to replicate Iran

Related Products Follow these links to view related products:  Training and Doctrine Command G-2. Operational Environments to 2028: The Strategic Environment for Unified Land Operations. 2012  Operational Environment Assessment: Iran 2010  Attacks Against the Iranian Nuclear Program 2012  Irregular Forces Financing Handbook March 2012  Terror Operations: Case Studies in Terrorism 2007 See also the Red Diamond Newsletter, which contains current articles on a variety of topics useful to both soldiers and civilians, ranging from enemy tactics and techniques to the nature and analysis of various threat actors. For detailed information on weapons and equipment, see the Worldwide Equipment Guide.

61 UNCLASSIFIED

Threat Tactics Report: Iran

To see more products from TRADOC G2 ACE Threats Integration, visit the Army Training Network (ATN) with CAC access: https://atn.army.mil/dsp_template.aspx?dpID=377

POC

Author Kristin Lechowicz 913-684-7922 (COMM) 552-7922 (DSN)

TRADOC G-2 ACE Threats Integration (ACE-TI) 803 Harrison Drive, BLDG 467 Fort Leavenworth, KS 66027

Jon Cleaves, ACE-TI Director Jennifer Dunn, ACE-TI Deputy Director Jon Moilanen, ACE-TI Operations

Note: Not all references listed in this publication are readily available to the public; some require a government common access card (CAC) to view.

References

American Enterprise Institute. “Statement before the House Committee on Foreign Affairs, Iran’s IRQC Global Force Projection Network.” 20 March 2013. American Foreign Policy Council. “Statement before the U.S. House of Representatives Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies The Iranian Cyber Threat, (Revisited).” 20 March 2013. Central Intelligence Agency. “World Factbook, Iran.” 22 June 2014. Commander, United States Northern Command (NORTHCOM) and North American Aerospace Defense Command. “Testimony (NORTHCOM Command Posture), before the House Armed Services Committee.” 26 February 2014. Commander, United States Southern Command (SOUTHCOM). “Testimony (SOUTHCOM Command Posture), Before The 113th Congress House Armed Services Committee.” 26 February 2014. Congressional Research Service. “Latin America: Terrorism Issues.” 15 August 2014. Department of Defense. “Annual Report on Military Power of Iran.” 2012. Department of Defense. “Quadrennial Defense Review.” 3 March 2014. Department of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2014. Director, National Counterterrorism Center. “Hearing before the Senate Committee on Homeland Security and Governmental Affairs: The Homeland Threat Landscape and U.S. Response.” 14 November 2013. Director, National Counterterrorism Center. “Hearing before the Senate Committee on Homeland Security, Worldwide Threats to the Homeland.” 17 September 2014.

62 UNCLASSIFIED

Threat Tactics Report: Iran

Director, National Counterterrorism Center. “Hearing before the Senate Foreign Relations Committee “Extremism and Sectarianism in Syria, Iraq, and Lebanon.” 6 March 2014. Director, Defense Intelligence Agency. “Annual Threat Assessment. Statement Before the Senate Armed Services Committee United States Senate.” 11 February 2014. Director of National Intelligence. “National Intelligence Strategy.” 18 September 2014. Director of National Intelligence. “Worldwide Threat Assessment of the US Intelligence Community.” 26 February 2015. Director of National Intelligence. “Worldwide Threat Assessment of the US Intelligence Community.” 29 January 2014. Federal Bureau of Investigation Tampa Division. “National Security Threat Awareness Monthly Bulletin.” April 2014. Federal Research Division. “Country Profile Iran.” Library of Congress. May 2008. Hayden, Michael. “Testimony before the House Committee on Foreign Affairs: Examining what a Nuclear Iran Deal Means for Global Security.” 20 November 2014. National Air and Space Intelligence Center. “Ballistic and Cruise Missile Threat.” 2013. Nader, Alireza . “Iran After the Bomb, How Would a Nuclear-Armed Tehran Behave?” Rand. 2013. Nader, Alireza, Ali Scotten, Ahmad Rahmani, Robert Stewart, and Leila Mahnad. “Iran’s Influence in Afghanistan: Implications for the U.S. Drawdown.” Rand. 2014. Select Committee on Intelligence of the US Senate. “Current and Projected National Security Threats to the United States.” 12 March 2013. United Kingdom Government. “Country Information and Guidance Iran: Background information, including actors of protection, internal relocation and illegal exit.” 25 November 2014. United Kingdom Government. “Iran Country of Origin Information Report.” 26 September 2013. US Department of Treasury. “Treasury Targets Networks Linked To Iran.” 2014. US Energy Information Administration. “Iran Country Analysis.” 22 July 2014. US State Department. “Country Reports on Terrorism.” 2013. The Washington Institute for Near East Policy. “Testimony submitted to the House Committee on Foreign Affairs Subcommittee on Terrorism, Nonproliferation, and Trade Subcommittee on the and North Africa, Iran’s Support for Terrorism Worldwide.” 4 March 2014.

Figure Credits

Figure 1. Iranian leadership. Source: Congressional Research Service. 25 July 2014. Figure 2. Iranian/proxy terror attacks. Source: Congressional Research Service. 25 July 2014. Figure 3. Snapshot of the Iranian military. Source: Adapted from Multiple Sources. Created by TRADOC G-2 ACE Threats Integration. 9 June 2015. Figure 4. IRGC and Artesh (Ground). Source: Congressional Research Service. 23 January 2012. Figure 5. Iranian ground forces. Source: TRADOC G-2 ACE Threats Integration. 9 June 2015. Figure 6. Overview of Iranian air and naval assets. Source: TRADOC G-2 ACE Threats Integration. 9 June 2015. Figure 7a. Swarming attack. Source: TRADOC G-2 ACE Threats Integration. 24 June 2015. Figure 7b. Swarming attack. Source: TRADOC G-2 ACE Threats Integration. 24 June 2015. Figure 7c. Swarming attack. Source: TRADOC G-2 ACE Threats Integration. 24 June 2015. Figure 8a. Artesh defense. Source: TRADOC G-2 ACE Threats Integration. 13 May 2015. Figure 8b. Artesh defense. Source: TRADOC G-2 ACE Threats Integration. 13 May 2015. Figure 9a. Wave attack. Source: TRADOC G-2 ACE Threats Integration. 13 May 2015. Figure 9b. Wave attack. Source: TRADOC G-2 ACE Threats Integration. 13 May 2015.

Endnotes

1 US State Department, “Country Reports on Terrorism.” 2014. 2 . “Remarks by President Obama in Press Conference after GCC Summit.” 15 May 2015. 3 Director, National Counterterrorism Center. “Hearing before the Senate Committee on Homeland Security, Worldwide Threats to the Homeland.” 17 September 2014. 63 UNCLASSIFIED

Threat Tactics Report: Iran

4 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014. 5 Paul Kerr. Iran’s Nuclear Program: “Tehran’s Compliance with International Obligations.” Congressional Research Service and US State Department. 28 April 2014. 6 Director, National Counterterrorism Center. “Hearing before the Senate Committee on Homeland Security, Worldwide Threats to the Homeland.” 17 September 2014. 7 Alon Bernstein. “Military Action Against Iran Still Possible, Says Israeli Official.” The World Post. 6 April 2015. 8 Kenneth Katzman. “Iran’s Foreign Policy.” 30 June 2015. 9 Training and Doctrine Command G-2. “Operational Environments to 2028: The Strategic Environment for Unified Land Operations.” August 2012. 10 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2014. 11 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 12 Vincent Stewart. “Statement for the Record Worldwide Threat Assessment Armed Services Committee United States House of Representatives.” 3 February 2015. 13 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 14 American Foreign Policy Council. “Statement before the U.S. House of Representatives Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies The Iranian Cyber Threat, (Revisited).” 20 March 2013. 15 US State Department. “Country Reports on Terrorism.” 2013. 16 Select Committee on Intelligence of the US Senate. “Current and Projected National Security Threats to the United States.” 12 March 2013. 17 Kenneth Katzman. “Iran’s Foreign Policy.” 30 June 2015. 18 US Department of the Treasury. “Fact Sheet: U.S. Treasury Department Targets Iran’s Support for Terrorism Treasury Announces New Sanctions against Iran's Islamic Revolutionary Guard Corps-Qods Force Leadership.” 3 August 2010. 19 Director, National Counterterrorism Center. “Hearing before the Senate Committee on Homeland Security, Worldwide Threats to the Homeland.” 17 September 2014. 20 US State Department. “Country Reports on Terrorism.” 2013 21 Senior Administration Officials, US State Department, “Background Briefing By Senior Administration Officials On Iran, the IRGC, and Hezbollah's Increased Terrorist Activity Worldwide.” US State Department. 31 May 2013. 22 US Energy Information Administration. “World Oil Transit Chokepoints.” 10 November 2014. 23 Steve Hargreaves. “Oil jumps over 2% as Iran threatens supplies.” CNN. 27 December 2011. 24 Kenneth Katzman, Neelesh Nerurkar, Ronald O’Rourke, Chuck Mason, and Michael Ratner. “Iran’s Threat to the Strait of Hormuz.” Congressional Research Service and US State Department. 23 January 2012. 25 US Energy Information Administration. “World Oil Transit Chokepoints.” 10 November 2014. 26 United States Department of Defense. “Iran’s Naval Forces: From Guerrilla Warfare to a Modern Naval Strategy.” Office of Naval Intelligence. Fall 2009. 27 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2010. 28 US State Department. “Country Reports on Terrorism.” 2013. 29 Director of Defense Intelligence Agency (DIA). “Annual Threat Assessment: Statement Before the Senate Armed Services Committee United States Senate.” 11 February 2014. 30 Director, National Counterterrorism Center. “Hearing before the Senate Foreign Relations Committee: ‘Extremism and Sectarianism in Syria, Iraq, and Lebanon.” 6 March 2014. 31 Jeremy Sharp and Christopher Blanchard. “Armed Conflict in Syria US and International Response.” Congressional Research Service. 12 July 2012. 32 Jeremy Sharp and Christopher Blanchard. “Armed Conflict in Syria US and International Response.” Congressional Research Service. 12 July 2012 33 US State Department. “Country Reports on Terrorism.” 2014. 34 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014. 35 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014. 36 CBS News, Israel: “Naval raid nabs Gaza-bound arms from Iran.” 5 March 2014. 64 UNCLASSIFIED

Threat Tactics Report: Iran

37 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014. 38 Central Intelligence Agency (CIA). “World Fact Book, Military.” 23 July 2015. 39 US State Department, “Country Reports on Terrorism.” 2014. 40 US State Department, “Country Reports on Terrorism.” 2014. 41 United Kingdom Government. “Country Information and Guidance Iran: Background information, including actors of protection, internal relocation and illegal exit.” 25 November 2014. 42 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2010. 43 Anthony Cordesman and Bryan Gold. “The Gulf Military Balance Volume I: The Conventional and Asymmetric Dimensions.” Center for Strategic and International Studies. 22 May 2013. 44 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 45 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 46 US Attorney’s Office Southern District of New York. “Four Individuals Charged in the Southern District of New York with Exporting Various Goods from the United States to Iran and China.” Federal Bureau of Investigation, New York Field Office. 5 December 2012. 47 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 48 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 49 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 50 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 51 National Air and Space Intelligence Center. “Ballistic and Cruise Missile Threat.” 2013. 52 National Air and Space Intelligence Center. “Ballistic and Cruise Missile Threat.” 2013. 53 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 54 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014. 55 Office of Naval Intelligence. “Iran’s Naval Forces: From Guerilla Warfare to a Modern Naval Strategy.” Fall 2009. 56 Center for Strategic & International Studies. “Iran’s Developing Military Capabilities.” May 2005. 57 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2014. 58 Office of Naval Intelligence. “Iran’s Naval Forces: From Guerilla Warfare to a Modern Naval Strategy.” Fall 2009. 59 Jane's Sentinel Security Assessment. “Security and Foreign Forces, Iran.” 23 April 2014. 60 Jane's Sentinel Security Assessment. “Security and Foreign Forces, Iran.” 23 April 2014. 61 US State Department. “2009 Human Rights Report: Iran.” 11 March 2010. 62 Jane's Sentinel Security Assessment. “Security and Foreign Forces, Iran.” 23 April 2014. 63 UK Border Agency. “Country of Origin Information Report, 2009.” 2009. 64 BBC. “Profile: Basij militia force.” 18 June 2009. 65 CNN. “Basij commanders.” 24 June 2009 66 United Kingdom Government. “Iran Country of Origin Information Report.” 26 September 2013. 67 Jane's Sentinel Security Assessment. “Security and Foreign Forces, Iran.” 23 April 2014. 68 Anthony Cordesman. “Iran’s Revolutionary Guards, the Al , and Other Intelligence and Paramilitary Forces.” Center for Strategic and International Studies. 16 August 2007. 69 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2010. 70 United Kingdom Government. “Iran Country of Origin Information Report.” 26 September 2013. 71 United Kingdom Government. “Iran Country of Origin Information Report.” 26 September 2013. 72 American Foreign Policy Council. “Statement before the U.S. House of Representatives Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies The Iranian Cyber Threat, (Revisited).” 20 March 2013. 73 YouTube. “Iran 9th Great Prophet Wargame Phase one_February 25, 2015.” 25 February 2015. 74 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014. 75 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 76 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014.

65 UNCLASSIFIED

Threat Tactics Report: Iran

77 Kenneth Katzman. “Iran: U.S. Concerns and Policy Responses.” Congressional Research Service and US State Department. 25 July 2014. 78 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 79 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 80 Ben Wilson. “The Evolution of Iranian Warfighting During the Iran-Iraq War.” Foreign Military Studies Office. July-August 2007. 81 Ben Wilson. “The Evolution of Iranian Warfighting During the Iran-Iraq War.” Foreign Military Studies Office. July-August 2007. 82 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2010. 83 Michael Eisenstadt. “The Strategic Culture of the Islamic Republic of Iran: Operational and Policy Implications.” Middle East Studies, Marine Corps University. August 2011. 84 Jane's Sentinel Security Assessment: “The Gulf States. Iran Procurement.” 13 May 2015. 85 Jane's Sentinel Security Assessment: “The Gulf States. Iran Procurement.” 13 May 2015. 86 Director of National Intelligence. “National Intelligence Strategy.” 26 February 2015. 87 American Foreign Policy Council. “Statement before the U.S. House of Representatives Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies The Iranian Cyber Threat, (Revisited).” 20 March 2013. 88 Michael Eisenstadt. “The Strategic Culture of the Islamic Republic of Iran: Operational and Policy Implications.” Middle East Studies, Marine Corps University. August 2011. 89 YouTube. “Iran 9th Great Prophet Wargame Phase one_February 25, 2015.” 25 February 2015. 90 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 91 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 92 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 93 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 94 Jane's Sentinel Security Assessment: “The Gulf States. Iran Procurement.” 13 May 2015. 95 Ben Wilson. “The Evolution of Iranian Warfighting During the Iran-Iraq War.” Foreign Military Studies Office. July-August 2007. 96 YouTube. “Iran 9th Great Prophet Wargame Phase one_February 25, 2015.” 25 February 2015. 97 US State Department. “2009 Human Rights Report: Iran.” 11 March 2010. 98 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 99 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2010. 100 American Enterprise Institute. “Statement before the House Committee on Foreign Affairs, Iran’s IRQC Global Force Projection Network.” 20 March 2013. 101 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 102 Congressional Research Center. "Iran: Politics, Gulf Security, and U.S. Policy." 30 March 2016. 103 BBC. “Iran Displays New Russian S-300 Defence Missile Parts.” 17 April 2016. 104 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 105 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2010. 106 Jane's Sentinel Security Assessment. “The Gulf States, Air Force Iran.” 5 January 2016. 107 Jane's Sentinel Security Assessment. “The Gulf States. Iran Defence Production and R & D.” 9 October 2014. 108 Congressional Research Center. "Iran: Politics, Gulf Security, and U.S. Policy." 30 March 2016. 109 Jane's Sentinel Security Assessment. “The Gulf States. Iran Defence Production and R & D.” 9 October 110 Congressional Research Center. "Iran: Politics, Gulf Security, and U.S. Policy." 30 March 2016. 111 Congressional Research Center. "Iran: Politics, Gulf Security, and U.S. Policy." 30 March 2016. 112 YouTube. “Iran 9th Great Prophet Wargame Phase one_February 25, 2015.” 25 February 2015. 113 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2014. 114 Office of Naval Intelligence. “Iran’s Naval Forces: From Guerilla Warfare to a Modern Naval Strategy.” Fall 2009. 115 YouTube. “Iran 9th Great Prophet Wargame Phase one_February 25, 2015.” 25 February 2015. 116 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2014. 117 Jeremy Binnie. “IRGC Attacks Replica Carrier in Latest Exercise.” Jane’s Defence Weekly. 25 February 2015. 118 Missile Threat. “Cruise Missiles, Ra’ad.” 10 April 2013. 119 Jane's Sentinel Security Assessment. “The Gulf States, Iran Navy.” 16 April 2015. 66 UNCLASSIFIED

Threat Tactics Report: Iran

120 Missile Threat. “Cruise Missiles, Ra’ad.” 10 April 2013. 121 Federal Bureau of Investigation Tampa Division. “National Security Threat Awareness Monthly Bulletin.” April 2014. 122 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 123 Jane's Sentinel Security Assessment. “World Armies, Iran.” 5 January 2016. 124 Michael Connell. “The Iran Primer Power, Politics, and US Policy.” United States Institute of Peace. 2010. 125 Ben Wilson. “The Evolution of Iranian Warfighting During the Iran-Iraq War.” Foreign Military Studies Office. July-August 2007. 126 Secretary of Defense. “Unclassified Executive Summary Annual Report on Military Power of Iran.” 2010. 127 Ben Wilson. “The Evolution of Iranian Warfighting During the Iran-Iraq War.” Foreign Military Studies Office. July-August 2007.

67 UNCLASSIFIED

THREAT TACTICS REPORT: SYRIA

TRADOC G-2 ACE THREATS INTEGRATION

VERSION 1.0 FEBRUARY 2016

Threat Tactics Report: Syria

Executive Summary

 The Syrian military is a heavy mechanized force, primarily designed to defend against a similarly composed external foe. The heavily armored force is not optimized for the type of combat experienced in Syria’s civil war.  The Syrian military is greatly diminished due to desertions and combat losses and had to broaden its defense capabilities to include a number of hybrid threat actors while significantly adapting its tactics and techniques in order to maintain its ability to protect the regime of President Bashar al Assad.  The Syrian military relies on outside actors to help defend its government, namely Hezbollah and the governments of Iran and Russia for arms, strategy, and personnel.  The reported use of chemical weapons by the Syrian military against its citizens represents the Assad government’s willingness to ignore law of warfare principles in order to achieve its objectives, regardless of global opinion.

This (U) Threat Tactics Report (TTR) was produced in accordance with (U) Intelligence Community Directive Number 203: Analytical Standards (Effective: January 2015). This TTR was coordinated with:

 National Ground Intelligence Center (NGIC)—Mr. Carl Pales  Headquarters, Department of the Army DCS G-2—Mr. Dana R. Dillon  Foreign Military Studies Office (FMSO)—Mr. Tom Wilhelm  US Army Central (USARCENT)—Mr. Jerome Redmond

Comments and feedback are welcome.

Jon S. Cleaves Director, TRADOC G-2 ACE Threats Integration

70 UNCLASSIFIED

Threat Tactics Report: Syria

Introduction

Syria and its ongoing civil war represent an operational environment (OE) that includes many of the characteristics illustrative of the complexities of modern warfare. Now in its fourth year, the civil war in Syria has lured a variety of threat actors from the Middle East and beyond. What began as a protest for improved opportunities and human rights has devolved into a full-scale civil war. As the Syrian military and security forces fought to subdue the civil unrest across the country, these protest groups responded with increasing violence aided by internal and external forces with a long history of terrorist activity. Ill- suited for the scale of combat that was unfolding across the country, Syrian forces turned to their allies for help, including Hezbollah and Iran. The inclusion of these forces has in many ways transformed the military of President Bashar al Assad from a conventional defensive force to a counterinsurgency force. TRADOC G-2 ACE Threats Integration (ACE-TI) is the source of the Threat Tactics Report (TTR) series of products. TTRs serve to explain to the Army training community how an actor fights. Elements that contribute to this understanding may include an actor’s doctrine, force structure, weapons and equipment, education, and warfighting functions. There will be a discussion of the actor’s tactics and techniques, and recent examples of tactical actions will be described if they exist. An actor may be regular or irregular, and a TTR will have a discussion of what a particular actor’s capabilities mean to the US and its allies. A TTR will also identify where the conditions specific to the actor are present in Decisive Action Training Environment (DATE) and other training materials so that these conditions can easily be implemented across all training venues. This particular TTR will describe and assess the structure and capabilities of the Syrian military and its allies in the fight against Sunni opposition forces. Topics will include force structure, combat techniques, military capabilities, irregular forces, and unique capabilities. It is the intent to provide the reader with knowledge of the Syrian military strategy, tactics, and techniques in order to make informed decisions about how best to replicate these conditions in US Army training events using the tools and exercise design methods contained in ACE-TI’s materials and products. The scope of this Threat Tactics report (TTR) covers the Syrian military, included but not limited to regular forces (army, navy, air force, special purpose forces) and paramilitary organizations (Hezbollah, the national defense forces, other foreign militias, and criminal elements) as they relate to the capabilities of the Syrian military.

Section 1: The Syrian Military

The Syrian military is dealing with the effects of a four-year long civil war. Once considered among the most capable in the Middle East, the Syrian military has lost much of its personnel to combat and desertion to antigovernment rebel groups and extremist organizations. Conscription is mandatory for all qualified males at age 18. Women are not required to join the Armed forces but some volunteer. The officer corps is ethnically diverse, however senior officers usually come from the more politically loyal Alawi and Druze populations. Membership in the dominant Ba’ath party is not a requirement but is necessary for advancement to higher positions. The Syrian military has suffered from a wide variety of problems including command and control (C2) issues and sustainment and logistics issues due to mismanagement of soldier professional development 71 UNCLASSIFIED

Threat Tactics Report: Syria

and a challenging modernization effort.1 The vast majority of Syrian military equipment is Soviet-era /Russian design and its doctrine has historically reflected the Soviet model. Syria has traditionally been a heavy mechanized force consisting of approximately 19 mechanized infantry brigades and 22 tank brigades. In addition to the large heavy forces, there are approximately 11 regiments of special purpose forces.2 At the beginning of the current civil war the Syrian military was estimated to be between 220,000 and 250,000 soldiers. The other branches of the Syrian military, the navy and the air force, have an estimated 4,000 and 30,000 members respectively.3 All branches of the military place a premium on loyalty to the government of President Bashar al Assad; the most loyal units in the Syrian military usually receive the most modern weapons and are the best trained. The Syrian navy is one of the smallest in the region. Due to this fact, there are no large naval units such as fleets or squadrons, instead each ship is considered a separate unit. The coastal defense has a naval infantry consisting of 350-500 troops and it is charged with protecting Syria’s 193 km coast. See the weapons and equipment section of this report for a list of relevant naval vessels. The is one of the largest in the Middle East and is the Syrian government’s main advantage against the opposition. In 2007 it was estimated to have 584 fixed wing and 210 rotary wing aircraft.4 However, a lack of spare parts and maintenance for the mostly Russian fleet created a significant effect on the readiness of these aircraft, especially the attack helicopters and offensive fixed- wing aircraft.5 For this reason many pilots are using training aircraft to conduct combat missions. These aircraft perform a range of missions including attack/combat, reconnaissance, transport, and training. Most aircraft are from Russian and former Commonwealth of Independent States (CIS) countries. Syrian air force operations include deep strikes into enemy-held territory as well as support to ground forces.6 The Syrian air force uses a variety of munitions including improvised bombs known as barrel bombs against rebel and civilian targets. An expeditionary force that attempts to intervene in the current crisis in Syria would need to control the Syrian air force prior to ground operations through either lethal attacks or a diplomatic agreement such as a no-fly zone. See the weapons and equipment section of this report for a list of relevant aircraft. Strategy and Goals

The strategic goal of the Syrian military is to maintain territorial integrity of the state of Syria for the current government of President Bashar al Assad. The civil war has forced the government to concentrate its forces on protecting the most critical regions in Syria with a special emphasis on major cities, the capital of , and pro-regime areas in western Syria. This is achieved through offensive and defensive operations designed to maintain security around political, military, and economic centers of power including provincial capitals and important military infrastructure such as air force and army bases, and other key infrastructure. The objectives of these operations are to retain territory that is considered operationally and or strategically important, to destroy the ability of rebel groups’ to conduct offensive operations, and to support the perception of legitimacy for the government. The government’s end state is to maintain enough control over Syria’s national power to emerge victorious from the civil war.7

72 UNCLASSIFIED

Threat Tactics Report: Syria

Key Alliances

The Syrian military relies on a number of allies in order to remain in power, the most notable being Iran, Hezbollah, and Russia. Most of Syria’s allies have provided a combination of military and economic support to maintain the government’s ability to survive. The influence of these actors has some members of the Assad regime fearful of losing control over the country to the foreign powers that control these militias. Iran A key ally of Syria, Iran, and particularly the Iranian Revolutionary Guard Corps (IRGC) share the Syrian government’s interests—which are multifaceted—and support Iran’s vision of regional stability that recognizes Iran as the dominant Middle Eastern power. The level of military and economic aid Iran provided to Syria in recent years was estimated by the United Nations (UN) to be approximately 6 billion dollars.8 Military and ideological ties with Hezbollah, access to sea ports in the Mediterranean, and the defeat of Sunni extremism and Western-influenced hegemony are some of the reasons Iran has invested heavily in Syria. Examples of this support includes a large security force assistance (SFA) program involving various branches of the Iranian government involved in training police and military forces. Activities include providing training and intelligence assistance, and coordinating foreign fighters from Iran, Iraq, and other Shia areas to assist the Syrian regime. Iranian materiel support to non-state actors such as Hezbollah is facilitated through Syrian air bases. Iran pursues a policy of maintaining the regime of President Bashar al Assad, but has also made preparations for a protracted destabilization effort to prevent a Sunni-dominated government should the current government fail. 9 Hezbollah Hezbollah is a non-state actor who has evolved from a grassroots reformist movement into a significant fighting force known for its adaptability in a variety of combat settings. Hezbollah provides both direct and indirect combat support to the Syrian regime in order to maintain freedom of movement across the Lebanese-Syrian border, to interdict Sunni extremists in Lebanon, and to support Iranian objectives in Syria.10 Hezbollah participated and continues to participate in ground operations alongside the Syrian military, especially in situations where its interests are directly threatened. Smuggling routes along the Lebanese border are the conduit for arms and supplies from Iran to Hezbollah’s safe havens in Lebanon, but the flow of resources is hampered by the security situation. This degrades Hezbollah’s ability to operate freely against its enemies both within and outside of Lebanon. Additionally, a number of Lebanese Shia residing on the Syrian side of the border need Hezbollah’s protection. For these reasons Hezbollah has increased its presence in Syria to interdict Sunni rebels attempting to smuggle arms and supplies.11 These operations assist the Syrian Army, which suffers from shortages of personnel. The idea that Hezbollah is a legitimate force in the Middle East that is capable of projecting power outside of its normal sphere of influence has reportedly backfired according to some researchers who claim that Hezbollah’s involvement in Syria has exposed it as a proxy for Iranian foreign policy. Shia and other Militias Like Hezbollah, Iraqi, Pakistani, and Afghan Shia militias are also providing combat support to the Syrian regime.12 Regarded as further evidence of Iran’s influence in the conflict, these militias fight for the

73 UNCLASSIFIED

Threat Tactics Report: Syria

government of Bashar al Assad and have provided security to Shia pilgrimage sites and key infrastructure and participated in the defense of Syrian government throughout the country.13 In 2014, when extremist group the Islamic State in Iraq and the Levant (ISIL) attacked a number of Iraqi cities, a significant number of Iraqi militias were forced to return to Iraq to defend their homeland. Recent reports suggest that these militias have returned and are focusing their efforts on the Alawite heartland of the Syrian Latakia province.14 Other militias that have allegiances to the regime were created from a wide variety of political interests, business groups, and clan-based tribal organizations, ranging in capabilities and providing local security and support to other pro-regime organizations.15 Russia Russia has provided support to Syria and its large inventory of Soviet-era military vehicles and aircraft. Russia is also an advocate for the Syrian regime in international politics and could challenge any security resolutions that threaten the Syrian government’s sovereignty. Russia has reportedly provided training and materiel to the Syrian military including the Syrian air force. Russian support to Syria focuses on enabling military trade between the two countries and protection of its interests in the Mediterranean Port of Tartus. Russia has moved a number of naval assets including a battalion of naval infantry to the Port of Tartus to perform routine missions, but it is expected that these forces can be repurposed if Russian interests are threatened. Organizational Size and Structure

There are roughly three classes of pro-regime military and paramilitary forces in Syria—the government- backed military’s regular forces, the government-backed national defense forces (NDF) irregular militia forces, and foreign irregular militias, most of which are provided through Iranian sponsored groups. The groups are unique while at the same time they complement each other. They use many of the same resources and sometimes operate jointly. Due to the current conflict, the Syrian Army has dwindled from 250,000 members to an estimated 125,000 members.16 The cause of these losses is a result of combat and, to a significant degree, defections and desertions. Manpower continues to be one of the greatest challenges for the Syrian military. The Syrian government has sought to fill its ranks by offering higher pay and benefits to recruits, supporting a robust national guard, and offering amnesty to deserters.17 Syrian government military forces are augmented by a variety of local and foreign pro-government militias estimated to contain 125,000 members that includes the NDF as well as elements from Iraq, Pakistan, and Afghanistan’s Shia populations.18 The NDF is the largest of the domestic militias and is charged with protecting the areas around its local communities.19 Its numbers have grown since the beginning of the conflict as pro-regime actors have sought to protect themselves from opposition groups. Service in the NDF is considered desirable among enlistees as they are able to continue to work on their civilian jobs, provide for their families while defending their communities. NDF fighters are able to receive extra pay and food rations for their family members. The NDF is trained by a combination of Syrian army trainers, Iranian advisors, and Hezbollah fighters. Additionally, these elements retain the ability to provide direct combat support to local militias as they did in pivotal battles such as al Qusayr where it was estimated that 1,200 Hezbollah fighters participated.20

74 UNCLASSIFIED

Threat Tactics Report: Syria

Iranian forces are estimated at between 1,000 to 7,000 members and usually perform advisory roles in Syria.21 Recognizing their interests in Syria, Iranian officials have played an active role in advising and training the NDF and the Syrian military. The short-term plan for Iran is to support the current government in Syria against the rebel opposition. The long-term strategy is to have the flexibility to conduct insurgent activities on its own should the regime fall and a Sunni government is put in place.22

Figure 1. Syrian force structure

Current Locations

Syrian forces are stationed at army and air force installations throughout the country, many of which are near major populations centers such a Damascus, Homs, and Aleppo. Small- to medium-size fortifications known as checkpoints have also been established along the approaches to these locations. The checkpoints vary in size from two to three soldiers on a so-called mobile “flying” checkpoint, to one to two platoons on large fortifications; this depends on proximity to population centers and critical facilities. The locations are designed to coincide with the Syrian government’s strategy to maintain control over the population and to protect elements of national power.23 These checkpoints are used to control the flow of people and resources, and have been used as a base of operations to conduct patrols in remote areas where the threat dictates. The Syrian regime maintains a strategy to have a military presence in all fourteen provinces in order to give the impression of central control over Syria’s territory.

75 UNCLASSIFIED

Threat Tactics Report: Syria

However, operational gains in the last year from the opposition forces including ISIL have resulted in the loss of a significant amount of territory. The province of Raqqa was lost to ISIL, and there is a minimal presence in Idlib, Hasakah, Dayr az Zawr, and Qunaytirah provinces. Currently, the areas in the western half of the country have the greatest concentration of pro- government military forces as the Syrian government struggles to maintain its power over areas that remain loyal to the regime.24 These areas include the majority of Damascus, the Southern portion of main road from Damascus to Aleppo, the Hama province, and the Alawite strongholds around Latakia and Tartus provinces. Additionally the province of Suweida, with the majority of its population belonging to the Druze sect, remains under government control. The mountainous region along the Lebanese border including the Qalamoun province is for the most part controlled by Syrian forces and Lebanese Hezbollah.25 Against regions where the rebel opposition is strongest, the Syrian military has attempted to maintain its defenses and sought to build combat power in order to create conditions favorable to regain control of these territories. The eastern regions that are threatened by ISIL are economy of force areas where limited disruption operations are conducted to slow the movement of ISIL and to support garrisons manned by small numbers of Syrian troops and local militias loyal to the regime. Supply of these remote locations is difficult as militants isolate them from government lines of communication. Remote outposts are supplied by transport planes that provide everything from food and water to ammunition. The security situation makes routine supply by ground transport difficult for many isolated military installations. For this reason transport aircraft are a key target of opposition groups’ limited air defense assets. Media reported cases where fixed-wing aircraft have been shot down by opposition forces, in some cases using surface-to-air missiles.26

Section 2: Syrian Tactics and Techniques

The Syrian army engages in defensive and offensive operations designed to protect its dwindling combat capabilities and promote the impression of progress against the opposition while focusing on maintaining what is termed by researchers as “vital Syria.”27 Vital Syria refers to areas that are politically, militarily, and economically important with a dominant Alawite population. These are areas along the M-45 highway such as South Aleppo, Hama, and Homs, and key centers of power such as Damascus and the Mediterranean coastal provinces of Latakia and Tartus. These types of operations will vary depending on combat conditions but can be generally categorized as area defense and dispersed attack. Due to massive desertions and combat losses, it is unlikely that the Syrian regime can sustain the large- scale offensive operations traditionally associated with armored forces such as multiple integrated attacks without significant risk to the defense of other areas.28 The Syrian army has focused on large- scale conventional operations as the mainstay of its tactical operations. These types of operations relied on fire and maneuver to surround and assault objectives using aerial raids, artillery fire, and armored attacks in an attempt to destroy the enemy or force his surrender.29 For this reason many of the soldiers in the Syrian army were and continue to be ill-prepared for the type of urban combat required in the civil war, which requires significant dismounted forces to cover armor avenues of approach from enemy antitank units. In the early stages of the civil war these techniques were thought to have contributed to the loss of many of the regime’s most capable tanks.30

76 UNCLASSIFIED

Threat Tactics Report: Syria

It is possible that these techniques originated from the Syrian army’s experience during the . In 1981 during the battle for Zahleh, Lebanon, the Syrian army achieved a minor success against the Lebanese forces defending the town. The Syrian army brutally mounted a siege-and-starve campaign in which it attacked the city and the surrounding areas with artillery and tanks for three months. The siege was met with fierce resistance and caused an international uproar that forced the Syrian army to withdraw before it completed the assault. 31 The Syrian army’s inability to penetrate Zahleh’s defenses should have been an indicator of things to come in the current civil war. However, for the past four years the regime has continued to rely on armored assaults in urban areas until combat losses made them untenable. The failed approach resulted in the loss of significant amounts of armored vehicles and personnel for the Syrian regime, and is increasing the reliance on outside allies and militias to operate its remaining armored vehicles. The inexperienced crews are less able to coordinate their movement and Syrian tactics appear to be more dispersed and less concentrated. Since adopting the dispersed tactics of its enemies, the Syrian army is able to preserve its limited combat power but is unable to mass for decisive operations. Although these dispersed tactics included the Syrian air force, they amount to little more than adaptive countermeasures; they have not evolved into an effective campaign. The captured notebook of a senior Iranian military official killed by sniper fire in Syria described the “dissipation and disintegration” of Syrian army units in combat. The deceased general also observed that the Syrian army needed to be more aggressive and take an offensive approach rather than a defensive one.32 Further evidence of the inadequacies of the Syrian army’s tactics was brought to light when researchers observed that many of the army’s tanks were lost in early battles, for example in where they were used as battering rams and were easily engaged by rocket-propelled grenades (RPGs) in the urban canyons of built-up areas.33 In response to the rapid loss of armored vehicles, the government forces would use a combination of seize-and-starve techniques that sealed off the objectives from external support while preparing engagement areas with indirect fires and large-scale aerial assaults, which were intended to provide no sanctuary for the enemy or its sympathizers. General Tactics The 7-100 series of OPFOR doctrinal manuals describes the types of techniques used by the Syrian military. The area defense includes both simple and complex battle positions that attempt to protect Syrian forces and populations loyal to the regime. Examples of simple battle positions the Syrian military uses are the fortifications built along approaches to military installations and cities, which protect critical infrastructure and secure populations. These defensive positions are crucial to the longevity of the regime and provide an information warfare (INFOWAR) effect as they maintain the impression of central control across the country. However, the nature of these static defenses presents easy targets for the opposition forces. For other forces, namely the militias of the Iranian-trained NDF, a network of caches similar to those used by the opposition are used to store and protect weapons and ammunition similar to the hybrid threat complex battle positions. Ideally, offensive operations would take the form of integrated attacks where the regime coordinates both its air force and army in sieges designed to isolate opposition forces and destroy their ability to hold territory throughout the country. However, these types of operations require the mobilization of large amounts of ground forces and coordinated close air support in order to hold captured territory.

77 UNCLASSIFIED

Threat Tactics Report: Syria

These types of operations have decreased in frequency as the civil war has progressed. Under the current state of affairs, offensive operations are dispersed and involve the employment of a hybrid threat consisting of a variety of pro-government actors to achieve their objective against the enemy. A mix of local militias, irregular forces, regular forces, and special purpose forces are employed against targets of opportunity including enemy caches, fighting positions, and concentrations of troops and equipment. Offensive operations are centered on reversing enemy gains and creating footholds in enemy-controlled areas for follow-on offensive operations. These operations can involve any combination of regular and irregular fighters and are conducted to control the tempo and attack the enemy’s will to fight. The Syrian air force is known to target concentrations of opposition personnel and materiel in a bombardment campaign designed to destroy and demoralize the enemy.34 The reliance on the air force has led to a steady increase in the number of sorties flown. When possible, or during large-scale offensive operations, the air force conducts the attacks in coordination with ground operations against enemy fighting positions. It also attacks known isolated concentrations of enemy forces and populations supportive of the opposition. The types of munitions employed vary and include conventional and improvised armaments including industrial chemical munitions such as chlorine bombs.35 Thermobaric or vacuum bombs that include a two-stage detonation technique to ignite the atmosphere are used to maximize the destructive force against area targets.36 The use of improvised explosive laden canisters known as barrel bombs has had significant lethal and psychological effects, especially against the civilian population. The air campaign has received international condemnation for its brutality and its high number of civilian casualties.37 Tactical Examples Tactical examples will illustrate how the Syrian regime employs its military forces. These examples will show how the Syrian regime has used both regular and irregular forces to maintain its claim to power over Syria and how it intends to defeat the opposition within its borders. The first example is the successful siege of al Qusayr, which fell to the regime in 2013 after nearly a year of being controlled by the opposition. The lesson of al Qusayr highlights a divergence from conventional Syrian siege tactics and exposes the weakness in the Syrian army caused by the loss of much of its fighting force to desertions and attrition. The next example describes the operations headed by Hezbollah in the Qalamoun region along the Lebanese border. This example shows how the regime has enjoyed some success by allowing its allies to take the lead in what might be termed economy of force operations. The border area is important to Hezbollah as the transfer point for Iranian arms into Lebanon. It is also an avenue of approach for Sunni militants looking to infiltrate the Bekaa valley and conduct operations against Hezbollah and the Lebanese government. Hezbollah’s operations in the region are significant and its defense of the region allows the regime to focus on other areas of the battle. The influence of Hezbollah and its sponsor Iran has caused divisions within Syrian President Bashar al Assad’s inner circle of trusted compatriots. The battle for Hama province was a part of a larger operation to secure lines of communication from pro-government strongholds in Hama and Latakia. The central location of Hama made it a buffer against opposition gains in western Syria and in the Idlib province. The decision to go on the offense in Hama was partially motivated by an eventual decisive battle in Syria’s second largest city, Aleppo. Hama was

78 UNCLASSIFIED

Threat Tactics Report: Syria

deemed strategically significant as it represented the forward limit of the opposition’s southern push to seal off Idlib province and clear out regime forces to the Turkish border. Syrian forces were determined to stop the southward push of opposition forces into Hama and called upon Colonel Suhayl al Hasan to coordinate the effort. Hasan, known as the Tiger, had achieved notoriety after winning a number of battles during his Aleppo campaign in 2013 and 2014 and breaking the siege in the industrial zone east of Aleppo. Touted as Bashar Assad’s favorite commander by the press, Hasan was known to be operationally aggressive and sufficiently competent to accomplish the mission. The operation ended with governmental forces taking back the city of in northern Hama, but the significance of this victory was lost as the opposition was able to successfully secure lines of communication in Idlib province in March of 2015.38 The Battle for al Qusayr In August 2011, Syrian forces entered al Qusayr to stop so called “Arab Spring” protests against the Syrian government. The army entered with more than 50 armored vehicles and isolated the area by cutting telephone, electricity, and water supplies.39 In what was described by eyewitnesses as a “full- scale military invasion,” the operation resulted in an estimated 13–20 casualties in the first 48 hours.40 More of the city’s residents fled into the countryside and, in some cases, made their way over the border to nearby Lebanon.41 By the fall of 2011, the city of al Qusayr was cut off and traffic was controlled by military checkpoints, preventing freedom of movement both into and out of the city. The anti-government protests continued despite the increased security. Syrian regime forces were heavy- handed in their execution of counterinsurgency (COIN) operations, occupying the town hall and turning the local hospital into an army barracks.42 Opposition forces known as the (FSA), aided by the defection of Syrian government soldiers and supplied by external actors, began to fortify their positions in the Sunni quarters of al Qusayr. These positions also included a number of weapons caches and support zones designed to provide support for the opposition and a base of operations. After a wave of opposition group and hit- and-run guerrilla-type attacks that included placement of improvised explosive devices and a tunnel blast underneath the local Syrian occupied hospital, the situation degraded to a stalemate.43 With the northeastern quarter of al Qusayr under rebel control, the Syrian army employed siege and starve operations in an attempt to force the enemy to give up his positions. The Syrian Arab Army (SYAA) continued to man checkpoints and shell the city in an effort to dislodge the rebels, but any attempt to mount an attack was met with stiff resistance. Recognizing the threat to its safe havens and smuggling routes from Syria to Lebanon, the guerrilla organization Hezbollah increased its presence in the Shia-dominated areas west of the Orontes River in order to prevent the rebels from using the area as a transit point. By providing technical support to including training and organizing militias, Hezbollah was able to conduct raids and launch rockets into al Qusayr from the safe haven of Hermel, Lebanon. The creation of the pro–regime militia Syrian NDF by elements of Hezbollah and the Iranian Quds force allowed Syrian governmental forces and Hezbollah to hold ground around al Qusayr while it prepared for another offensive in the spring. By the spring of 2013, Hezbollah fighters were a mainstay of the effort in the countryside outside al Qusayr. One of the first objectives included the town of Tell Qadesh, just south of Lake Homs. The ancient location of the largest chariot battle in history, Tell Qadesh was deemed a strategic location due

79 UNCLASSIFIED

Threat Tactics Report: Syria

to its relative height (200m above sea level) and its proximity to avenues of approach into al Qusayr from the north.44 Hezbollah fighters led the charge with the NDF and Syrian army in support, resulting in the capture of many of the towns in the outlying area as the regime tightened its hold around al Qusayr. With the countryside under regime control, the last phase of the operation was an assault on al Qusayr itself. In late May 2013, the second assault on al Qusayr culminated with the Syrian governmental forces and the Hezbollah-led guerrilla force clearing the town of the opposition. The specialized training of Hezbollah fighters provided a tactical advantage as they integrated the movement of light infantry and armor and used skilled demining teams to breach defensive positions.45 Rebel leaders attempted to salvage the situation and called for the FSA and other rebel forces to converge and “rescue” al Qusayr.46 The new strategy by the pro-government Syrian Arab Army, however, had produced the intended results. As pro-regime web pages tracked the progress of the loyalist and Hezbollah forces on the Internet, it became apparent to the international press that al Qusayr was under regime control once again.47

Figure 2. Integrated attack on al Qusayr (example)

80 UNCLASSIFIED

Threat Tactics Report: Syria

As many as 1,700 Hezbollah fighters were deployed to retake al Qusayr in support of the pro- government Syrian army. These units operated in small two- to five-man teams to conduct surveillance on rebel positions and provide support to the Syrian army. Syrian commanders were assigned designated sectors within the area of operations in order to coordinate efforts and prevent fratricide. The Hezbollah fighters methodically cleared booby traps and tunnels on the objectives and cleared the path for Syrian government army units.48 Additionally, reconnaissance units acted as forward observers and were instrumental in calling in airstrikes and artillery.49 Command and control was enhanced by using a system of code words for each of the city sectors in order to provide interoperability between Hezbollah and Syrian Regime Forces.50 Syrian forces began the final operation by shelling and conducting airstrikes in and around the city of al Qusayr.51 Syrian army elements then assaulted from the south and the west toward the northwestern part of the city, seizing the town hall and other buildings in the vicinity.52 Hezbollah fighters were able to attack strongholds with Syrian army support by taking the city section by section. Resistance at opposition strong points was defeated with a combination of indirect fire, air raids, and attacks by infantry. Once the opposition was pushed out of the city Syrian army forces began exploitation operations to stop any nascent resistance within the city. Hezbollah forces than began the pursuit of remaining rebels in the surrounding towns as the opposition retreated. Disruption Efforts in Qalamoun The techniques used in al Qusayr were refined as the Syrian regime maintained a disruption zone in the Anti-Lebanon Mountains of the Qalamoun province, north of Damascus. The Qalamoun province is adjacent to Lebanon’s Bekaa valley an ethnically diverse region that is Hezbollah’s heartland and considered the primary supply route for Iranian weapons destined for Hezbollah commanders in the region. Given the strategic importance to both Iran and Hezbollah in their struggle for regional power, Hezbollah took the lead in disrupting forces trying to create a safe haven from which to launch attacks against the Damascus front. Hezbollah’s force was estimated to be in the hundreds and used UAVs and enhanced optics to locate and engage rebel fighters traversing the border area between Sunni support zones in the Lebanese town of Arsal and the villages in Syria.53 Forces stationed on both sides of the borders stand guard in outposts with approximately 30 fighters each located at two mile intervals. In addition to the disruption efforts in the hills and villages, Hezbollah forces also conducted reconnaissance operations within the population centers to locate suspected improvised explosive devices (IED) destined for Hezbollah strongholds in Lebanon. Ground reconnaissance in Syria is not only conducted by regular forces and special purpose forces, it includes a large and growing number of irregular forces and fighters from Hezbollah, and technical advisors from Syrian allies such as Iran and Russia. Additionally, militia fighters from the NDF, provided a wide range of security support including reconnaissance. For example, gathering intelligence. The shaping operations in Qalamoun were part of a larger disruption effort to flush out opposition fighters from key towns along the Lebanon Syria border including Yabrud in Syria. Hezbollah was successful in disrupting rebel troops and supplies as it moved into Syria, providing eyes and ears for Syrian government forces, and acting as forward observers for indirect fires. Fires included a combination of conventional and improvised rocket assisted munitions (IRAM) known as “volcanos” against rebel strongholds inside the towns and surrounding villages.54 Throughout the region Hezbollah forces deployed of troops in an effort to fill in the gaps for Syria’s regular military. 81 UNCLASSIFIED

Threat Tactics Report: Syria

Figure 3. Syrian army and irregular forces disruption zone (example)

The Battle for Hama In early 2014 the Syrian government’s Syrian Arab Army (SyAA) with help from local militias including the National Defense Forces (NDF) were able to protect the airbase from opposition forces in Hama’s capital and the surrounding area and allow operations to continue. 55 The Hama airbase, a key component of the Syrian government’s air campaign, flew an estimated 15 fixed-wing and rotary-wing aircraft sorties out of the facility daily.56 The city of Mhardah, a predominantly Christian city, contains one of the largest electrical power plants in the country providing an estimated seven percent of Syria’s electrical power and was defended by a local Christian militia. Additionally, there was a suspected barrel bomb facility near Hama city.57 Not only did Hama hold the airbase, the province supported a number of army bases, contained several ammunition depots, and served as a key logistics hub to support governmental forces fighting north in Aleppo. Defense of Hama The Syrian regime maintained an area defense using both regular and militia troops at military installations and area villages. The Syrian governmental forces designed their area defense to deny key areas to the opposition including two major highways, the Mharda power plant, and the Hama airbase. In a war of attrition, the area defense is used to inflict losses on the enemy, while retaining ground and protecting combat power.58 The militia patrols had the responsibility to secure long stretches of highway, small villages, and quarters in Hama’s major cities. The defensive posture in Hama epitomized

82 UNCLASSIFIED

Threat Tactics Report: Syria

the Syrian regime’s “win by not losing strategy.” The regime conducted access control operations that traded time for the opportunity to attack the opposition when and where it is most vulnerable. The Opposition Attacks Opposition groups launched operation “Badr al Sham” against Hama province and the military structure supporting it. The opposition fighters established support zones and secured lines of communication in cities within Hama province’s boundaries that held large populations of Sunni sympathizers. The opposition forces designed perception management operations that highlighted the regime’s brutality against Sunnis to garner influence with the Sunni population and imposed fear on non-aligned parties as a means to maintain security and ensure support in these friendly areas. In southern Idlib and northern Hama provinces, opposition groups established support areas in Morek, Lataminah, and Kifr Zita. The opposition fighters infiltrated into , massing troops for offensive operations in villages along the Orontes River and the Hama Latakia highway.59 At the Serthel checkpoint, the opposition forces used captured Syrian army equipment to overrun the government force’s outpost.60 The Khattab ammunition depot fell in late July with opposition forces capturing ammunition in its crates, various artillery pieces, and some armored vehicles.61 Armed with captured Syrian equipment, the opposition force advanced to within four kilometers of the Hama airbase engaging the base with BM-21 grad missiles mounted on medium trucks.62 Counter Attack The Syrian government dispatched elements of the 4th armored division and a newly designated unit known as the Tiger Brigade to Hama to improve command and control among the Syrian government forces. In addition to these forces, the militias received augmentation by additional Iranian advisors and an array of foreign fighters coordinated by the Iranian IRGC. The Syrian air force dropped barrel bombs in opposition controlled areas such as Kifr Zita and Morek.63 In addition to the air campaign, the Syrian regime adopted more aggressive tactics to meet with and engage the enemy. The techniques employed were likely a result of the Iranian advisors’ suggestions to crack open opposition defenses with specially trained “line breaker” troops, which were fast-moving troops ordered to sweep ahead of armored vehicles and defeat antitank missile teams. These techniques were viewed by Syrian military officials as successful when Hezbollah used them in a regime offensive in the Qalamoun Mountains in 2013.64 Analysis of pro-Syrian regime videos shows small groups of 10 to 20 infantry attacking positions with support from heavy machine guns and tanks on the edges of population centers.65 Typically, ground forces advanced after rebel fighting positions were sufficiently degraded by aerial bombardment. Using preemptive strikes against concentrations of enemy troops and equipment as well as suspected support facilities such as medical clinics and food distribution sites, the air force isolated and attrited the rebel forces.66 The air force also targeted specific heavy weapons such as tanks and antiaircraft guns. Ground forces used mortars, artillery, and short range missiles against remaining opposition targets to dislodge the enemy from its positions and allow the infantry to close within the effective range of its small arms and anti-armor weapons.67 The pro-governmental forces used heavy weapons at maximum standoff distances to protect combat power. Artillery, improvised rocket assisted munitions, and multiple launch rocket systems shelled villages throughout the offensive operations, removing enemy defensive positions for the attacking forces and closing off escape routes for the opposition.

83 UNCLASSIFIED

Threat Tactics Report: Syria

In larger towns armored vehicles were cautiously moved close to the main battle zone to provide support for advancing infantry. T-55 main battle tanks (MBT), in coordination with dismounted observers, engaged opposition particularly well-defended fighting positions. Using heavy guns mounted on medium trucks, the regime forces fired on enemy positions and also acted as spotters for tanks to fire their main gun. Dismounted radio operators directed the tanks into fighting positions and oriented the guns to their target. The pro-government units only advanced after the threat was either destroyed or neutralized. Infantry cleared roads, patrolled ditches, and inspected culverts for IEDs in order to protect the tanks. The exploitation force cleared the fighting positions, defused booby traps, and performed site exploitation operations by taking images of enemy weapons, ammunition, and equipment left behind by the fleeing opposition fighters. This last step provided the Syrian government the evidence needed to support the claims of a large amount of foreign assistance to the anti- government opposition groups.

Figure 4. Syrian regime operations in Hama province 2014 (example)

Section 3: Syrian Weapons and Equipment

Most of the equipment on this list represents estimated pre-civil war equipment levels for the Syrian Government. As mentioned above, Syrian regular army units are at 50–70% strength. Information on many of the following platforms can be found in the 2014 Worldwide Equipment Guide.

84 UNCLASSIFIED

Threat Tactics Report: Syria

ARMY68 Armored Equipment in Service Artillery Systems in Service AT/SAM Weapons in Service T-72 Upgraded 122 82mm Mortar 200 AT-3 Sagger 3500 T-72M 1478 M-1943 120 mm Mortar 400 AT-4/5 350 T-62M / K 1000 M-160 160 mm Mortar 100 AT-10/15 Kornet 2,000 T-55 / T-54 2200 M-240 240 mm Mortar 10 Milan 200 T-55 ARV UNK M-1938 122 mm 150 SA-24 Strelets (Igla-S) 32 BMP-1 2450 D-30 Howitzer 122 mm 500 SA-7 Grail UNK BMP-2 100 M-46 130 mm 800 SA-14 Gremlin UNK BRDM-2 950 D-20 152 mm 20 SA-16 Igla-1 UNK BTR-152 560 M-1937 152 mm 50 Sa-18 Igla UNK BTR- 50/60/70/152 1,040 S23 180 mm 10 BTR-4 26 2S3 152mm 50 ZSU-23 400 2S1 122mm 400 D-30 mntd on T-34 chassis 50 Tungunska-M1 6 ZU-23-2 650 M-1939 37 mm 300 S-60 57 mm 675 KS-19 100 mm 25 KS-12 85 mm 25 Type-63 107 mm MRL 200 BM-21 220 mm MRL 300 BM-27 Uragan 220 mm UNK MRL69

9A52-2 Smerch–M 280 UNK mm MRL70 ARMY AVIATION

Fixed Wing Aircraft in Service Rotary Wing Aircraft in Missiles in Service Service FROG Missile 18 Scud Launchers 24-36 Scud B Missile 200 Scud C Missiles 8 SS-21 Launcher 18 SS-21 Missile 36 SS-21 Scarab Missile 200 No Dong UNK

85 UNCLASSIFIED

Threat Tactics Report: Syria

SS-C 1B Sepal 4 SS-C-3 Styx 6 AIR FORCE

Fixed Wing Aircraft in Service Rotary Wing Aircraft in Missiles in Service Service Su-24 20 Mi-2 Hoplite 20 SA-2/3 Guideline 600 MiG-29 SMT 14 Mi-8 /171E 100 SA-3 Goa Su-22 90 Mi-25 Hind D 48 SA-5 Gammon 48 MiG-23 Bn 44 SA 342 Gazelle 42 SA-6 Gainful 200 MiG-21 170 SA-8 Gecko 60 MiG-23 90 SA-9 Gaskin 20 MiG-25 30 SA-11 Buk M1 UNK MiG-29 22 SA-13 Gopher 35 MiG-25R 6 SA-17 Buk M2 UNK MiG-21 H/J 8 SA-22 Pantsir 12 UAV Limited TOR M1 Gauntlet UNK Training 139 Transport 22 NAVY

Vessels Aviation Petya-III 2 Ka-28 Helix ASW 2 Helicopter OSA I and II 10 Mi-14 Haze ASW 13 Helicopter Patrol Craft 8 Mine Warfare Craft 5 Polnocny Amphibious 3

Section 4: Syrian Military Organization

Many in the midlevel leadership as well as many of the conscripts within the Syrian military were from the Sunni majority. As the conflict became increasingly sectarian, Sunni soldiers and officers defected or deserted the military. Alawite officers do not trust their Sunni soldiers and their personal security is provided by Alawites.71 Loyalty to the regime is a prized trait among the Syrian military’s current leadership. Although there are some exceptions, many high-ranking leaders are from the Alawite religious sect to which the president and his family belong. Even before the civil war, elite formations of special purpose forces, the republican guard, and certain heavy units such as the 4th Armored Division were predominantly Alawite in their makeup. Possibly for political purposes, there are a number of Sunni officials holding high-

86 UNCLASSIFIED

Threat Tactics Report: Syria

ranking positions in the . These units are used for offensive operations and for defending key elements of the Syrian government.

Figure 5. Military leadership of Syria72

Military Capabilities

Command and Control The Commander in Chief of the Syrian military is the president. Below the president is a traditional military structure similar to the Soviet military system. High-level ranks include the following:  General  Lieutenant General  Major General  Brigadier General  Colonel Ranks below colonel are the same as in most armies. There are three ranks among warrant officers. There are only six grades of enlisted ranks. The navy and air force are arranged similarly with the highest ranks being the equivalent of an army lieutenant general (vice admiral) and colonel general (general), respectively. Among the more elite units the rank structure follows the normal military lines. However, officers from these units are granted more authority due to their functions and social standing in Syrian society.

87 UNCLASSIFIED

Threat Tactics Report: Syria

Since the beginning of the civil war, Iranian influence is well-documented in the Syrian decisionmaking process. The current strategy of holding the provincial capitals as a show of governmental power is suspected by observers of the conflict as having Iranian origins, mainly from Iranian Quds Force Commander Major General Qassem Suleimani.73 The Syrian military’s ability to conduct combined joint operations is low due to a number of factors including distrust among regular units, obsolete equipment, and a lack of confidence in the other services besides the army.74 However, the current conflict is forcing the military to adopt new approaches to exercising command and control over a multinational, unevenly-trained force. One example is to attach less-reliable regular army units and national defense forces to loyalist command and control structures.75 This allows commanders to have more combat power and to maintain discipline with loyalists in key leadership positions. This command and control technique was reportedly used in al Qusayr when elements of Hezbollah retook the town using Syrian governmental units in support. Maneuver As a predominantly heavy armored force, the Syrian army was not prepared with the proper tactics and force structure to fight a guerrilla-based insurgency.76 Seize and starve tactics that were designed to isolate the enemy in its safe havens were only moderately effective. The humanitarian toll of these types of operations had a detrimental effect on governmental forces’ ability to gain support from fence- sitters both in the area of operations and in the world of public opinion. Armored operations in urban areas were unsuccessful when executed without proper terrain analysis and infantry support. As a result, Syria suffered significant losses to its most advanced main battle tanks. Consequently, Syrian military leaders have sought to integrate light forces with armor to attempt to reduce anti-armor capabilities before committing tanks to the attack. INFOWAR The Syrian Regime is adept at using a variety of cyber-related techniques to gain intelligence and influence and inform both support and opposition groups. Social media was recognized early on as an outlet that needed to be monitored and controlled in order for the regime to influence events on the ground. After a series of nuisance attacks that included website defacement and propaganda campaigns of social media outlets, the Syrian regime has steadily improved its abilities to penetrate high-profile websites. In 2013 a news feed from a respected news outlet falsely reported an attack on the White House. As recently as June of 2015, western media attributed a crash on a US Army website to the . Computer security firm Fireye also reported on a concerted effort by the Syrian regime to hire pro- government computer trolls to find and exploit Syrian opposition fighters. The report explained how regime hackers used avatars of single women to lure fighters into an image exchange in which they were able to install malware. The avatar images were actually Trojans that contained the remote administrative tool Dark Comet and allowed regime hackers to access the opposition’s computers.77 Propaganda is a major element of the Assad regime’s ability to control information and to propagate themes and narratives that support the government’s brand of secular Arab nationalism. The regime has capitalized on the widespread use of social media and other new forms of information technology to

88 UNCLASSIFIED

Threat Tactics Report: Syria

manipulate public opinion by allowing disinformation to spread to the point where it is difficult for target audiences to distill fact from fiction. In practice, the Syrian regime attempts to focus on the brutal activities of the opposition and to maintain the narrative of a stable and legitimate central government in Syria. President Assad conducted an interview with western media in which he declared that his regime is defending itself against terrorism and highlighted efforts to engage opposition groups in independent negotiations. This control leveraged on all forms of media, including traditional mass media and new social media, has allowed the regime to foster claims of legitimacy by discrediting opposing views. Another propaganda element is the National Defense Force (NDF). Civilians taking a proactive role in the defense of Syria is an example of loyalty to the state. President Assad explained his views in a recent speech, saying, “Syria is not for those who live in it or those with Syrian citizenship; it is for those who defend it.” The effect it has on the NDF fighters, their families, and neighbors is twofold depending on what side a person is on in the Syrian civil war. For those against the regime, the NDF is illustrative of just how far the rebellion has to go before it can be successful. If the regime continues to absorb recruits then it is likely that the war will last a long time. For those that are pro-regime, NDF fighters represent security at the lowest level and the legitimacy of President Assad’s government. This sense of national identity is a part of the propaganda campaign that has allowed the Syrian regime to stay in power. RISTA All Syrian maneuver units have the ability to execute a reconnaissance mission to support the overall objective. The reconnaissance force could include a mix of elements from any of the regular divisional or independent infantry and armored brigades, or special purpose forces regiments.78 Tactical units may also send out independent reconnaissance patrols (IRPs) to perform ground reconnaissance. The size of such patrols can vary, but in today’s fight the Syrian army usually opts for a reconnaissance or combat arms platoon, often augmented with Hezbollah or other irregular light infantry and engineers. In theory, Syrian special purpose forces (SPF) may form additional IRPs, or their personnel and vehicles can supplement patrols formed by other reconnaissance or combined arms units. In the early days of the current Syrian conflict, Syrian SPF patrols located and eliminated opposition leaders suspected of radicalism within contested areas. Before the civil unrest began, however, the Syrian SPF units supported border security operations and guarded sensitive defense facilities throughout the country.79 While many SPF units provided intelligence and information on external threats to Syria, some SPF units were not prepared to conduct counterinsurgency operations against their own populations. This led to a number of defections not just among the ranks of the special purpose forces but in the regular forces as well. Most of the SPF were considered among the most loyal of the Syrian armed forces and President Assad allocated to them the best weapons as well as support from the Syrian security apparatus. Reconnaissance forces geared for border security, such as the 14th Special Forces Division, received the mission of canalizing attacking forces into conventional forces engagement zones.80 These experiences were useful for interdicting rebel forces attempting to cross into Syria with men and materiel. Fire Support Syria has a large number of indirect fire equipment including mortars, self-propelled artillery, and towed artillery pieces. Additionally, the air force provides air support to ground forces and conducts independent operations against remote targets. The Syrian government’s use of chemical weapons has

89 UNCLASSIFIED

Threat Tactics Report: Syria

been noted and, despite efforts to discontinue their use, it is questionable whether or not there are more weapons available for future use. 81 Fires by both artillery and rockets as well as by attack aircraft are an important element of the Syrian government forces’ offensive and defensive tactics. In Syria’s urban combat theaters (Aleppo, Damascus, Homs), controlling and holding high ground has been fundamental. Tunnel blasts are one of the few ways to successfully counteract the adversary’s control of high ground in this conflict. In most cases fires are used to degrade and displace enemy positions before ground forces attempt an assault. Reports of the use of advanced Russian multiple rocket launchers and aircraft to deliver a range of munitions, including cluster bombs, is indicative of the Syrian government’s willingness to pursue specialized technology in order to prevent enemy freedom of maneuver and remain in power.82 Protection The use of improvised armor and berms in static fighting positions aids in the survivability of armored vehicles against anti-armor weapons. Additionally, the use of dismounted troops as observers for tank direct fire has allowed tanks to be more effective when establishing a situational defense. Syrian forces will also use heavy machine guns to suppress the enemy while tanks move into position to decisively engage enemy fighting positions. The NDF also provides protection for Syrian regular forces by identifying concentrations of enemy forces and establishing which quarters are most dangerous. As a local militia, the NDF is best suited for providing intelligence on enemy dispositions in its areas. In order to combat mines and booby traps, Hezbollah forces with special engineer training were used throughout the theater. The Syrian army uses specialized mine-clearing vehicles, known as MTK-2 Meteorit, to create mobility corridors using a thermobaric charge.83 Command and control techniques that assign sectors to various sections of an urban area of operations allow for limited engineer assets to methodically clear enemy fighting positions. The use of snipers to lay suppressive fires on known enemy locations has allowed follow-on forces to penetrate deeper into rebel-controlled sectors in relative confidence. Russian sniper rifles were used extensively in Aleppo, Homs, and Duma.84 Logistics At the strategic level, much of Syria’s support comes from Russian and Iran. In 2011 Syria signed a 4 billion dollar military aid package with Russia. 85 Supplies and spare parts are delivered via the sea ports in Tartus and Latakia as well as being flown in to the various air bases throughout the country.86 The roadways connecting the major cities and military installations throughout the country represent the lines of communication for the Syrian forces. The main Damascus and Aleppo highway connects the north and south of the country, as well as linking Damascus to the Alawite-dominated areas in the west. Hezbollah maintains bases and facilities in Lebanon and uses sea ports to bring in supplies from Iran. The border between Lebanon and Syria is porous, with men and materiel moving both in and out of Syria via known smuggling routes. Lines of communication from the Bekaa Valley in Lebanon to battlefronts in Damascus run through the Qalamoun Mountains and have been at the center of Hezbollah’s efforts in Syria since 2013.

90 UNCLASSIFIED

Threat Tactics Report: Syria

Remote military installations, including airbases, are supplied primarily by air—especially in areas with a significant rebel presence. In some cases supplies are air-dropped via parachute to Syrian governmental units.87 Air Defense The main perceived threat against Syrian airspace is from the . The Syrian air defense effort is one of the largest in the Middle East and consists of mainly Soviet-era technology. This includes a mix of tactical- and strategic-level surface-to-air missile (SAM) systems that provide redundant protection for Syrian airspace. Syrian air defense equipment has received a number of upgrades, including improved early-warning radar systems. The deployment of Syrian strategic SAMs is designed to defend against threat ingress routes focusing on major population centers, the coastal areas, and the southwestern part of the country. The air defense forces also possess a number of empty sites that are used to increase flexibility if missile systems need to be repositioned or if there is a need to take additional air defense systems out of storage in response to a threat. At least eight air defense sites have been compromised by rebel forces. The loss of these sites, especially in rebel-controlled areas along the Turkish border, could enable attacks from aircraft stationed in Turkey. UAVs Due to aircraft losses in the Syrian air force, investment in air defense and early warning systems has been redirected, at least temporarily, to the acquisition of systems such as UAVs. The situation has caused the Syrian regime to seek assistance from its allies and their proxies to locate and destroy an enemy that is familiar with the governmental forces’ tactics, techniques, and procedures.88 Syrian forces are known to use UAVs to provide intelligence on enemy locations and to assist in locating targets for artillery and air strikes.89 The use of UAVs provides situational awareness and preserves combat power that can then be used for decisive operations. Iran supported the Syrian regime by providing a wide array of UAV technology. Relatively-advanced platforms such as the Shahed-129, with a possible range of 200 km and an endurance of 24 hours, appear in insurgent videos.90 A recent video shows a Russian- made mini-UAV known as Eleron 3SV that was claimed to have been shot down by members of Jubhat al Nusra.91 Hezbollah fighters also used UAVs and enhanced optics to patrol potential enemy mortar point- of-origin sites aimed at security outposts and to locate and engage rebel fighters traversing the border area between Sunni support zones in the Lebanese Bekaa Valley and the village of Yabrud in Syria.92 Chemical Weapons The Syrian government maintains a chemical weapons program, which provides it with a strategic deterrent against perceived threat actors in the region. 93 The Syrian government did sign the Chemical Weapons Convention in 2013 after it was accused of using nerve agents in Khan al Assal and Al Qusayr.94 This spurred western governments to consider airstrikes and motivated the Syrian regime to reveal at least a portion of it chemical weapons facilities.95 In light of a series of major setbacks for the Syrian government, there is a chance that it could use hidden chemical weapons to ensure its survival. There are also examples of the Syrian government using toxic industrial chemicals such as chlorine against targets throughout the country. Barrel bombs loaded with chlorine have reportedly been utilized

91 UNCLASSIFIED

Threat Tactics Report: Syria

throughout the conflict and their use is being expanded as the Syrian government deals with having to protect political, military, and economic sites.96

Conclusions

Before the current civil war, the Syrian army was mainly a heavy ground force and thus not suited for urban combat. Conducting population- and resource-control operations from armored vehicle and tanks is difficult and sends the wrong message when the intent is to influence the population to reject rebel narratives and accept government authority. Syrian forces attacked population centers using antiaircraft guns and tanks to destroy suspected enemy positions with little regard for the civilians in the area. This type of heavy-handedness isolated populations and increased their resolve to fight against Syrian regular forces. Additionally, heavy weapons lacked the maneuverability to pursue lightly-armed insurgents in an urban battlefield. Hezbollah provided experienced fighters with recent combat experience against Israel to assist the Syrian army in areas where it was lacking the experience necessary to root out rebels in complex battle positions and safe havens throughout the cities of Syria. This assistance included reconnaissance, engineer support, snipers, and light infantry to augment Syrian heavy forces.

REAL-WORLD CONDITIONS APPLIED TO TRAINING

The TC 7-100 Hybrid Threat series, the Decisive Action Training Environment (DATE), and the Worldwide Equipment Guide provide training resources for applying real-world conditions to training. The tactics used by the Syrian army can be found as part of the composite threat model that exists in the Hybrid Threat Doctrine series. The Syrian army uses principles of offense and defense very similar to those present in TC 7-100.2 Opposing Force Tactics. Additionally, the operational environment outlined in DATE includes characteristics of the Hybrid Threat that can be modified to represent the actors currently associated with the Syrian army.  Most aspects of the Syrian military would be easy to replicate in a training environment.  The pro-government militias and other foreign fighters that support the Syrian regime can be replicated using the various irregular forces contained in DATE 2.2 with minor adjustments to capabilities. For example, certain units of the Syrian National Defense Forces could include elements from motorized, mechanized, and armored formations in the Hybrid Threat Force Structure.  The environmental conditions in Syria are complex and involve a wide array of actors with unique objectives. DATE 2.2 allows for this with the various irregular organizations present in Ariana, Atropia, Donovia, Gorgas, and Limaria.

Replication in Training Of the countries in DATE, the one that can most realistically replicate Syria from a capabilities perspective is Ariana. Like Syria, Ariana is a country intent on growing its national power through diplomatic, informational, military, and economic means. Recent years of economic sanctions have forced Ariana to develop military capabilities indigenously. Ariana is not a complete representation of

92 UNCLASSIFIED

Threat Tactics Report: Syria

Syria, however, due to how its military is equipped. In order to portray Syria in a training environment, Ariana’s military would need to include additional irregular forces. For information on how to build a force structure to conduct these actions, reference TC 7-100.4 Hybrid Threat Force Structure Organization Guide (Chapter 3, Section VIII “Building an OPFOR Order of Battle”). The table below contains excerpts from the TC 7-100.2 that define the tactical actions discussed in this report.

TC 7-100.2 Tactics 3-151. The purpose of an annihilation ambush is to destroy the enemy force. These are violent attacks designed to ensure the enemy’s return fire, if any, is ineffective. Generally, this type of ambush uses the terrain to the Offensive Operations Towards An Enemy On The Move attacker’s advantage and employs mines and other (Annihilation Ambush) obstacles to halt the enemy in the kill zone. The goal of the obstacles is to keep the enemy in the kill zone throughout the action. Using direct, or indirect, fire systems, the support element destroys or suppresses all enemy forces in the kill zone. It remains in a concealed location and may have special weapons, such as antitank weapons. 3-64. Integrated attack is an offensive action where the OPFOR seeks military decision by destroying the enemy’s will and/or ability to continue fighting through the application of combined arms effects. Integrated attack is Offensive Operations Towards An Enemy In The Defense often employed when the OPFOR enjoys overmatch with (Integrated Attack) respect to its opponent and is able to bring all elements of offensive combat power to bear. It may also be employed against a more sophisticated and capable opponent, if the appropriate window of opportunity is created or available. 4-62. In situations where the OPFOR is not completely overmatched, it may conduct a tactical maneuver defense. This type of defense is designed to achieve tactical decision by skillfully using fires and maneuver to destroy key elements of the enemy’s combat system and deny Mobile Defense (Maneuver Defense) enemy forces their objective, while preserving the friendly force. Maneuver defenses cause the enemy to continually lose effectiveness until he can no longer achieve his objectives. They can also economize force in less important areas while the OPFOR moves additional forces onto the most threatened axes.

93 UNCLASSIFIED

Threat Tactics Report: Syria

4-85. In situations where the OPFOR must deny key areas (or the access to them) or where it is overmatched, it may conduct a tactical area defense. Area defense is designed to achieve a decision in one of two ways:  By forcing the enemy’s offensive operations to Positional Defense (Area Defense) culminate before he can achieve his objectives.  By denying the enemy his objectives while preserving combat power until decision can be achieved through strategic operations or operational mission accomplishment.

Table 1. Excerpts from TC 7-100.2 Opposing Force Tactics Additional considerations for replicating Syria in training environments would be replicating Syria’s capabilities in five key areas. These areas are combined arms, CBRN, fire support including air support, INFOWAR, and SPF. Syria’s capabilities in these five areas are currently being used and are illustrative of Syria’s adaptive strategy. The chart below details how training centers could replicate a capability comparable to that of Syria.

Capability (What) Actor/Order of Battle (Who) Tactic (How)

INFOWAR Ariana has an INFOWAR brigade (section TC 7-100.2 Opposing Force Tactics Chapter 7 2C-9 of DATE) that can be used for FM 7-100.1 Opposing Force Operations INFOWAR replication. Chapter 5 To replicate Syria: Highlight strategic INFOWAR operations discussed in the TC.

RISTA Ariana has a very robust RISTA capability TC 7-100.2 Opposing Force Tactics Chapter 8 with a dedicated command. The order of FM 7-100.1 Opposing Force Operations battle of this command can also be found Chapter 6 in DATE section 2C-9. To replicate Syria: Place emphasis on militia, guerrillas, and INFOWAR capabilities.

Fire Support Ariana has a very powerful fire support TC 7-100.2 Opposing Force Tactics Chapter 9 capability. Its units are equipped with tier FM 7-100.1 Opposing Force Operations 1 fire support. To replicate Syria, a training Chapter 7 center could use Ariana’s fire support orders of battle; however, the systems To replicate Syria: Make prolific use of would need to be reduced to tier 2 “annihilation fire.” capability.

Air Defense Ariana has a robust air defense capability TC 7-100.2 Opposing Force Tactics Chapter made of primarily tier 2 systems. Arianian 11 air defense units can be used to replicate FM 7-100.1 Opposing Force Operations Syria’s air defense assets. Chapter 9 To replicate Syria: Highlight missile systems.

94 UNCLASSIFIED

Threat Tactics Report: Syria

SPF Syria has placed great emphasis on its SPF TC 7-100.2 Opposing Force Tactics Chapter capability in recent years and Ariana’s SPF 15 capability can sufficiently represent that of FM 7-100.1 Opposing Force Operations Syria’. Chapter 13 To replicate Syria: Highlight amphibious and airborne operations discussed in the FM.

Table 2. How to use doctrine to replicate Syria Related Products Follow these links to view related products:  Syria Quick Guide November 2012  Threat Report Jul 2012  The Battle for al Qusayr, Syria  Syrian Electronic Army (SEA) Targets Qatar See also the Red Diamond Newsletter, which contains current articles on a variety of topics useful to both soldiers and civilians ranging from enemy tactics and techniques to the nature and analysis of various threat actors. For detailed information on weapons and equipment, see the Worldwide Equipment Guide. To see more products from ACE Threats Integration, visit the Army Training Network (ATN) with CAC access: https://atn.army.mil/dsp_template.aspx?dpID=377.

POC

Author Jerry England 913-684-7934 (COMM) 552-7934 (DSN)

TRADOC G-2 Analysis and Control Element (ACE) Threats Integration 803 Harrison Drive, BLDG 467 Fort Leavenworth, KS 66027

Jon Cleaves, ACE-TI Director Jennifer Dunn, ACE-TI Deputy Director Jon Moilanen, ACE-TI Operations

95 UNCLASSIFIED

Threat Tactics Report: Syria

Note: Not all references listed in this publication are readily available to the public; some require a government common access card (CAC) to view.

References

Blanchard, Christopher, Carla Humud, and Mary Beth Nikitin. “Armed Conflict in Syria: Overview and U.S. Response.” Congressional Research Service. 17 September 2014. White, Jeffrey. “Hezbollah’s Declaration of War in Syria: Military Implications.” The Washington Institute. 29 May 2013.

Figure Credits

Figure 1. Syrian force structure. ACE-TI, 17 August 2015. Figure 2. Integrated attack on al Qusayr (example). ACE-TI, 17 August 2015. Figure 3. Syrian army and irregular forces disruption zone (example). ACE-TI, 17 August 2015. Figure 4. Syrian regime operations in Hama Province 2014 (example). ACE-TI, 17 August 2015. Figure 5. Military leadership of Syria. ACE-TI, 17 August 2015.

Endnotes

1 Anthony Cordesman. “If its Syria: Syrian Military Forces and Capabilities.” Center for Strategic and International Studies. 15 April 2003. 2 Joseph Holliday. “The Syrian Army: Doctrinal Order of Battle.” Institute for the Study of War. February 2013. 3 Global Security. “Syrian Arab Navy.” accessed 22 April 2015; Andre de Nesnera. “Syrian Air Force One of Middle East’s Largest.” Voice of America. 20 June 2012. 4 Anthony Cordesman. “Israel and Syria: The Military Balance and Prospects of War.” Center for Strategic and International Studies. 15 August 2007. 5 Institute for the Study of War. “Updated Syrian Air Force and Air Defense Capabilities.” 7 May 2013. 6 Jeffrey White. “Syrian Air Force Operations: Strategic, Effective, and Unrestrained.” The Washington Institute. 11 December 2014. 7 Chris Kozack. “'An Army in All Corners:' Assad’s Campaign Strategy in Syria.” April 2015. 8 Eli Lake. “Iran Spend Billions to Prop Up Assad.” Bloomberg Review. 9 June 2015. 9 Will Fulton, Joseph Holliday, and Sam Wyer. “Iranian Strategy in Syria.” Institute for the Study of War. May 2013. 10 Abigail Hauslohner. “Hezbollah’s Role in Syrian Civil War Drives Sectarian Tension in Lebanon.” Washington Post. 27 April 2013. 11 Marisa Sullivan. “Hezbollah in Syria.” Institute for the Study of War. April 2014. 12 1TVAfghanistan. “Captured Afghan Fighters in Syria say came via Iran for Money.” 25 April 2015; Christopher Reuter. “Death in Aleppo: A Group of Afghan Fighters Located in Syria.” Der Spiegel. 6 June 2014. 13 Ali Alfoneh. “Analysis: Shiite Afghan Casualties of the War in Syria.” Long War Journal. 12 March 2015. 14 Aymen Jawad Al Tamimi. “The Return of Iraqi Shi’i Militias to Syria.” Middle East Institute. 16 March 2015. 15 Aron Lund. “Who Are the Pro-Assad Militias?” Carnegie Endowment for International Peace. 2 March 2015. 16 Anne Barnard, Hwaida Saad, and Eric Schmitt. “An Eroding Syrian Army Point to Strain.” New York Times. 28 April 2015. 17 Manal Ismael and Hazem Sabbagh. “Decree Granting Amnesty on Deserters.” . 25 July 2015. 18 Anne Barnard, Hwaida Saad, and Eric Schmitt. “An Eroding Syrian Army Point to Strain.” New York Times. 28 April 2015. 19 Aron Lund. “Who Are the Pro-Assad Militias?” Carnegie Endowment for International Peace. 2 March 2015. 20 Nicholas Blanford. “Hezbollah Marks Major Triumph as Qusayr Tips Back into Assad Camp.” Christian Science Monitor. 5 June 2013. 21 Aram Nerguizian. “The Military Balance in a Shattered Levant.” 15 June 2015; Jack Moore. “Iranian Military Mastermind Soleimani Vows to Surprise World in Syria.” Newsweek. 3 June 2015. 22 Will Fulton, Joseph Holliday, and Sam Wyer. “Iranian Strategy in Syria.” Institute for the Study of War. May 2013. 96 UNCLASSIFIED

Threat Tactics Report: Syria

23 Alarabi Aljadid. “The Millions Checkpoints in Syria.” 13 April 2015. 24 Chris Kozack. “'An Army in All Corners:' Assad’s Campaign Strategy in Syria.” April 2015. 25 Nour Samaha. “The Battle for the Qalamoun Mountains.” 6 February 2015. 26 World Tribune. “Rebels Claim First Syrian Military Plane since Receiving SAMs.” 20 May 2014. 27 Aram Nerguizian. “The Military Balance in a Shattered Levant: Conventional Forces, Asymmetric Warfare & the Struggle for Syria.” Center for Strategic and International Studies. 15 June 2015. 28 Chris Kozack. “'An Army in All Corners: Assad’s Campaign Strategy in Syria.” April 2015; Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. 29 R.D. McLaurin. “Technical Memorandum 8-86: The Battle of Zahle.” US Army Human Engineering Laboratory. September 1986. 30 Oryx. “Syria’s Steel Beasts: The T-72.” Bellingcat. 14 December 2014. 31 R.D. McLaurin. “Technical Memorandum 8-86: The Battle of Zahle.” US Army Human Engineering Laboratory. September 1986. 32 Liveleak. “Iran’s Agony in Syria - Captured document reveals infighting, manpower shortage.” 7 July 2014. 33 Oryx. “Syria’s Steel Beasts: The T-72.” Bellingcat. 14 December 2015. 34 Jeffrey White. “Syrian Air Force Operations: Strategic, Effective, and Unrestrained.” The Washington Institute. 11 December 2014. 35 Aryn Baker. “Syria’s Civil War: The Mystery Behind a Deadly Chemical Attack.” Time. 1 April 2013. 36 Liam Stack. “Watching Syria’s War: Buildings Flattened in Attack on Northern Syrian Town.” New York Times. 15 August 2012; Y Net News. “Syrian Rebels Say Assad Using ‘Mass-Killing’ Weapons in Aleppo.” 10 August 2012. 37 Human Rights Watch. “Syria: Barrage of Barrel Bombs.” 30 July 2014. 38 Aron Lund. “Falling Back, Fighting On: Assad Lays Out His Strategy.” Carnegie Endowment for International Peace. 27 July 2015. 39 Al-Sharq al-Awsat Online. “Some 20 People Killed in Syrian Al-Qusayr Town, Demonstrations Held in Lebanon.” 13 August 2011. 40 Doha Al-Jazirah Satellite Channel Television in Arabic. “'Eyewitnesses' on Military Operation in Latakia; Casualties Reported.” 15 August 2011. 41 Agence France-Presse. “Syrian Activists Report Security Forces Enter Another Two Protest Hubs.” IJK News. 11 August 2011. 42 Doha Al-Jazirah Satellite Channel Television in Arabic. “Free Syria Army Officer on Army Role; General Commission Official on Hamah Events.” 11 December 2014. 43 James Bays. “Al-Qusayr: FSA’s Biggest Victory in Months.” Al Jazeera. 11 July 2012. 44 Beirut Naharnet in English. “Naharnet: Syria Opposition Says Hizbullah Fighters Massing in Qusayr: We Don't Want Nusra- Hizbullah Confrontation.” 12 April 2013. 45 Press TV. “Documentary: Al Qusayr Battle for Victory.” 5 November 2013. 46 Australian Associated Press. “Syrian rebels urged to join Qusayr battle.” 22 May 2013. 47 US Department of State. “On-Camera Daily Press Briefing Index.” US State Department Daily Press Briefing. 5 June 2013. 48 Nicholas Blanford. “Hezbollah marks major triumph as Qusayr tips back into Assad camp.” Christian Science Monitor. June 2013. 49 Marisa Sullivan. “Middle East Security Report 19: “Hezbollah in Syria.” Institute for the Study of War. 2014. 50 Nicholas Blanford. “The Battle for Qusayr: How the Syrian Regime and Hizb Allah Tipped the Balance.” CTC Sentinel. August 2013. 51 Naharnet Newsdesk. “Syria Opposition Says Hizbullah Fighters Massing in Qusayr: We Don't Want Nusra-Hizbullah Confrontation.” 11 April 2013. 52 Agence France-Presse. “Syrian forces storm rebel bastion of Qusayr.” 20 May 2013. 53 Nicholas Branford. “Hezbollah close to cutting off key route for Syrian rebels, refugees.” Christian Science Monitor. March 2014. 54 Stahlgewitter Syrien. “Qalamoun: Lebanese Hezbollah launches IRAM ‘Volcano’ against Nusra Front Positions.” YouTube. 31 May 2015. 55 Valerie Szybala with Chris Harmer. “Regime Air Activity in Hama: 1,800 Sorties in 50 Days.” Institute for the Study of War. 30 May 2014.

97 UNCLASSIFIED

Threat Tactics Report: Syria

56 Yalla Souriya. “#Syria, Sorties of warplanes and Helicopters in Northern hama.” 22 May 2014; Luftwaffe A.S. “Air Raids From Hama & Sh'eirat AFB's (1st Quarter 2014).” 8 April 2014. 57 Agence France-Presse. “Syria rebels advance on key airport in Hama province.” 29 July 2014. 58 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. 59 Tom Perry. “Syrian forces win battle with rebels in Hama.” Reuters. 12 September 2014. 60 YouTube. “Syria War Heavy Firefights and Clashes In Hama Syrian Civil War 2014! FSA VS SAA!” October 2014. 61 Scott Lucas. “Syria Daily, July 27: A Multi-Front Battle Between Assad’s Forces & Islamic State.” EA Worldview. 27 July 2014. 62 Syria: Direct. “Hama military airport key to controlling province.” 28 August 2014; Scott Lucas. “Syria Daily, July 30: Insurgents Close on Major Military Airport Near Hama.” EA Worldview. 30 July 2014. 63 Brown Moses. “Alleged Chemical Attack Tall as Sayyad.” YouTube. 28 August 2014. 64 Liveleak. “Iran’s Agony in Syria - Captured document reveals infighting, manpower shortage.” 7 July 2014. 65 Isham Ali Rasheed Al-Asheeri. “Syrian Arab Army & NDF advance in North Hama, Syria.” YouTube. 20 September 2014; Support Truth. “Syrian NDF Civilians 2014 Syrian Army Tribute.” YouTube. 15 December 2014. 66 Jeffrey White. Syrian Air Force Operations: Strategic, Effective, and Unrestrained. The Washington Institute. 11 December 2014. 67 Syria: Direct. “Syria Direct: News Update 9-9-14.” 9 September 2014. 68 Anthony Cordesman. “If its Syria: Syrian Military Forces and Capabilities.” Center for Strategic and International Studies. 15 April 2003; Army Recognition. “Syria Land Forces military equipment and vehicles Syrian Army.” 2015. 69 Brown Moses. “Evidence Of The Syrian Military Deploying BM-30 Smerch Launched Cluster Munitions.” 14 February 2014. 70 Brown Moses. “Evidence Of The Syrian Military Deploying BM-30 Smerch Launched Cluster Munitions.” 14 February 2014. 71 Euronews. “Insight: Battered by war, Syrian army creates loyalist paramilitary force.” 21 April 2013. 72 Jang Ji Hyang and Peter Lee. “Unknown Horror or Deliberate Indifference? A comparative analysis of Human Rights Violations in North Korea and Syria.” The Asan Institute for Policy Studies. 2014. 73 Will Fulton, Joseph Holliday, and Sam Wyer. “Iranian Strategy in Syria.” Institute for the Study of War. May 2013. 74 Anthony Cordesman. “If its Syria: Syrian Military Forces and Capabilities.” Center for Strategic and International Studies. 15 April 2003; Anthony Cordesman. “Israel and Syria: The Military Balance and Prospects of War.” Center for Strategic and International Studies. 15 August 2007. 75 Charles Lister. “Dynamic Stalemate: Surveying Syria’s Military Landscape.” Brooking Doha Center. May 2014. 76 Joseph Holliday. “The Assad Regime: From Counterinsurgency to Civil War.” Middle East Report 8. Institute for the Study of War. March 2013. 77 Daniel Regalado, Nart Villeneuve, and John Scott Railton. “Fireeye Threat Intelligence Behind The Syrian Conflict’s Digital Front Lines.” February 2015. 78 Richard Bennet. “The Syrian Military: A Primer.” Middle East Intelligence Bulletin. September 2001. 79 Richard Bennet. “The Syrian Military: A Primer.” Middle East Intelligence Bulletin. September 2001. 80 Joseph Holliday. “The Assad Regime: From Counterinsurgency to Civil War.” Middle East Report 8. Institute for the Study of War. March 2013. 81 Dow Jones Business News. “Assad Chemical Threat Mounts.” 29 June 2015. 82 C. J. Chiver. “Syria Unleashes Cluster Bombs on Town, Punishing Civilians.” New York Times. 20 December 2012; Brown Moses. “Evidence Of The Syrian Military Deploying BM-30 Smerch Launched Cluster Munitions.” 14 February 2014. 83 Robert Beckhusen. “Spotted—Al Assad’s Brutal Mine Clearing Tank in Syria.” War is Boring. 12 October 2014. 84 Haya Kheyto. “No One Safe in Syria’s Sniper War.” 5 December 2014. 85 Joseph Keechian. “What is Syrian Arab Army Military Capability?” Gulf News. 8 September 2013. 86 Jonathan Saul. “Exclusive: Russia steps up military lifeline to Syria's Assad.” Reuters. 17 January 2014. 87 YouTube. “Syria Air Supply Army Units Ar Raqqa AVI.” 2 December 2014. 88 Patrick Hilman. “Iran’s Drone War in Syria.” The Daily Beast. May 2014. 89 World Tribune. “Assad using drones from Iran, Russia against Syrian rebels.” June 2013. 90 Jeremy Binnie. “New UAV spotted over Damascus.” Jane’s. April 2013. 91 Oryx Blog. “From the to Syria, Russian Orlan-10 and Eleron-3SV drones in Syria’s Skies.” 21 July 2015. 92 Nicholas Branford. “Hezbollah close to cutting off key route for Syrian rebels, refugees.” Christian Science Monitor. March 2014.

98 UNCLASSIFIED

Threat Tactics Report: Syria

93 US Deputy Director of National Intelligence for Analysis. “Report to Congress on the Acquisition of Technology Relating to Weapons of Mass Destruction and Advanced Conventional Munitions.” 31 January 2010. 94 James Martin Center for Nonproliferation Studies at the Monterey Institute of International Studies. “Country Profile Syria Chemical.” Nuclear Threat Initiative. July 2014; Nicholas Blanford. “All Signs Point to no Lethal Chemical Weapon Attack in Syria.” Christian Science Monitor. 20 March 2013. 95 Dow Jones Business News. “Assad Chemical Threat Mount.” 29 June 2015. 96 World Tribune. “Report: Syrian Forces Believed Using Chlorine Bombs.” 15 May 2014; Dow Jones Business News. “Assad Chemical Threat Mounts.” 29 June 2015.

99 UNCLASSIFIED

THREAT ACTION REPORT: Al-Shabaab Janaale Attack

TRADOC G-2 ACE THREATS INTEGRATION

DECEMBER 2015

Threat Action Report

Purpose

 To inform the Army training community of the attack by al-Shabaab on Ugandan soldiers stationed in Janaale, Somalia, as part of the African Union Mission in Somalia (AMISOM).  To report on the increased size of recent attacks by al-Shabaab against targets in Somalia.  To demonstrate the connectivity among the tactics, threat doctrine, and conditions present in other training materials such as the Training Circular (TC) 7-100 series. Key Judgments

 Al-Shabaab fighters no longer conduct mainly squad- and platoon-size ambushes against AMISOM convoys or raids against outposts or convoys. Al-Shabaab is now attacking in company (+) size elements of approximately 200 fighters in its most recent attacks.  The more recent attacks are aimed at larger, fixed, and relatively isolated AMISOM bases.  This attack on 1 September occurred in limited visibility conditions that reduced the AMISOM forces’ ability to use drones and provide other aerial support.  Al-Shabaab isolated the target by destroying bridges along likely rescue routes that increased reaction time of any ground reinforcements.  Al-Shabaab attacked on the anniversary of the death of one of its leaders, Ahmed Abdi Godane. The group also claimed the attack was retaliation for the massacre of civilians at a wedding by AMISOM troops in Marka on 31 July 2015.  Al-Shabaab attempts to conduct an information warfare (INFOWAR) campaign via social media and traditional media outlets in conjunction with its kinetic attacks.

This (U) Threat Action Report (TAR) was produced in accordance with (U) Intelligence Community Directive Number 203: Analytical Standards (Effective: Jan 2015). This TAR was coordinated with:

 National Ground Intelligence Center (NGIC)— Ms. Sarah E. Adams  HQDA DCS G-2— Ms. Tiffany R. Graham  FMSO—Mr. Tom Wilhelm  AFRICOM— Mr. Wayne Fulton Comments and feedback are welcome.

Jon S. Cleaves Director, ACE–Threats Integration

102 UNCLASSIFIED

Threat Action Report

Introduction

On 1 September 2015, al-Shabaab fighters attacked the AMISOM base in Janaale, Somalia housing Ugandan soldiers serving as part of Ugabag 16, an element of the AMISOM forces. The Ugandan soldiers were initially forced to retreat, but after regrouping the AMISOM forces drove the attackers out of their base. The al-Shabaab fighters, however, took several Ugandan soldiers hostage and stole a number of heavy weapons and munitions. Al-Shabaab later paraded both the captured prisoners and equipment before cameras for propaganda purposes as part of its INFOWAR campaign.1 This attack on Janaale was the third attack on an AMISOM outpost in the previous few months. These attacks are a change from al-Shabaab’s normal tactic of conducting small squad- or platoon-size ambushes on AMISOM convoys or raids against isolated villages to obtain necessary military equipment and supplies to continue its struggle against the recognized Somali government. The change also resulted in a higher number of African Union (AU) casualties than in typical al-Shabaab attacks.

Operational Environment Background—Somalia

When Mohamed Siad Barre’s 20+ year rule ended in 1991, Somalia became an anarchy pitting warlords against each other, creating a safe haven for extremist groups such as al-Shabaab to flourish. After 14 transitional, international backed governments, a new constitution was finally approved in August 2012 and a new parliament created. The federal government of Somalia only holds nominal influence and responsibility over the southern portion of the country—however, the semi-autonomous state of Puntland is willing to become a federated state within that construct. In February 2007, the United Nations (UN) first authorized the AU to deploy a peacekeeping mission to support the nascent Somali Transitory Federal Institutions. The UN continues to extend the AMISOM mission, with the latest extension approved until 30 November 2015 with a maximum of 22,126 troops in country. The AMISOM soldiers come from Burundi, Djibouti, Ethiopia, Kenya, and Uganda. On 28 September 2015, Great Britain announced as many as 70 military personnel would go to Somalia to support AMISOM in its fight against al-Shabaab.2

Threat Actor Background—Al-Shabaab

The largest of the insurgent forces operating in Somalia is al-Shabaab, sometimes called Harakat a- Shabaab al-Mujahidin. Al-Shabaab is translated as “The Youth,” and the group refuses to negotiate with the Somali Federal Government as it sees itself as part of the same global struggle as Al-Qaeda (AQ). The aim of al-Shabaab is to create an Islamist state in Somalia under sharia law. The exact number of members fluctuate, however, it is believed there are between 3,000 and 8,000 active combatants. Al- Shabaab can also surge in numbers by calling on their fighters’ clan kinsmen. It is estimated there are about 300 to 800 hard-core believers. Many people belong to al-Shabaab for financial or economic reasons. The average Somali earns less than a $1 a day, assuming they can find work, and as such are desperate for an income.

103 UNCLASSIFIED

Threat Action Report

Figure 1. Map of Somalia showing locations of Janaale and Leego attacks, Central Intelligence Agency (CIA) modified by TRADOC G2 ACE-TI, 8 October 2015

In 2009–10, al-Shabaab controlled most of central and southern Somalia, but AMISOM forces began an offensive in February 2011 driving the group from Mogadishu by August 2011. Al-Shabaab chose not to make a final stand in many Somali cities the group controlled; instead the group opted to abandon Baidoa, Beledweyne, and Mogadishu seeking refuge in remote areas. Al-Shabaab, however, continues to sporadically make attacks in Mogadishu and some of the other larger cities in Somalia. For more information on al-Shabaab, see the Horn of Africa Operational Environment Assessment (OEA) and the “Al-Shabaab Update.”3

104 UNCLASSIFIED

Threat Action Report

Leego Attack

On 26 June 2015, approximately 200 al-Shabaab fighters attacked an AMISOM compound at Leego and began the attack with a suicide vehicle-borne improvised explosive device (SVBIED) ramming the gate. The Burundi AMISOM casualties totaled at least 50 soldiers killed and 60 people missing, including 20 Burundian soldiers. The total casualty numbers have not been officially released. After the SVBIED exploded at Leego, al-Shabaab fighters entered the Burundian compound shooting the soldiers, taking military equipment off the dead, and burning vehicles. The attack on the Janaale AMISOM compound occurred in almost the exact same manner.4

Janaale Attack

On 1 September 2015 at around 0530 hours local time, approximately 200 armed al-Shabaab fighters attacked the AMISOM base at Janaale, Somalia, where Ugandan and Somali soldiers lived. Over the next hour, fighting raged between the two sides until the attackers left in their getaway vehicles after completing the intended mission. This was the third major attack in a little over two months against an isolated, static AMISOM military compound. Besides Leego, al-Shabaab also attacked a Somali army outpost.5

Tactical Action Al-Shabaab’s Abu Zubeyr Brigade (or Battalion) of about 200 fighters initiated the assault at Janaale when one of its fighters killed himself by detonating an SVBIED at the entrance gate to the AMISOM base and the car bomb exploded. Almost simultaneously or a few minutes immediately beforehand, other groups prevented reinforcements from arriving by blowing up two bridges—one in Qoryooley and the other in Janaale. The destruction of the bridge in Janaale also made it more difficult for the Ugandan troops to escape the attack. Al- Shabaab further isolated the Ugandan military compound by cutting phone lines into and out of the village. The attack occurred simultaneously with a massive fog preventing AMISOM air assets, including drones, from coming to the Ugandan soldiers’ aid. The al- Shabaab fighters entered the compound through the blown gap in the base’s defenses or by removing razor wire obstacles. The attackers held a decisive advantage early on, not only because of the Figure 2. The Ugandan force did not have heavy weapons element of surprise, but because such as this tank that was used in the initial attack that much of the Ugandans’ heavy took Janaale infantry weapons, such as machine

105 UNCLASSIFIED

Threat Action Report

guns, had been recently removed to be used against Islamic extremists in other parts of the country. Additionally, the Ugandan soldiers failed to maintain proper security levels or institute adequate access procedures to the compound. After the approximately 100 Ugandan defenders conducted a “tactical withdrawal” to regroup, the AMISOM soldiers claimed to have driven the attackers off, but the attackers may have left because al-Shabaab accomplished what they set out to do.6 The entire raid took only approximately one hour before the attackers left the compound before any reinforcements could arrive. The attack caused much destruction, the loss of military equipment, and the kidnapping of several Ugandan soldiers to be used later in al-Shabaab propaganda videos.7 During the attack and afterwards, al-Shabaab claimed its force controlled the Janaale base, captured a large quantity of military supplies, and even took prisoners. The Ugandan force immediately denied all of al- Shabaab’s claims, many of which eventually turned out to be true. According to a Somali military official, it took 30 minutes for AMISOM units to Figure 3. Janaale Perimeter Defense included prefabricated take control of one of the walls filled with dirt bridge sites. Local witnesses told the media some AMISOM soldiers jumped into the nearby river in an attempt to avoid being killed or captured. Other media reports indicated there were several wounded soldiers lying along the river after the raid ended. Late in the day, four helicopters were searching for approximately 40 missing soldiers. After the attack, al-Shabaab claimed its fighters killed anywhere between 50 and 80 of the AMISOM soldiers and their Somali partners living on the Janaale base in retaliation for AMISOM soldiers killing innocent Somali civilians at a wedding in Marka on 31 July 2015.8

Casualties The number of reported AMISOM casualties varied widely, ranging from only ten to as many as 80—as claimed by al-Shabaab. On the day of the attack, a former Somali government representative, Bashiir Badi Mohamed, told the media at least 50 AU soldiers were killed during the attack and the al-Shabaab fighters had made off with several weapons and an unknown amount of ammunition. A Somali official on the day of the attack told Voice of America at least 19 Ugandan soldiers were killed in action (KIA). Reports on 2 September 2015 from Western officials put the casualty figures at 50 AMISOM soldiers KIA and an additional 50 soldiers missing in action (MIA). On 3 September 2015, a Somali security service source told CNN at least 25 Somali soldiers had died in the attack at Janaale as well as 12 Ugandan soldiers. A Ugandan source, LTC Paddy Ankunda, confirmed the latter figure the same day, and ten of the dead Ugandan soldiers had already been evacuated to their home country. This brought the total to 37 soldiers who died during the defense of the Janaale outpost. Ankunda insisted all AMISOM forces were accounted for and none were MIA. At the same time Ankunda was quoting 12 Ugandan soldiers

106 UNCLASSIFIED

Threat Action Report

dead, sources in the Ugandan capital city, however, were giving out the casualty figures as nine Ugandan soldiers KIA and five wounded in action (WIA). Late on 3 September 2015, Ankunda was telling reporters in Somalia there were only ten Ugandan soldiers KIA and all had been returned to their home country. Ankunda even gave out the names of the ten dead soldiers. But on 7 September 2015, the Ugandan government listed the number of its soldiers KIA at Janaale as 11. A week after the attack, al-Shabaab continued to boast the group held several Ugandan soldiers as prisoners while the Ugandan government still insisted none of its soldiers were MIA. By 10 September 2015, the Ugandan government still asserted none of its soldiers were prisoners of war, but al-Shabaab may have taken some Ugandan uniforms during the Janaale raid and dressed its own soldiers in them for propaganda purposes.9 The issue of possible missing Ugandan soldiers came to a boil when family members attempted to retrieve their fallen kin’s bodies from the military for burial. Some family members saw their son’s name on the KIA list, but the soldier’s body was not on the plane. Other families received a body purported to be their son’s, but the relatives claimed the deceased soldier was not related to them. After so many complaints in such a short period of time, the Ugandan Figure 5. The Al Shabaab Flag used in Somalia government agreed to conduct DNA tests on the deceased soldiers to verify their identities. The Ugandan government finally changed its tune regarding casualty numbers when its president, Yoweri Museveni, admitted while visiting Japan that 19 Ugandan soldiers were killed at Janaale, many other AU soldiers suffered injuries, and six soldiers still remained unaccounted for by the AMISOM leadership. Despite the president’s admission on 12 September 2015 in Tokyo, other government representatives were still giving out lower casualty figures. Now over a month after the al- Shabaab raid, it is still impossible to determine the actual number of AMISOM casualties for the Janaale attack.10

Aftermath The fallout over the raid was almost immediate, as the Ugandan government and military looked to find a scapegoat for the fiasco at Janaale. By 8 September 2015, the Uganda Defense Ministry had indicted three senior military commanders for lapses in leadership, in that they had failed to properly defend the Janaale base and protect their soldiers. The officers brought up on charges included Colonel Bosco Mutambi, the 16th AMISOM Brigade Commander; Major Noel Mwesigye, the 13th Ugandan AMISOM Troops Commander; and Captain Swaibu Yusuf, the Janaale AMISOM Base Commander. The investigating officer was given only two weeks to complete his investigation after receiving the assignment the day the indictments were announced. Another media report, a week later, stated four Ugandan soldiers would be put on trial for failing to stop the al-Shabaab attack. This report contained no

107 UNCLASSIFIED

Threat Action Report

names, however, so it is not known if the three previously-named officers were part of this latest group to be brought up on charges, or an entirely new group.11

Figure 6. Janaale attack graphical representation. This is not an exact representation of what happened at Janaale, but embodies the key components of the attack based on available open sources

Analytical Assessment

 1 September 2015 was the one year anniversary of the air strike killing the al-Shabaab leader, Ahmed Abdi Godane. The Abu Zubeyr Brigade (or Battalion) is named in honor of Ahmed Abdi Godane. It is likely al-Shabaab chose to attack Janaale because of the significance of the date to the group.12  The Janaale attack is similar to the Leego attack on 26 June 2015 and represents a significant change in tactics for al-Shabaab fighters. Before these attacks and a couple of other high profile

108 UNCLASSIFIED

Threat Action Report

attacks over the last six months, al-Shabaab usually conducted squad- to platoon-size ambushes of AMISOM convoys or other small raids. Using a force of approximately 200 fighters, al- Shabaab is now attacking isolated but static AMISOM outposts in rural areas housing larger numbers of soldiers. The attacks against so-called “liberated” parts of Somalia demonstrate to the Somali civilian populace that al-Shabaab was not defeated and dispels the false sense of security in the government-controlled areas of the country.13  The most recent attacks are most likely attempts by al-Shabaab to counter claims the group has been severely weakened after its territorial losses in southern Somalia during “Operation Jubba Corridor. AMISOM launched Operation Jubba Corridor in the summer of 2015 as an attempt to degrade al-Shabaab’s capabilities in the Gedo, Bakool, and Bay regions of Somalia.”14  After the attack on the wedding party in Marka on 31 July, it is likely many Somali civilians turned against the AMISOM peacekeepers. This lack of trust probably reduced the amount of intelligence local civilians provided to AMISOM that could have tipped off the Ugandans that al- Shabaab may have been planning an attack at Janaale. The fear of the local civilians may have also reduced the number of patrols conducted by AMISOM forces further reducing intelligence collection efforts. After the Janaale attack, AMISOM abandoned several of its remote outposts, most likely for fear of another such al-Shabaab attack.15  The destruction of the two bridges caused additional delays in the ground movement of any AMISOM rescue force to Janaale. The heavy fog present, whether part of the planning or purely happenstance, prevented attack air support and the quick aerial transport of reinforcements to the AMISOM base. The poor road infrastructure and dense vegetation made it difficult for AMISOM ground forces to travel quickly to many parts of the country.16  The Janaale assault as well as the other attacks in 2015 may also expose weaknesses in the AMISOM forces as well as the Somalia National Army. These issues include a shortage of personnel, lack of helicopters, and poor coordination between the AMISOM contingents. Even with over 22,000 soldiers, that number of military personnel is not enough to adequately provide security for the entire southern part of Ethiopia. AMISOM lacks rapid reaction forces and helicopters normally found in other peacekeeping operations. While not found in open sources for Janaale, it took over 48 hours for AMISOM reserve forces to reach Leego after the attack even though Ugandan soldiers were only 30 km away at an airport and an Ethiopian military unit was within 70 km. Some of the slow movement was due to the fear of al-Shabaab ambushes along any ground routes to Leego. Whether coincidental or planned by al-Shabaab, the Ugandan military lacks organic troop transport or attack helicopters in Somalia. The Ethiopian and Kenyan AMISOM units operate both attack and transport helicopters. While the Kenyan AMISOM units operate only a few helicopters, Kenyan soldiers can call upon fighter jets flown by the Kenyan Air Force for close air support. Even though the Ugandan forces can call on air support, it is not their own helicopters or planes. Six countries form the core of AMISOM. While each contingent’s leader reports to the AMISOM commander, the contingent leader often seeks orders from its home country’s leaders. The various militaries comprising AMISOM do not even coordinate with each other for reinforcement if another country’s unit is attacked, creating a lack of synergy in the efforts to defeat al-Shabaab.17

109 UNCLASSIFIED

Threat Action Report

 While the Ugandan soldiers fought to the best of their abilities, it is likely most of those at Janaale were poorly trained, poorly led, and had low morale. The trial of several of the Ugandan AMISOM leaders attest to the fact the government felt its officers did not do all they could to prevent the Janaale attack. The almost exact replication of the Leego attack at Janaale indicates the Ugandan chain of command did not take seriously any lessons learned from the earlier attack, and exemplifies possible incompetence of the AMISOM officers.18  The low morale among some of the Ugandan soldiers serving on the AMISOM mission could be partially blamed on the lack of pay as reports indicated some peacekeepers had not received a paycheck in nine months. The Ugandan spokesman, LTC Paddy Ankunda, denied the truthfulness of this media story, as the Ugandan army was only five months in arrears to its AMISOM unit members. Ankunda blamed the lapse in payments on the UN for its failure to fund the approved AMISOM contingents. The UN pays Uganda $1,028 for each soldier, but the Ugandan government skims $200 from each soldier as an administrative fee, leaving a monthly take-home salary of $828. Whether the Ugandan government was nine months or only five months behind in compensation to the AMISOM units, the soldiers were unpaid for months. Since Uganda does not border Somalia directly, both the Ugandan government and its soldiers may be both involved with AMISOM for primarily financial gain.19

TRAINING IMPLICATIONS

The Janaale attack is an almost textbook example of an opposition force (OPFOR) raid, as found in TC 7- 100.2, Opposing Force Tactics. The al-Shabaab fighters used a raiding element, a security element, a support element, and an information warfare (INFOWAR) element. While al-Shabaab probably does not call each of its elements by these names, the actions of each unit performed the functions of the OPFOR elements as written in TC 7-100.2.

 While detonating an SVBIED would be difficult to simulate in a training environment, all other aspects of this type of raid could be conducted at a combat training center (CTC) or during home station training.  The size of the attack—200 in the main body plus additional forces—may be difficult to replicate at local training areas. A similar attack scaled down for the size of the force being trained, however, could be conducted in home station exercises.

110 UNCLASSIFIED

Threat Action Report

Related Products

Follow these links to view related products:  OEA 6 Horn of Africa: This Operational Environment Assessment from October 2013 covers seven countries in the Horn of Africa region including Somalia.  Al-Shabaab Update: This November 2012 Threat Report covers al-Shabaab’s activities up to the publication date.  Somalia Hotel Bombing: This March 2014 Threat Report covers the explosion on 1 January 2014 at the Jazeera Hotel in Mogadishu, Somalia, claimed by al-Shabaab. See also the Red Diamond Newsletter, which contains current articles on a variety of topics useful to both soldiers and civilians ranging from enemy tactics and techniques to the nature and analysis of various threat actors. Some Red Diamond articles that may relate to al-Shabaab include:  Boat Operations—Nigeria and Somalia: May 2013  Al-Shabaab Attack on the Westgate Mall: Nairobi, Kenya: October 2013  Somalia: Military Variable Highlights: November 2013  Al-Shabaab Update: November 2012  Irregular Forces Financing Handbook: March 2012  Update: al-Shabaab: January 2012 For detailed information on weapons and equipment, see the Worldwide Equipment Guide. To see more products from TRADOC G-2 ACE Threats Integration, visit the Army Training Network (ATN) with CAC access: https://atn.army.mil/dsp_template.aspx?dpID=377#ta

POC

H. David Pendleton 913-684-7946 (COMM) 552-7946(DSN)

TRADOC G-2 Analysis and Control Element (ACE) Threats Integration 803 Harrison Drive, BLDG 467 Fort Leavenworth, KS 66027

Note: Not all references listed in this publication are readily available to the public; some require a government common access card (CAC) to view.

111 UNCLASSIFIED

Threat Action Report

References

Bryden, Matt. “The Reinvention of Al-Shabaab: A Strategy of Choice or Necessity.” Center for Strategic & International Studies (CSIS). February 2014. Feldman, Robert L. “Why Uganda Has Failed to Defeat the Lord’s Resistance Army.” Defense & Security Analysis Vol. 24. No. 1, pp 45-52. March 2008. Feldman, Robert L. “Problems Plaguing the African Union Peacekeeping Forces.” Defense & Security Analysis Vol. 24. No. 3, pp 267-279. September 2008. Marchal, Roland. “A Tentative Assessment of the Somali Harakat Al-Shabaab.” Journal of Eastern African Studies. 1 November 2009. Menkhaus, Ken. “The Crisis In Somalia: Tragedy In Five Acts.” African Affairs, 106/204, pp 357-390. Turbiville, Graham, Josh Meservey, and James Forest. “Countering the al-Shabaab Insurgency in Somalia: Lessons for U.S. Special Operations Forces.” Joint Special Operations University Report 14-1. February 2014.

Endnotes

1 Risdel Kasasira. “UPDF in Somalia not paid for nine months.” Kampala Daily Monitor in English. Via Open Source Center. 6 September 2015. 2 African Union Mission in Somalia. “Brief History.” Undated; African Union Mission in Somalia. “AMISOM Military Component.” Undated; BBC, “British troops for Somalia peacekeeping mission.” 28 September 2015. 3 Jane’s. “Somalia > External Affairs.” 25 May 2012; BBC. “In prison with al-Shabaab: What drives Somali militants?’ 5 October 2013; BBC. “Somali defector: Why I left al-Shabaab.” 20 May 2015; Holly Yan. “What is Al-Shabaab, and what does it want?” CNN. 23 July 2015; Duncan Miriri, Abdi Sheikh, Abdirahman Hussein, and Feisal Omar. “Al-Shabaab attacks hotels in Somali capital, six civilians killed.” 10 July 2015. 4 Jennifer Keltz. “Al-Shabaab Attacks AMISOM Base in Leego, Somalia.” Center for Security Policy. 26 June 2015; Voice of America (VOA). “Al-Shabaab Attack Kills Scores of AU Soldiers.” 26 June 2015; 5 Jennifer Keltz. “Al-Shabaab Attacks AMISOM Base in Leego, Somalia.” Center for Security Policy. 26 June 2015; Voice of America (VOA). “Al-Shabaab Attack Kills Scores of AU Soldiers.” 26 June 2015; AlJazzera. “Al-Shabaab claims ‘scores’ killed in attack on AU troops.” 1 September 2015; The Guardian. “Al-Shabaab kills dozens of African Union troops at base in Somalia.” Agence France-Presse (AFP). 26 June 2015; Isaac Mugabi. “Somalia: Amisom Morale ‘Is High.’” allAfrica. 1 September 2015; Al Jazeera (Doha). “Somalia: Al-Shabaab Claims ‘Scores’ Killed in Attack on AU Troops.” allAfrica. 1 September 2015; Risdel Kasasira. “Al-Shabaab Attack UPDF Amisom Base.” allAfrica. 2 September 2015. 6 Mohammed Ibrahim. “Qaeda-Affiliated Group Overruns African Union Base in Somalia.” The New York Times. 1 September 2015. 7 AlJazzera. “Al-Shabaab claims ‘scores’ killed in attack on AU troops.” 1 September 2015; AMISOM. “AMISOM condemns the attack on its base at Janaale, Lower Shabelle Region, Somalia.” Press Release. 1 September 2015; BBC World Service, “Somalia: Al-Shabaab Kills Scores of AU Forces in Janaale, AMISOM Condoles With Ugandans.” Via Open Source Center. 1 September 2015; BBC World Service in Swahili. “Al-Shabaab Claims Killing Scores of AU Troops at Janaale Base, AMISOM Says Repulsed Attackers.” Translated by Open Source Center. 1 September 2015; Mohammed Ibrahim. “Qaeda-Affiliated Group Overruns African Union Base in Somalia.” The New York Times. 1 September 2015; BBC. “Somalia attack: Al- Shabaab attacks African Union Janale base.” 1 September 2015; Feisal Omar and Abdi Sheikh. “Islamist militants attack African Union base in southern Somalia.” Reuters. 1 September 2015; Al Jazeera (Doha). “Somalia: Al-Shabaab Claims ‘Scores’ Killed in Attack on AU Troops.” allAfrica. 1 September 2015; Mogadishu Jowhar.com in Somali. “Somalia: AMISOM Reportedly Continues Search For Missing Soldiers in Janaale After Al-Shabaab Attack.” Translated by Open Source Center. 2 September 2015; Abdi Guled. “Residents: Dead bodies lay inside African Union military base after Somalia attack.” Associated Press (AP). 2 September 2015; Robyn Kriel and Briana Duggan. “Military Sources: Al-Shabaab attack in Somalia kills dozens of AU troops.” CNN. 3 September 2015; Radioandalus.com in Somali. “Somalia: Leaked Western Commanders Report Claims 50 Ugandan Troops Killed, 50 Others Missing. Translated by Open Source Center. 2 September 2015; allAfrica, “Somalia: Al Shabaab Displays Slain Amisom Soldiers in Janaale Attack, 7 September 2015; Uganda News.Net. “Al Shabaab Displays Slain Amisom Soldiers in Janaale Attack.” allAfrica. 8 September 2015; Somalia Newsroom. “Al-Shabaab Continues Mass Raid Tactics Against AMISOM.” 2 September 2015.

112 UNCLASSIFIED

Threat Action Report

8 AlJazzera. “Al-Shabaab claims ‘scores’ killed in attack on AU troops.” 1 September 2015; BBC World Service, “Somalia: Al- Shabaab Kills Scores of AU Forces in Janaale, AMISOM Condoles With Ugandans.” Via Open Source Center. 1 September 2015; BBC World Service in Swahili. “Al-Shabaab Claims Killing Scores of AU Troops at Janaale Base, AMISOM Says Repulsed Attackers.” Translated by Open Source Center. 1 September 2015; Mohammed Ibrahim. “Qaeda-Affiliated Group Overruns African Union Base in Somalia.” The New York Times. 1 September 2015; BBC. “Somalia attack: Al-Shabaab attacks African Union Janale base.” 1 September 2015; Cape Town News24. “Al-Shabaab Captures Au Military Base In Somalia.” Via Open Source Center. 1 September 2015; 8 Milton Grant. “Somalia: Deadly Al-Shabaab Raid Kills ‘50’ AU Soldiers.” allAfrica. 1 September 2015; Isaac Mugabi. “Somalia: Amisom Morale ‘Is High.’” allAfrica. 1 September 2015; Mogadishu Jowhar.com in Somali. “Somalia: AMISOM Reportedly Continues Search For Missing Soldiers in Janaale After Al-Shabaab Attack.” Translated by Open Source Center. 2 September 2015; Boosaaso Horseed Media Online in Somali. “More than 60 AU Somalia troops missing after deadly Al-Shabaab attack.” Translated by Open Source Center. 2 September 2015; BBC. “Ugandan bodies flown home after Somalia al-Shabaab attack.” 3 September 2015; Horseed Media. “Somalia: Al-Shabaab say attack on AMISOM base was retaliation of civilian massacre.” 1 September 201; allAfrica. “Somalia: Al Shabaab Displays Slain amisom Soldiers in Janaale Attack.” 8 September 2015. 9 Milton Grant. “Somalia: Deadly Al-Shabaab Raid Kills ‘50’ AU Soldiers.” allAfrica. 1 September 2015; Radioandalus.com in Somali. “Somalia: Leaked Western Commanders Report Claims 50 Ugandan Troops Killed, 50 Others Missing. Translated by Open Source Center. 2 September 2015; Abdi Guled. “Residents: Dead bodies lay inside African Union military base after Somalia attack.” Associated Press (AP). 2 September 2015; Robyn Kriel and Briana Duggan. “Military Sources: Al-Shabaab attack in Somalia kills dozens of AU troops.” CNN. 3 September 2015; Kampala Daily Monitor Online in English. “Twelve Ugandan soldiers killed in Somalia’s Al-Shabaab attack, army says.” Via by Open Source Center. 3 September 2015; Kampala Daily Monitor Online in English. “Uganda army chief flies to Somalia following Al-Shabaab attack on AU troops.” Via Open Source Center. 3 September 2015; BBC. “Ugandan bodies flown home after Somalia al-Shabaab attack.” 3 September 2015; Reuters. “Uganda says 12 of its soldiers killed in Islamist attack in Somalia.” 3 September 2015; Kampala The New Vision Online in English. “Uganda vows ‘appropriate response’ to Al-Shabaab attack as it names victims.” Via Open Source Center. 4 September 2015; allAfrica, “Somalia: Al Shabaab Displays Slain Amisom Soldiers in Janaale Attack, 7 September 2015; Radioandalus.com in Somalia, “Somalia: Al-Shabaab Reportedly Holding Ugandan Soldiers Captive,” Translated by Open Source Center. 8 September 2015; Somalia Memo in Somali, “Al-Shabaab says holding Ugandan soldiers in Somalia.” Translated by Open Source Center. 8 September 2015; London Universal Online in Somali. “Uganda Military Denies Al-Shabaab Claims of Holding Its Soldiers as Prisoners.” Via Open Source Center. 10 September 2015; Voice of America. “19 AU Soldiers Killed in Somali Al-Shabaab Attack.” 1 September 2015. 10 Radioandalus.com in Somali, “Uganda: Families Searching for Missing Kin Bodies Killed in Janaale.” Translated by Open Source Center. 9 September 2015; Nairobi Warqaad in Somali. “Ugandan President Says 19 Soldiers Killed, Several Injured, Six Missing in Somalia.” Translated by Open Source Center. 10 September 2015; Radioandalus.com in Somali, “Ugandan President Reportedly Admits Al-Shabaab Killed 19 Soldiers, Six Missing From Janaale Attack.” Translated by Open Source Center. 12 September 2015 11 Mogadishu Radio Kulmiye Online in Somali. “Uganda’s Military Interdicts Top Military Commanders Over Al-Shabaab Janaale Attack on 1 September.” Translated by Open Source Center. 8 September 2015; Mogadishu Radio Kulmiye Online in Somalia, “Uganda to Try Four Soldiers For Laxity on Duty in Somalia Following Deadly Shabaab Attack.” Translated by Open Source Center. 15 September 2015. 12 Mohammed Ibrahim. “Qaeda-Affiliated Group Overruns African Union Base in Somalia.” The New York Times. 1 September 2015; Robyn Kriel and Briana Duggan. “Military Sources: Al-Shabaab attack in Somalia kills dozens of AU troops.” CNN. 3 September 2015; Simon Allison. “RSA Article Examines Implications for AU Mission of al-Shabaab Attack on Military Base.” Johannesburg The Daily Maverick in English via Open Source Center. 3 September 2015; allAfrica, “Somalia: Al-Shabaab Has Changed Its Tactics. Amisom Must Do So Too.” 9 September 2015; allAfrica. “Uganda: UPDF Under Attack.” 14 September 2014. 13 allAfrica, “Somalia: Al-Shabaab Has Changed Its Tactics. Amisom Must Do So Too.” 9 September 2015: Simon Allison. “Analysis: Al-Shabaab’s revenge sparks another crisis in Somalia.” Hiiraan online. 3 September 2015. 14 Mahadaay Weyn, “Amisom: Operation Jubba Corridor in Somalia.” 25 July 2015. 15 Abdi Sheikh and Feisal Omar. “Al-Shabaab militants retake Somali town from African Union.” 6 September 2015; Abdi Sheik and Fesial Omar. “Al-Shabaab militants seize two towns in southern Somalia.” 5 September 2015. 16 Robyn Kriel and Briana Duggan. “Military Sources: Al-Shabaab attack in Somalia kills dozens of AU troops.” CNN. 3 September 2015.

113 UNCLASSIFIED

Threat Action Report

17 Voice of America. “Al-Shabab Attacks Expose AMISOM Weaknesses.” 1 July 2015; Robyn Kriel and Briana Duggan. “Military Sources: Al-Shabaab attack in Somalia kills dozens of AU troops.” CNN. 3 September 2015. 18 Coastweek.com. “Soldiers fought well at Janaale says AMISOM Force Commander.” 7 October 2015. 19 Risdel Kasasira. “UPDF in Somalia not paid for nine months.” Kampala Daily Monitor in English. Via Open Source Center. 6 September 2015; 9 September 2015; allAfrica. “Uganda: UPDF Under Attack.” 14 September 2014.

114 UNCLASSIFIED

THREAT ACTION REPORT: Battle for Sinjar, Iraq

TRADOC G-2 ACE THREATS INTEGRATION

APRIL 2016

Threat Action Report

Purpose  To inform the Army training community of the Islamic State in Iraq and the Levant (ISIL) occupation of Sinjar and the subsequent Kurdish retaking of the city by a variety of Kurdish forces.  To report on tactics and techniques used by ISIL in the Sinjar area.  To demonstrate the connectivity among the tactics, threat doctrine, and conditions present in other training materials such as the Training Circular (TC) 7-100 series. Executive Summary  In the summer of 2014, ISIL forces pushed Peshmerga forces from key areas in Nineveh province, Iraq, threatening the government seat of the Kurdistan Regional Government (KRG) in Erbil and capturing Mosul.  Pressure to respond to a growing humanitarian crisis, fueled by media coverage of Sinjar’s Yazidis fleeing ISIL violence, led to calls for an international response that included US and allied bombing of ISIL positions.  ISIL mitigated the effects of bombing by building a sophisticated network of tunnels that connected key buildings.  ISIL used marksmen, snipers, ambushes, improvised explosive devices (IEDs), and suicide bombers to slow the Kurdish advance, but eventually conserved most of its force by exfiltrating the area and not engaging in a decisive battle.  In November 2015, an alliance of Kurdish factions resulted in recapturing ISIL-held territory in Nineveh province—including Sinjar, which sits on ISIL’s Highway 47 supply route connecting ISIL- held Raqqa, Syria, and Mosul Iraq.  While successful in Sinjar, the alliance of the KRG’s Peshmerga, Kurdistan Worker’s Party (PKK), the Syrian Popular Protection Unit (YPG), and Yazidi militias (YBS) is fraught with ISIL-exploitable fault lines.

This (U) Threat Action Report (TAR) was produced in accordance with (U) Intelligence Community Directive Number 203: Analytical Standards (Effective: Jan 2015). This TAR was coordinated with:

 HQDA DCS G-2—Major Adam Clements  FMSO—Mr. Tom Wilhelm  Asymmetric Warfare Group— SFC Todd Agrimon Comments and feedback are welcome.

Jon S. Cleaves Director, ACE Threats Integration

116 UNCLASSIFIED

Threat Action Report

Introduction

This Tactical Action Report (TAR) provides information on the capture and subsequent recapture of Sinjar, a town at the foot of the Sinjar Mountains. The Nineveh Offensive, of which Sinjar was a key target, led to the capture of a large part of northern Iraq and included the occupation of Mosul. ISIL pushed Peshmerga forces from the area and threatened Erbil, the government seat of the KRG in 2014. A growing humanitarian crisis developed as ISIL began purging villages in the Sinjar area of the minority group known as Yazidis. Thousands were killed, kidnapped, or forced to flee their homes. Many Yazidis retreated to the Sinjar Mountains where they were besieged by ISIL fighters. These circumstances led to President Barack Obama ordering air strikes to protect Erbil, where US military advisors were headquartered, and to relieve the displaced Yazidi civilians. Over a year later Peshmerga fighters, with the help of other Kurdish factions, pushed ISIL forces out of Sinjar and other surrounding areas and severed a key supply route connecting ISIL-held Raqqa, Syria, with Mosul, Iraq.

Operational Environment Background—Sinjar

Sinjar1 is a strategically-located Iraqi town in northwestern Nineveh province. It lies along a major ISIL east-west supply route that connects Mosul in Iraq with Raqqa in Syria—two important ISIL-held cities. Sinjar is approximately 52 km east of the Syrian border and 117 km west of Mosul. It is positioned at the foot of the Sinjar Mountains, an east-west mountain range rising 1,463 m above the surrounding alluvial steppe plains. Sinjar is populated primarily by a Kurdish religious minority called the Yazidis. The Yazidis are particularly vulnerable to violence and persecution, having been the object of hatred for centuries because of their religious practices. Yazidis are ethnically Kurdish, but their religion combines elements of Islam, ancient Persian Zoroastrianism, and Eastern Mediterranean Mithraism. While Yazidis are monotheists, they believe in a fallen angel who serves as an intermediary between God and man. To Muslims, this intermediary resembles the Quranic devil. Yazidis are, therefore, considered devil worshippers by their Muslim neighbors. With isolated geography and a history of persecution, the Yazidis rarely intermarry and do not accept converts, further distinguishing themselves.1 In June 2014, ISIL began an offensive in Nineveh province and captured Mosul, the second-largest city in Iraq, that same month.2 This ISIL victory gave momentum to a push throughout Kurdish Peshmerga-held Nineveh province. On 1 August 2014, ISIL attacked a Peshmerga unit in the town of Zumar, a small Kurdish-majority outpost 40 km northwest of Mosul. ISIL killed 14 Peshmerga soldiers, while the group sustained 100 casualties and 38 members were taken prisoner in the attack.3 On 2–3 August, in a serious setback for Kurdish Peshmerga soldiers, ISIL succeeded in taking three strategic towns: Zumar, Wana, and Sinjar. Zumar is an oil-rich area that also lies on a road leading to Syria; Wana is a town on the Tigris river within striking distance of the Mosul dam; and Sinjar is a town on a major supply line that connects ISIL-held Mosul in Iraq with ISIL-held Raqqa in Syria. The towns form a triangle west from Mosul to the borders of Syria and Turkey. The capture of these towns gave ISIL both momentum and proximity to

1 Sinjar is the Arabic name; however, the Kurdish Shingal is also seen in some writings. 117 UNCLASSIFIED

Threat Action Report

seriously threaten those protecting the Mosul dam, which was temporarily captured and then lost by ISIL between 7–18 August.4 ISIL forces continued throughout August 2014 to push Kurdish Peshmerga forces from positions in Nineveh province. On 6 August, ISIL moved to within 49 km of Erbil, the capital of the Kurdish autonomous region, threatening US military and civilian personnel. On 8 August, the US began conducting airstrikes against ISIL positions, beginning around Erbil, to stop ISIL’s advance on that city.5 Starting on 9 August, the US began airstrikes around the Sinjar Mountains to relieve Yazidis and others trapped by ISIL.6 ISIL successes created a humanitarian crisis, with thousands displaced from their homes, kidnapped, injured, and killed by ISIL fighters. In the Sinjar area, ISIL gunned down 5,000 Yazidi men in a series of massacres, detained over 5,000 Yazidi women to be sold into slavery or given to jihadists as wives and sex slaves, and caused as many as 200,000 civilians to flee, 50,000 of whom retreated into the besieged Sinjar Mountains. Pictures of Yazidis surrounded and trapped by ISIL on Mount Sinjar put increasing international pressure on the US administration to act and on Pershmerga forces—who were stinging from multiple defeats at the hands of ISIL—to reclaim lost territory.7

Figure 1. Peshmerga offensive against ISIL

By October 2014, Peshmerga forces began winning back territory lost in the ISIL offensive. Kurdish Peshmerga attention then turned to rescuing the Yazidis trapped in the Sinjar area. The Kurdish offensive against ISIL began with US air strikes. Launching from the recaptured cities of Rabiya and

118 UNCLASSIFIED

Threat Action Report

Zumar, 8,000 Kurdish fighters opened a corridor from Mount Sinjar northeast into Kurdish-controlled areas. This broke the siege, but still left Sinjar in the hands of ISIL. Kurdish fighters were able to capture part of Sinjar, but settled into a stalemate with ISIL fighters in the city.8 ISIL encountered little resistance from Kurdish Peshmerga forces when it attacked Sinjar and the surrounding area in August 2014. It immediately took control of the population. Residents were told to either convert or be killed. While most Sinjar residents escaped, evidence of the extreme brutality brought to bear on those who remained has been found in mass graves uncovered after Kurdish soldiers recaptured the city. Forensic evidence indicates ISIL adherents executed hundreds of Yazidis and buried them in mass graves.9 The massacres served to both reduce the number of those not willing to adhere to ISIL’s interpretation of Islam and, through fear, increased compliance in those who remained. Soon after ISIL took control of the city of Sinjar, US air strikes began to attack its positions. ISIL responded to this by building a network of tunnels that connected houses. These tunnels provided protection for fighters and served as a means of subterranean command and control. The sandbagged tunnels, about the height of a person, contained ammunition, prescription drugs, blankets, electrical wires leading to fans and lights, and other supplies. In total, there were at least 30–40 tunnels.10 During the next fifteen months, ISIL emptied the city of most of its inhabitants and prepared battle positions in anticipation of an inevitable major Kurdish attack to retake the city. Kurdish forces entered and captured parts of Sinjar, but were unable to gain complete control. From positions Figure 2. ISIL tunnels in Sinjar (video link) within the city, ISIL utilized marksmen, small sniper teams, IEDs, rocket propelled grenade launchers, and mortars to keep the Kurdish soldiers at bay. Repeated air attacks by the US-led coalition pummeled the city, but ISIL still prevented the Kurdish fighters from declaring victory in Sinjar.11

Kurdish Coalition Vulnerability

While successful in Sinjar, the coalition that defeated ISIL is an exploitable vulnerability. This coalition included Kurdish forces from the Peshmerga, PKK, YPG, and YBS. The major fault line lies between the PKK and its growing allies and the KRG with its Peshmerga fighters and its allies. The KRG is particularly

119 UNCLASSIFIED

Threat Action Report

concerned about other Kurdish groups permanently occupying areas around Sinjar. Questions of which group will administer the captured area, mistrust, and historical disagreements have potential for eruption. Peshmerga forces are the military arm of the KRG. Of the groups who fought to retake Sinjar, the Peshmerga was the largest and best-resourced. The KRG considers Nineveh province part of its territory.12 It has consistently played down the role of other participants, to the annoyance of those who continued to fight ISIL after the Peshmerga was forced out of the area.13 The major rival to the Pershmerga forces is the PKK. Formed in the 1970s, the PKK is an armed separatist group fighting to gain Kurdish independence from Turkey. Designated by the US as an international terrorist organization, it cannot coordinate directly with the US and needed to rely on passing targets and friendly position coordinates through the Peshmerga during the Sinjar operations. The PKK maintained a forward base at a northern entry point to the city at the foot of Mount Sinjar during the months preceding the final attack.14 A smaller group allied with the PKK is the Syrian YPG, the military arm of the Democratic Union Party. The YPG has emerged from the Syrian civil war with fighting tactics and techniques that allow it to perform well against ISIL. Relying on speed, stealth, and surprise, the YPG has been able to quickly redirect attacks to outflank and ambush its enemy. The YPG has trained over 1,000 Yazidis in one-week courses, giving it influence and loyalty in areas where its fighters are now occupying Iraqi ground previously held by Peshmerga forces. Iraqi Kurds view any permanent occupation by the YPG as a violation of Kurdish sovereignty.15 The Yazidis formed the Sinjar Resistance Unit (YBS) when ISIL forced them out of their city. Allied primarily with the PKK and the YPG, the YBS remained after the Peshmerga left Sinjar in the summer of 2014. The YBS conducted urban attacks in the city and protected displaced Yazidis in the Sinjar Mountain. Increased Yazidi confidence in its own protection forces after the military training, experience, and alliances developed with other Kurdish groups during the Sinjar battles need to be factored into any future KRG dealings with the Yazidis. The Yazidis blamed, in part, the Peshmerga’s retreat from Sinjar in 2014 for the ISIL atrocities that occurred in its absence. This has left the Yazidis with anger toward and mistrust of the Peshmerga fighters.16

Tactical Action

The offensive to take Sinjar back began at dawn on Thursday 5 November 2015 on three fronts. US-led coalition air attacks preceded the Kurdish ground attack. A coalition of PKK, YPG, YBS, and Peshmerga fighters attacked south into Sinjar. Opening with a rocket attack, the Kurdish forces moved south from the mountain to reinforce fighters already in the city. Movement through the city was slow and difficult due to ISIL marksmen, snipers, and suicide and planted IEDs. Most of the ISIL fighters had already left the city under the heavy bombardment, leaving behind small sniper teams. ISIL snipers, having been in the city for months, had the advantage of knowledge of the terrain, prepared positions, tunnels, underground shelters, and the element of surprise.17

120 UNCLASSIFIED

Threat Action Report

Figure 3. Battle for Sinjar

121 UNCLASSIFIED

Threat Action Report

While some Kurdish fighters attacked from the north, others moved from the east and the west of Sinjar to cut off ISIL’s supply line along highway 47 between Mosul and Raqqa. Fighters, mostly PKK, attacked from the west while a predominately Peshmerga force attacked from the east. ISIL utilized practiced techniques in attempting to prevent its supply line from being cut and its units surrounded. ISIL used Figure 4. Peshmerga attack from East (video link) marksmen, snipers, ambushes, IEDs, and suicide bombers along the road and in the city to block movement. The coalition force eventually cleared the road after a few days of slow and cautious movement. Most of the ISIL fighters had already exfiltrated from the area as the Kurdish forces made gains. A few snipers stayed behind, as the Kurds began to claim victory, to harass and prevent complete Kurdish freedom of movement. Additionally, clearing the city of booby- traps and other kinds of IEDs slowed free movement within the city. In one mass grave, for example, ISIL rigged bodies to explode when moved.18 Figure 5. View of the City of Sinjar (video link)

Analytical Assessment  In the summer of 2014, the ISIL Nineveh Offensive resulted in the capture of a large swathe of northern Iraq, to include still-held Mosul, embarrassing both the Iraqi Army and the Kurdish Peshmerga.  The abandonment of the Sinjar area in 2014 under ISIL pressure created a lingering Yazidi distrust of the Peshmerga. During the Peshmerga absence in Sinjar, the Yazidis developed closer alliances with the PKK and YPG. This will complicate future relationships between the KRG and returning Yazidis.

122 UNCLASSIFIED

Threat Action Report

 Closing the Highway 47 supply line between Mosul and Raqqa will not completely cut off routes between those cities, but will make it more expensive and difficult to move personnel and supplies between the two cities.  Kurdish factional solidarity combined with overwhelming numbers defeated ISIL in Sinjar and the surrounding area.  Adaptive techniques such as tunnels allowed ISIL to maintain command and control and protect its forces from the effects of air attacks.  Utilizing successful INFOWAR techniques, snipers, marksmen, and IEDs, ISIL maintained control of a portion of the city for 15 months and slowed the advance of Kurdish forces in the final attack, all at a small cost compared to its opposition.  ISIL leadership concluded growing Kurdish forces would eventually overwhelm the group and withdrew most of its forces before the combined Kurdish attacks. With small units and teams, ISIL bogged down Kurdish attackers, eventually ceding control of a destroyed town.

TRAINING IMPLICATIONS

 ISIL uses violence against indigenous populations to both further its interpretive narrative of strict adherence to and protector of Islamic truth, and as a means of creating compliance through fear. The result is depopulation of whole towns and creation of humanitarian crises from fleeing, displaced people. A humanitarian crisis diverts attention and resources away from the hybrid threat, provides the enemy with human shield opportunities, and creates internal and external political and humanitarian pressures on its enemies.  Air strikes significantly limited ISIL’s ability to maneuver and were critical to Kurdish success in regaining lost territory from ISIL. ISIL responded to this new threat by going underground in Sinjar. Building a sophisticated network of tunnels that connected key buildings and provisioning those tunnels with supplies allowed the group to mitigate some of the effects of the bombing. Given time, the hybrid threat will continue to improve its subterranean expertise and find other ways to mitigate the effects of superior technology.  ISIL used marksmen and sniper teams effectively in the Sinjar urban environment as described in TC 7-100.2 to create casualties; impede movement; instill fear; influence enemy decisions, actions, tactics, and techniques; lower morale; damage or destroy materiel; and disrupt enemy tempo.19  ISIL uses suicide and planted IEDs to impede progress, kill, and instill fear in its enemy.  ISIL may choose to conserve most of its force by exfiltrating an area and not engage in a decisive battle when presented with overwhelming force.

Related Products

Follow these links to view related products:  Threat Tactics Report: ISIL  Threat Tactics Report: Syria  Red Diamond—Threat Tactics Report: ISIL Update  Red Diamond—Two Border Towns in Syria: A description of Urban Operations

123 UNCLASSIFIED

Threat Action Report

 Red Diamond—HAMAS’ Tunnel Vision: Recent Experiences in Gaza  Red Diamond—Wadi al Deif and al Hamadiyah Military Base Attacks  Red Diamond—Fight for Hama  Red Diamond—The Fall of Ramadi: ISIL on the March  Red Diamond—Refugee Crisis in CENTCOM  Red Diamond—Subterranean Environment: Tunnel to Victory  Red Diamond—ISIL’s Use of Social Media  Red Diamond—ISIL Attack on the Tabqa Airbase See also the Red Diamond Newsletter, which contains current articles on a variety of topics useful to both soldiers and civilians ranging from enemy tactics and techniques to the nature and analysis of various threat actors. For detailed information on weapons and equipment, see the Worldwide Equipment Guide. To see more products from ACE-TI, visit the Army Training Network (ATN) with CAC access: https://atn.army.mil/dsp_template.aspx?dpID=377

POC

Author Rick Burns 913-684-7897 (COMM) 552-7897 (DSN)

TRADOC G-2 Analysis and Control Element Threats Integration (ACE-TI) 803 Harrison Drive, BLDG 467 Fort Leavenworth, KS 66027

Jon Cleaves, ACE-TI Director Jennifer Dunn, ACE-TI Deputy Director Jon Moilanen, ACE-TI Operations

Note: Not all references listed in this publication are readily available to the public; some require a government common access card (CAC) to view.

Figure Credits

Figure 1. Peshmerga offensive against ISIL in Nineveh province. Source: ACE Threats Integration. 2016. Figure 2. ISIL tunnels in Sinjar. Source: YouTube. 25 November 2015. Figure 3. Battle for Sinjar. Source: ACE Threats Integration. 2016. Figure 4. Peshmerga Sinjar attack from the East. Source: YouTube. 19 November 2015. Figure 5. View of the city of Sinjar. Source: YouTube. 16 June 2015.

124 UNCLASSIFIED

Threat Action Report

Endnotes

1 Avi Asher-Schapiro. “Who Are the Yazidis, the Ancient, Persecuted, Religious Minority Struggling to Survive in Iraq?” National Geographic. 11 August 2014. 2 Al Jazeera. “Rebels Seize Control of Iraq’s Nineveh.” 10 June 2014. For a more detailed description of the , see Threat Tactics Report: Islamic State of Iraq and the Levant. 3 APF. “Jihadists Kill Dozens as Iraq Fighting Rages.” Al Arabiya. 2 August 2014. 4 Tim Arango. “Sunni Extremists in Iraq Seize 3 Towns from Kurds and Threaten Major Dam.” The New York Times. 3 August 2014; Tim Arango, “Jihadists Rout Kurds in North and Seize Strategic Iraqi Dam.” The New York Times. 7 August 2014; BBC News. “Iraq Crisis: Mosul Dam Retaken from IS.” 19 August 2014. For a more detailed description of the ISIL defense of the Mosul dam, see Threat Tactics Report: Islamic State of Iraq and the Levant. 5 Julian E. Barnes, Jeffrey Sparshott, and Nour Malas. “Barack Obama Approves Airstrikes on Iraq, Airdrops Aid.” The Wall Street Journal. 8 August 2014. 6 Dan Roberts, Martin Chulov, and Julian Borger. “Obama Authorises Air Strikes on ISIS to Help Iraqis Besieged on Mountain.” The Guardian. 8 August 2014. 7 Mohammed A. Salih and Wladimir van Wilgenburg. “Iraqi Yazidis: ‘If We Move They Will Kill Us’.” Al Jazeera. 5 August 2014; Steve Hopkins. “Full Horror of the Yazidis Who Didn’t Escape Mount Sinjar: UN Confirms 5,000 Men Were Executed and 7,000 Women Are Now Kept As Sex Slaves.” Daily Mail. 14 October 2014; Martin Chulov. “Iraq’s Largest Christian Town Abandoned As ISIS Advance Continues.” The Guardian. 7 August 2014. 8 BBC News. “Mount Sinjar: Islamic State Siege Broken, Say Kurds.” 19 December 2014. 9 Human Rights Watch. “Iraq: Protect Mass Graves.” 30 January 2016. 10 Associated Press. “ISIS Dug Network of Tunnels under Conquered Iraqi City of Sinjar.” NBC News. 25 November 2015. 11 Dalton Bennett. “Kurdish Fighters Battle to Recapture Iraq’s Sinjar from ISIS.” AOL. 21 December 2014; Al Arabiya. “Kurds Push Deeper in Sinjar but Face ISIS Resistance.” 22 December 2014. 12 Kurdistan Region Security Council. “Operation Free Sinjar Concluded – KRSC Statement.” 14 November 2015; KR Security Council. “Twitter Feed.” 11 November 2015. 13 Mohammed A. Salih. “With the Islamic State Gone from Sinjar, Kurdish Groups Battle for Control.” Al Monitor. 10 December 2015. 14 Al Jazeera America. “Exclusive: Inside the PKK’s Frontline Fight against ISIL.” 11 June 2015; Mohammed A. Salih. “With the Islamic State Gone from Sinjar, Kurdish Groups Battle for Control.” Al Monitor. 10 December 2015. 15 Michael Stephens. “Analysis: YPG – the Islamic State’s Worst Enemy.” IHS Jane’s 360; Danny Gold. “Meet the YPG, the Kurdish Militia that Doesn’t Want Help from Anyone.” Vice. 31 October 2012; John Caves. “Syrian Kurds and the Democratic Union Party (PYD).” Institute for the Study of War. 6 December 2012. 16 Sheren Khalel and Matthew Vickery. “Armed and Ready: Displaced Yazidis Battle ISIS in Sinjar.” Middle East Monitor. 7 March 2015; Joanna Paraszczuk. “Yazidi Militias Fight IS in Iraq, Amid Kurdish Rivalries.” Radio Free Europe Radio Liberty. 11 June 2015. 17 BBC News. “Kurds’ ‘Advance on IS-held Sinjar’r.” MSN. 11 December 2015. For more information on snipers and marksmen, see Training Circular 7-100.2, Opposing Force Tactics. 18 William Watkinson. “Sinjar: 123 Booby-Trapped Bodies of Dead Yazidis Found in Shallow Grave after ISIS Slaughter.” International Business Times. 28 November 2015; BBC News. “Battle for Sinjar: Kurds ‘Advance on IS-Held Iraqi town.” 12 November 2015. 19 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. Para 16-24.

125 UNCLASSIFIED

THREAT ACTION REPORT: Pathankot, India, Airbase Attack

TRADOC G-2 ACE THREATS INTEGRATION

MAY 2016

Threat Action Report

Purpose

 To inform the Army training community of the attempted attack on the Pathankot Air Force Base in India by Pakistani-based militants.  To report on the actions taken by the Indian security forces upon the receipt of intelligence about a possible impending attack.  To describe some of the deficiencies in the relationship between the local and national police and the interagency squabbles that possibly compromised safety.  To demonstrate the connectivity among the techniques used in the attack, threat doctrine, and conditions described in training materials such as the Training Circular 7-100 series. Executive Summary

 The militants planned to a level of detail that included two different cells to conduct the attack and a possible associated attack in another country.  Because the local police failed to take seriously the kidnapping of a district police officer due to his prior work history, delays ensued in the search for the attackers.  Indian interagency conflict caused various security forces to attempt to take the lead in the operation, and may have increased the casualties among Indian security force personnel.  After the initial contact, the Indian security force personnel assumed that all the intruders were dead, when in fact two more actually remained alive and subsequently inflicted additional casualties.

This (U) Threat Action Report (TAR) was produced in accordance with (U) Intelligence Community Directive Number 203: Analytical Standards (Effective: Jan 2015). This TAR was coordinated with:

 National Ground Intelligence Center (NGIC)—Mr. Ronald L. Kinser and Mr. Aaron R. Linderman  HQDA DCS G-2—Mr. Peter J. Tedford  FMSO—Mr. Tom Wilhelm  USARPAC—Mr. Dennis F. Quigley Comments and feedback are welcome.

Jon S. Cleaves Director, ACE Threats Integration

128 UNCLASSIFIED

Threat Action Report

Introduction

On 2 January 2016, six militants attacked the Pathankot Air Force Base in the Indian state of Punjab, with the intention of destroying the airplanes and helicopters on the tarmac. Before the intruders could reach the runway or aircraft, base personnel confronted the infiltrators and alerted security personnel of their presence. After a cook killed one of the militants with the attacker’s own rifle, security personnel cornered and killed three other intruders. The remaining two attackers hid in an unoccupied barracks while security forces rushed to protect the airfield, any remaining aircraft, and other high-priority targets. Many hours later, the two remaining militants ambushed unsuspecting base personnel, leading to an assault on the two-story barracks by specialized Indian military and security personnel. Due to this second surprise attack, Indian security forces then conducted a thorough search of the entire base to ensure no other intruders were still at large. In addition to the six attackers killed, ten Indian military personnel were killed in action and another 22 people were wounded. Indian governmental officials claimed the Jaish-e- Mohammed terrorist group conducted the attack.

Operational Environment Background—Northwest India

Northwest India faces several major challenges, mainly due to border disputes involving territory claimed by India, Pakistan, and/or China. These disputes most often revolve around the Indian state of Jammu & Kashmir. In 1947, with the withdrawal of Great Britain from the Asian sub-continent, the primarily Muslim areas were assimilated into the country of Pakistan, while the majority Hindu areas joined together to form India. The maharaja (ruler) of Jammu & Kashmir—a Hindu who governed a majority Muslim state—was permitted to remain independent or join either country. When Pakistani forces invaded, the Maharaja chose to join India and the region has been contested since that time. Pakistan has attempted to alter this territorial decision ever since. India defeated Pakistan in three wars (1947–48, 1965, and 1971) over this disputed territory, with little change in the status quo.1 Figure 1. Disputed areas between China, India, and Pakistan

129 UNCLASSIFIED

Threat Action Report

Pathankot is a city and district location in Punjab state, one of the three states in the primarily Muslim area of northwest India. (There is also a Punjab province in Pakistan). The other Indian states where Islam dominates are Jammu & Kashmir (one single state) and Himachal Pradesh.

Jaish-e-Mohammed

Jaish-e-Mohammed (JeM) is an Islamic militant group based in Pakistan. Its aim is to unite the Indian state of Jammu & Kashmir with Pakistan and to expel all foreign troops operating in Afghanistan. JeM has also declared war against the US. JeM, translated as the Army of Mohammed, was outlawed by Pakistan in 2002, but continues to operate under other names such as Khuddam ul-Islam (KUI) and Tehrik ul-Furqaan. JeM has various splinter groups, including Jammaat ul-Furqan (JUF)—also known as the Maulana Abdul Jabbar Group (MAJG)—headed by Abdul Jabbar.2 JeM continues to operate in defiance of the Pakistani government’s prohibition. Indian officials previously jailed both JeM founder Masood Akhar and Abdul Jabbar for their work with insurgent groups, but the Indian government later released them in 2000 and 2003, respectively. JeM or its splinter groups are considered likely suspects in the Srinagar, India, bombing in October 2001 that killed 30 people; the 2002 abduction and murder of US journalist David Pear; and the March 2009 attack on the Sri Lankan cricket team in Lahore, Pakistan. JeM supporters are primarily Pakistanis and Kashmiris, but also include Afghans and Arab veterans of the Afghan war against the . In 2001, the US State Department formally designated JeM as a foreign terrorist organization. JeM attacks targets both outside of and within Pakistan that are supportive of groups counter to its beliefs.3 Masood Azhar, a Pakistani citizen, founded JeM in the early 2000s after serving with Harakat ul- Mujahedeen (HuM), another US-designated terrorist group. It is believed that Azhar worked with al- Qaeda (AQ) and fought US troops in Somalia with a HuM cell under guidance from Osama bin Laden. On 14 January 2016, the Pakistani government placed Azhar under protective custody and he has been in detention ever since. The Indian government claims that Azhar masterminded the Pathankot attack.4 JeM normally operates only within the Indian states of Jammu & Kashmir or Punjab, or within Pakistan itself. Prior to the Pathankot airbase attack, JeM’s only other confirmed operation outside these areas occurred on 13 December 2001, when it struck the parliament in New Delhi, India. While the United Jihad Council (UJC)—an umbrella of Pakistan-based, Kashmir-focused militants—took almost immediate credit for the January 2016 Pathankot Airbase attack, some Indian intelligence analysts believed the evidence pointed toward JeM, a UJC member, as the specific perpetrators. The UJC later claimed that Kashmiri militants carried out the attack on the airbase. Some Indian Figure 2. JeM Flag intelligence analysts, however, suspect that the UJC is just trying to divert suspicion from the specific culprit, JeM.5

130 UNCLASSIFIED

Threat Action Report

JeM Attacks in India and Pakistan

JeM has carried out a number of attacks in India and Pakistan over the last two decades. Many of the attacks took place in Northwest India. The following is a list of major attacks, not all-inclusive, where JeM claimed responsibility or Indian government officials alleged active JeM involvement:  19 April 2000: JeM conducted the first suicide bomb attack in India when a suicide vehicle borne improvised explosive device (SVBIED) exploded outside the 15 Corps headquarters building in Badami Bagh, Jammu & Kashmir State, India, injuring seven people. The only person who died was the suicide bomber.6  4 June 2000: JeM gunmen killed police officers at bus stops in Srinagar and Wazirbagh cities in the Indian-administered Kashmir (IAK) region, causing four casualties that included three dead.7  11 December 2000: Militants that claimed to belong to JeM planted a mine on the main Srinagar-Barmamulla road and detonated it when a Border Security Force vehicle passed over it, killing one person and injuring eight others.8  25 December 2000: A vehicle borne improvised explosive device (VBIED) exploded outside an IAK Indian Army headquarters, killing eight people and injuring 23 others. Both JeM and another militant group, Jamaat-ul-Mujahideen, attempted to take credit for the attack.9  1 October 2001: JeM carjacked a government jeep and converted it into a VBIED before ramming it into the main gate of the Srinagar Legislative Assembly complex prior to detonation. Additional assailants then entered the complex and fired indiscriminately with their rifles, threw grenades, and set fires before the battle ended several hours later. The attack killed at least 31 people. Srinagar is the summer capital city of Jammu & Kashmir. JeM initially claimed responsibility for the attack, but then denied responsibility a few days later.10  13 December 2001: In coordination with the Pakistani-based militant group LeT, JeM members participated in an attack on the Indian Parliament in New Delhi, killing at least 14 people and injuring at least 22 others. The five JeM/LeT attackers entered the building using fake identity stickers and wore military-style uniforms.11  23 January 2002: Daniel Pearl, a Wall Street Journal reporter, was abducted while visiting Pakistan; he was beheaded several weeks later. JEM is one of several Islamist groups suspected of being involved.12  14 February 2002: JeM was the likely culprit behind the death of Indian National Conference activist Abdul Hafeez Mirza, as JeM previously warned people to not participate in an upcoming election in Jammu & Kashmir.13  5 August 2002: Four JeM gunmen attacked a Christian school near Murree, Punjab Province, Pakistan, killing six people and wounding two others. None of the 150 children attending the school were injured.14  9 August 2002: JeM members threw grenades into a Christian missionary hospital in Taxila, Punjab Province, Pakistan, killing three nurses and injuring 20 others. One of the attackers died when his grenade exploded prematurely.15  25 December 2003: JeM was likely behind two suicide bombing attempts to assassinate Pakistani President Pervez Musharraf in Rawalpindi, Pakistan. JeM launched a second attack just 12 days after an initial attempt, by attempting to add two SVBIEDs to Musharraf’s convoy—one at the front end, and one at the back. Although both SVBIEDs exploded, Musharraf escaped

131 UNCLASSIFIED

Threat Action Report

harm. At least 15 people died. Approximately 46 others, mostly civilian passers-by caught within the bursting radius of the explosions when the bombs detonated, were injured.16  31 May 2005: Three JeM members wrested an automatic rifle from a police guard outside the Madinatul Iim Imambargah, a Shia mosque in eastern Karachi, Pakistan, then killed him with it. Other police killed two of the attackers, but the third reached the inside of the mosque a detonated an IED strapped to his body. Total casualties included five dead and 28 others injured.17  2 November 2005: JeM detonated a VBIED outside the home of the Jammu & Kashmir Chief Minister, Mufti Mohammad Sayeed, in Srinagar, India. The explosion killed at least ten people and injured 18 others.18  30 May 2006: JeM operatives threw grenades at a police vehicle escorting a human rights commission convoy in Srinagar, India, causing eleven casualties Figure 3. Punjab district map 19 including one death.  26 September 2013: Militants attacked an Indian Army base in Jammu & Kashmir, making use of a truck VBIED. Despite the claim by the al-Shuda Brigade that it perpetrated the attack, Indian authorities suspected that JeM and LeT joined forces to conduct the raid.20

Historical Punjab Attacks

Militant groups have initiated terrorist attacks in Punjab state, India, for many years. The following attacks are just a sampling of various attacks that occurred between 2001 and 2016 in Punjab.21  1 March 2001: Indian government officials discovered a 125-meter tunnel that originated in Pakistan and ended in Gurdaspur district.  31 January 2002: An explosion on a Punjab Roadways bus in Patrana, Hoshiarpur district, killed two and injured 12 others.  31 March 2002: A bomb exploded on the Ferozepur-Dhanbad express train at Daroha, Ludhiana district, killing two and injuring 12 other civilians.

132 UNCLASSIFIED

Threat Action Report

 28 April 2006: A bomb blast killed at least eight people when a bus carrying 45 passengers exploded at the Jalandhar depot, Jalandhar district.  14 October 2007: A bomb exploded at a movie theater in Ludhiana, Ludhiana district, killing seven and injuring 40 others.  27 July 2015: Three individuals carried out an attack on a police station in Dinanager, Gurdaspur district, killing seven people including a Punjab police superintendent. However, all three militants died in the attack. The perpetrators reportedly were on their way to attack the Pathankot Airbase, but because dawn was fast approaching, the cell diverted its attack to the police station in order to carry out the assault under cover of darkness.22

Thawing of Indian and Pakistani Relations

On Friday, 25 December 2015, Indian Prime Minister Narendra Modi met with Pakistani Prime Minister Nawaz Sharif as Modi was returning to New Delhi from Kabul, Afghanistan. This meeting took both nations, as well as the world, by surprise, as Modi only announced the meeting via Twitter that same morning. The two leaders met for approximately 2 1/2 hours and jointly announced afterwards that their countries would seek to open avenues leading toward peace, for the common good of both countries.23 This was only the second meeting between the two leaders. The first meeting had been very brief, at the Paris Climate Conference, when the two shook hands on 30 November 2015. The thawing in relations between the two countries had received another boost when Indian Foreign Minister Sushma Swaraj traveled to Islamabad, Pakistan, earlier in December for a multilateral conference. The two prime ministers at the 25 December meeting also agreed that their foreign secretaries would meet in Islamabad on 15 January 2016.24 Figure 4. Indian Prime Minister Narendra Modi and Pakistani Prime Minister Nawaz Sharif Whenever indications of rapprochement between during their 25 December 2015 meeting Pakistan and India surface, one of the Pakistani- based militant groups typically perpetrates some outrage intended to derail any bilateral talks that could potentially reduce tensions between the two historical adversaries. Some Indian government officials believed that the Pathankot Airbase attack bore a marked similarity to previous attacks apparently intended to torpedo attempts by Indian and Pakistani leaders to find common ground for resolving their differences. Due to the attack on the Pathankot Airbase, the two countries decided to postpone the January 2016 meeting between the Indian and Pakistani Foreign Ministers until a later date.25

133 UNCLASSIFIED

Threat Action Report

Attack on Pathankot Airbase

The following recounts the sequence of events leading to the attack as well as the aftermath of the attack, all garnered from open sources. The actual physical location of the entry points on the Pathankot Airbase have not been publicly released, but an examination of the information available and the terrain provides a good approximation of the possible location. The techniques used by the attackers and lessons learned are valid even if the exact location/terrain is not known.

December 2015 On 27 December 2015, the Punjab police released a report of a possible New Year’s Day LeT attack in India, to be carried out by fifteen well-trained individuals. Leaders at the Pathankot Airbase and other military installations in Northwest India paid little heed to the warning and took only nominal additional precautions. On 31 December, the Indian government issued a high alert announcing that 20 LeT operatives were on the loose in Northwest India, causing the Punjab police to mobilize and increase their border security. Late in the evening of 31 December 2015, the Punjab police received credible intelligence indicating that 15 LET members had infiltrated into India from Pakistan. The infiltration was confirmed the following morning when Indian intelligence officials decoded a message about an impending attack in Pathankot district. Of note, while the Border Security Force (BSF) attempts to secure the border between Pakistan and India, each BSF company of 100 guards is charged with responsibility for patrolling a frontage of 2.75 km in Jammu & Kashmir and 5.6 km in Punjab. With round-the-clock operations required to accomplish this mission, security typically consists of widely-separated stationary posts augmented by limited roving patrols that traverse the BSF company’s Figure 5. Unoccupied BSF designated sector. A post-attack inspection later revealed that watchtower on the India- most of the BSF’s ground surveillance radar systems and Pakistan border handheld thermal imaging devices were inoperable on the night of 31 December 2015.26

Wednesday, 30 December 2015 Kashif Jan, a key JeM handler, dropped off at least four militants on 30 December in the Shakargarh tehsil (country) area of Narowal district, Pakistan, across from Bamiyal village in India. After dropping off his passengers, Jan made at least 17 calls to other JeM members. At least one of the Pathankot attackers called Jan during the operation.27

134 UNCLASSIFIED

Threat Action Report

Thursday, 31 December 2015

Border Infiltration Despite the high alert, four (some initial reports said five) individuals crossed the Pakistani-Indian border using a handheld GPS in almost the same exact location as the operatives who previously conducted the Gurdaspur attack on 27 July 2015. The militants probably entered India through an infiltration tunnel frequently used by drug smugglers near Bamiyal, a village of about 700 people, in Pathankot district near the Pakistani border. Bamiyal is located near a point where the districts of Punjab, Jammu & Kashmir, and Himachal Pradesh meet. The village is also situated near a major highway that connects Jammu & Kashmir to the rest of India, an ideal location for infiltration. After the July attack, an investigation revealed damaged border fencing near Bamiyal; that nearby floodlights were inoperable, primarily due to heavy rains; and that the breach in fencing had persisted for at least a year prior to the July 2015 infiltration. On 1 January 2016, a farmer named Jaspal Singh Pakko, after learning that a police officer had been kidnapped, told National Investigation Agency (NIA) personnel that he had discovered prints in his garlic and wheat fields that were not there the previous afternoon. Authorities subsequently determined that the prints matched those of boots produced by the East Pakistan Chrome Tannery, hardly a location where local Indian citizens would purchase their footwear. The farmer’s field lies only about 400 meters from a stationary BSF post. Less than three weeks after the Pathankot Airbase attack, BSF personnel shot another infiltrator near Bamiyal.28 Sometime after their crossing into India, the infiltrators changed into Indian Army uniforms—either taken from a cache or brought with them across the border. By that time, they had also procured some small arms. According to media reports, by the time they reached the airbase the attackers were carrying AK rifles, some with under-barrel grenade launchers attached; 52-mm mortars; and GPS devices. The exact time when the attackers gain possession of all their weapons remains a matter of speculation.29

Taxi Ride Between 2130 and 2330 local time, a Bamiyal taxi driver received seven phone calls from a Pakistani phone number regarding picking up a fare—the four infiltrators—in Pathankot province. Exactly when the driver, Ikagar Singh, picked up his passengers, and the amount of time they remained in his vehicle, has not been determined. Relatives of the driver later asserted that the JeM members carjacked the taxi while Singh was changing a flat tire. While the exact circumstances regarding how Singh met the four men in military uniforms may never be known, it is clear that Singh ended up dead in a field near the roadside where police found his abandoned vehicle. From GPS history, the carjackers forced the driver to avoid main thoroughfares and instead follow an unpaved route, which possibly made the driver suspicious. Forensic evidence suggests that Singh purposely crashed his taxi into a tree on an isolated road about 30–35 km from Pathankot Airbase, perhaps after discerning his passengers’ nefarious intentions. Two flat tires rendered the taxi, a Toyota Innova, inoperable after the crash. Finding themselves without transportation, the JeM cell members sought another means for reaching their target.30

Carjacking At about midnight on New Year’s Eve, the JeM cell flagged down Salwinder Singh, an unarmed Gurdaspur district police superintendent in civilian clothes, as he traveled home from a religious shrine, accompanied

135 UNCLASSIFIED

Threat Action Report

by his cook, Madan Gopal, and a friend, Rajesh Kumar. The four individuals used their rifles to take control of Singh’s multi-utility vehicle, a Mahindra USV X500, near the town of Dinangar. After covering the eyes of the hostages with tape and detaining them for about an hour, the kidnappers either threw Singh and Gopal out of the vehicle or released them (media reports conflict). In any event the JeM members continued to hold Kumar captive. Singh concealed his identity from the carjackers, who up to that point had apparently not noticed the inoperable blue police beacon on the vehicle. The carjackers also confiscated their victims’ cell phones. After releasing the two men, the kidnappers must have discovered that one of their former captives was a police officer, because they later returned to the area and searched for Singh and Gopal. Both the police officer and cook remained hidden in the vegetation until their former captors finally left the area a second time. While with their kidnappers, the three men overheard their captors speaking on the phone with their Pakistani handlers. The JeM handlers urged the team to hurry up, since the other team was already in position. Kumar said that the carjackers later told him that the impeding attack was revenge for the hanging of Afzal Guru, one of the individuals charged with the December 2001 attack on the Indian parliament. The kidnappers slit Kumar’s throat when the vehicle was stopped, but miraculously he lived to tell about it. Kumar was later found unconscious near the Punjab- Himachel Pradesh border.31

Friday, 1 January 2016 Following release by their kidnappers, Singh and Gopal walked for an hour before reaching a police sub- station. There, in the early morning hours of New Year’s Day, Singh called his superior, the Gurdaspur Senior Police Superintendent, at his home. At first the Punjab police discounted Singh’s report, partly because of his dubious professional history as a police officer. Singh’s superior told him to go home and report to work later in the day. When Singh returned to his jobsite on Friday, he related news of his experience to other Indian law enforcement agencies, but because the area had already been alerted to the possible terrorist threat, few if any additional measures were taken, and the information was never sent up the chain of command.32 The intruders’ activities throughout the ensuing 20 hours is a matter of speculation. Actions taken by Indian security agencies, however, are known. Indian National Security Advisor Ajit Doval met with representatives of the defense and home ministries, the Indian intelligence services, and other agencies on Friday morning. After the meeting, during which authorities notified attendees of a possible Figure 6. India NSG Black Cat commandos impending attack on a military base in Pathankot, the

Indian government flew in 50 National Security Guard (NSG) commandos from New Delhi to Pathankot district. These commandos, however, operated out of another military post in Pathankot. The NSG commandos, informally called the Black Cats, began a major search operation for the individuals that kidnapped the Gurdaspur police officer.

136 UNCLASSIFIED

Threat Action Report

Later the same day, the Indian military deployed another 110 Black Cats to the Pathankot district. About 2130 hours local time, the Indian Air Force (IAF) ordered all flyable planes and helicopters at the Pathankot Airbase transferred to other airbases geographically removed a safe distance from the border. About the same time, the Indian Army mobilized nine “columns” of local Army units and IAF Garud commandos to augment the search operation. The Punjab police, having spent the previous day investigating the abandoned Toyota Innova—found near the Kathlore bridge, about 30–35 km from the Pathankot Airbase—were also placed on high alert. Apparently either the Pathankot Airbase commander, or his superiors, did not choose to replace or at least augment the Defense Security Corps (DSC) guards that provided perimeter security to the facility. The DSC is comprised of older individuals, typically Indian military retirees. The Punjab police did not treat theft of the police car as a terrorist incident until 12 hours after it had occurred. Actually, the Punjab security agencies failed to locate the police officer’s vehicle for about 10 hours; until the attack on the Pathankot Airbase was imminent. Although the four carjackers drove straight to the Pathankot Airbase and abandoned their vehicle, it was not found until 1100 hours on 1 January 2016.33

Saturday, 2 January 2016 More is known about the team’s activities on Saturday thanks to eyewitness accounts—often given long after the fact—and electronic signatures of the attackers.

Perimeter Penetration Most likely in the early morning hours of 2 January 2016, the four team members climbed a eucalyptus tree to reach the top of a wall, cut the barbed wire at its top, and then dropped a nylon rope to allow the others to climb over the wall. The entire perimeter of the over 2,000-acre Pathankot Airbase—24 km—is protected by this wall, but there is no closed-circuit television covering any part of the base. Guard towers are placed sporadically every 100–200 meters along the trace of the wall’s interior and manned by DSC personnel armed with light weapons. At times lax security prevailed along the perimeter. Reports suggest that civilians would bribe some of the guards with 20 rupees (approximately 30 US cents) to allow their cows to graze on the luscious grass located on the base. A maintenance road paralleled the wall on the interior side of the base. After breaching the perimeter wall and crossing the road and a drainage ditch, the intruders initially hid in the high elephant grass, prevalent in several locations on the base.34

Phone Calls Using phones stolen during the previous kidnapping of Singh and the other two victims, the carjackers made four calls in the early morning hours of Saturday, 2 January 2016. Three of them discussed the impeding attack, but the final call was personal in nature. Indian intelligence services monitored a 55- second phone call at 0030 hours from one of the team members to a Pakistani phone number under electronic surveillance. The caller talked to three different handlers; all four spoke Punjabi with a Multani accent. The team made a second call to the same Pakistani number at 0052 hours that lasted 32 seconds. One, possibly two, handlers provided final instructions related to the attack. The third and most lengthy call of 87 seconds was made to the same phone number at 0110 hours. The handler at the other end gave the final go-ahead to the cell to enter the target area and blow up the planes and helicopters. With the mission a go, one of the intruders made a 70-second personal phone call to his mother at 0158 hours,

137 UNCLASSIFIED

Threat Action Report

twice saying that although he was on a suicide mission, Allah would take care of all of them. His mother merely responded by advising her son to consume a good meal before he died.35

Faulty Link-Up Sometime before 0300 hours on Saturday morning, the four carjackers may have unsuccessfully attempted to meet with two additional perpetrators who had been on location for a considerable period, waiting for the second team. This made a total of six attackers. It is likely that these two additional attackers brought most of the weapons and ammunition to the link-up site. The munitions may have been

Figure 7. Pathankot Airbase attack hidden in a cache; however, since the two groups did not appear to link up either outside or inside the airbase. The carjackers accidently left a walkie-talkie with very limited range in the police car, and therefore could not communicate with the second team of two attackers. Before entering the base, the

138 UNCLASSIFIED

Threat Action Report

four-man team armed itself with AK rifles (some with under-barrel grenade launchers), grenades, and ammunition. Each attacker carried six kg of RDX explosives for possible use against the aircraft. The other team of two members was already inside the airbase for up to 48 hours before the attack began and was similarly armed. Two Pathankot airmen assisted these two original intruders by cutting open a part of the wall and supplying them with ammunition. These insiders also provided information on the number of hangers and indicated the number and location of operational aircraft, in return for 30,000 rupees—about $438 US dollars—in compensation. The two would-be attackers broke into an isolated Military Engineer Services shed on the base, knowing no one would be in the area over the weekend. There they ate, slept, and waited for the arrival of the other cell from the relative comfort of the shed.36

Figure 8. Event sequence on 2–3 January 2016

Initial Confrontations Lacking direct communication between their cells, the two groups initiated their plan—probably at a pre- planned time. Because an unmanned aerial vehicle (UAV) detected them climbing over the perimeter wall, the larger group of four members almost immediately—around 0330 hours—ran into an IAF Garud (commando) Quick Reaction Team (QRT) conducting a search operation. In the ensuing firefight, one IAF member was killed and another wounded. The QRT reported approximately four intruders heading towards the buildings on base. The base commander then ordered his IAF and NSG personnel to secure the MiG-21 jet fighters and Mi-25 attack helicopters unable to fly out the night before, and also to secure other strategic points such as fuel stations and ordnance bunkers. Before notification of the perimeter breach reached everyone on post, the larger group of intruders passed a DSC dining facility where preparations for an early morning breakfast were just getting underway. Some reports indicate that some of the intruders actually entered the facility. One of the DSC jawans (lower-ranking enlisted soldiers)

139 UNCLASSIFIED

Threat Action Report

thought something was amiss when a group of men wearing army fatigues suddenly appeared, and the jawan confronted them. The attackers tried to escape, but the observant jawan chased one of them down and killed the intruder with his own weapon. Unfortunately, the other intruders then shot the jawan, killing him. The surviving cooks reported an estimated four intruders, all wearing military uniforms.37

First Indian Security Operation Soon after the dining facility incident, NSG commandos, IAF Garud commandos, and Indian Army special forces arrived on the scene and cornered three of the intruders. The Indian security forces used a combination of ground and aerial assets during the operation, the latter including both observation and attack helicopters. Over the next 12 hours, the Indian forces conducted an operation to neutralize the intruders. The situation ended, or so the Indian military thought, when security personnel discovered four corpses. Losses to Indian security forces at this point included two killed in action and six wounded in action. Some of the wounded would later succumb to of their injuries.38

The Lull Although the Indian security agencies then believed all the intruders had been killed, a systematic search of the base continued, with Figure 9. Armored car moves to Pathankot to a special focus on the most vital targets. In fact, support the search for the militants two intruders remained alive. This pair of attackers had abandoned its attempt to reach the flight line—over 700 meters from its location—and finally sought refuge in an unoccupied barracks building. Early on Saturday night, the Indian Defense Minister announced on social media that all the attackers were dead and the episode concluded. An additional 80 Black Cat commandos, raising that group’s presence on the airbase to an aggregate 240 personnel, arrived on Saturday night to join their comrades at the Pathankot Airbase.39

A Second Militant Attack After hiding and sleeping intermittently for approximately 12 hours, the two remaining intruders sprang into action Saturday evening when they fired at Indian security personnel from the two-story barracks where they had taken refuge earlier that day. The Indian security forces, caught unaware, immediately began an operation to eliminate the final two attackers. Because their chain of command was unhappy with the number of friendly casualties incurred so far, this second operation proceeded in a slow and methodical fashion. All through Saturday night and well into Sunday morning, Indian air force helicopters equipped with night vision sights and thermal imaging devices made sure that no invaders escaped the security dragnet this time around. Indian security personnel discovered and, using hand grenades, eliminated what turned out to be the sixth and final intruder. By midnight, the Indian authorities believed that all the attackers were dead, but refused to release that information to avoid a second faux pas on their part.40

140 UNCLASSIFIED

Threat Action Report

Sunday, 3 January 2016 The combination of several Indian military and security groups continued to search the airbase for additional infiltrators in what their leaders described as a “combing” operation. During this operation, Lieutenant Colonel Niranjan Kumar, an NSG explosives ordnance disposal (EOD) commander, died when a hand grenade exploded as he searched an intruder’s corpse. Both groups apparently had rigged a number of explosives to detonate over a period of time, since 29 explosions (grenades and other types) occurred after the death of the sixth, and last, intruder. This created the false impression that additional attackers still remained alive and at large on the installation. Media located outside the airbase heard what they perceived to be sporadic gunfire after midnight on Saturday. The military brought in still more (an additional 80) Black Cat commandos to the Pathankot Airbase, bringing the total number of NSG special forces personnel involved in the operation to 320 soldiers. While authorities now thought all the intruders were dead, the government hesitated to make a formal announcement to that effect, based on the previous day’s premature declaration. About two days later, Indian authorities finally released an official statement announcing that all the attackers involved in the Pathankot Airbase attack were dead.41

Aftermath The Pathankot Airbase attack spawned several policy adjustments, although some bore little relation to increased security:  The Indian government ordered additional security at tourist hubs, airports, and railway stations throughout the country.42  On 3 January 2016, Indian officials implemented increased security measures in Jammu & Kashmir state, especially on air force bases.43  On 4 January 2016, Indian authorities delayed several train departures due to potential bomb threats. These delays also impacted the New Delhi Railway Station, one of India’s major transportation hubs for civilian travel.44  By 4 January 2016, Indian security personnel announced that their security forces had identified all six of the deceased attackers, and were trying to retrace their infiltration route to the Pathankot Airbase. Evidently this was not the case after all, as on 21 March 2016, the NIA released the photos of four of the militants and asked the public for help in the identification of the attackers. A week later, the Indian government announced that the NIA would provide DNA samples of the attackers to the Pakistani Joint Investigation Team (JIT) in hopes of identifying the possible parents of the slain militants.45  The BSF committed additional personnel resources to patrol the Pakistani/Punjab border; additional measures included using boats to patrol wetland and river areas, especially during the hours of darkness.46  On 17 January 2016, the Indian government announced a plan to erect “laser walls” at 40 vulnerable points along the Pakistani/Punjab border. These invisible walls will be used mainly in riverine areas where conventional walls are not practical. Prior to the previous July 2015 attack, the Indian government had erected most of its laser walls only along the Pakistani/Jammu & Kashmir border, the primary transit point for infiltrators into India.47

141 UNCLASSIFIED

Threat Action Report

 The Indian military revised the NSG standard operating procedures for defusing bombs and IEDs to avoid a recurrence of the type of incident that cost the life of the EOD commander during the Pathankot operation.48  India had recently removed 600 NSG Black Cat commandos’ VVIP (very, very important people) security duties, and Pathankot was this NSG unit’s first antiterrorism operation. Some observers in the security field believed the Pathankot operation validated the change in mission for the former VVIP Black Cats. Others questioned the necessity of calling in this NSG unit to Pathankot when other qualified forces were stationed near the airbase and possessed a greater familiarity with the local terrain.49  Similar to the aftereffects of the 2008 Mumbai attacks, the Pakistani government offered to help find the attackers. The Pakistani Prime Minister, Nawaz Sharif, ordered an investigation into the leads provided by Indian officials. On 11 January 2016, after Pakistan provided members for a joint Indian/Pakistani investigation team, officials arrested three suspects connected to the Pathankot Airbase attack. Two days later, Pakistani officials arrested several JeM militants, but their role in the Pathankot attack is uncertain. After a couple more days, Pakistani officials raided a school run by JeM and arrested additional suspects. Again, their role in the Pathankot attack remained undetermined.50  India and Pakistan delayed a conference of high government officials scheduled for 15 January 2016 in Islamabad, and neither party has proposed a date for rescheduling the meeting.51  On 13 April 2016, the Indian government issued a ban on building any kind of structure or planting of trees within 100 meters of the boundary wall of some Indian airbases.52

Results Between seven and ten Indian security personnel died in the Pathankot Airbase attack, along with the six intruders. The lack of specificity may be attributed to miscounting those who were mortally wounded and later died, or discrepancies related to naming conventions. Approximately 22 additional security personnel were wounded. Based on names listed in several sources, the dead belonged to four different military organizations:53  DSC: 754  IAF Commando: 1  IAF Garud Commando: 155  NSG: 156 Minor building damage also occurred, but no aircraft were damaged during the attack. Figure 10. A military honor guard pays final respects to one of the security personnel killed during the attack

142 UNCLASSIFIED

Threat Action Report

Concurrent Attack on Indian Consulate in Mazar-i-Sharif, Afghanistan

While Indian security personnel continued to search for additional intruders on the Pathankot Airbase, four armed militants attacked the Indian consulate on Sunday evening, 3 January 2016, in Mazar-i-Sharif, Afghanistan. Evidenced recovered after all four attackers died indicated that the attack on the consulate was also in retaliation for the hanging of Afzal Guru.57 While most of the consulate personnel were watching the Afghanistan-India soccer game on television Sunday evening, four armed invaders fired rocket propelled grenade rounds and attempted to attack the Indian facility. The Indo-Tibetan Border Police (ITBP), whose members guard Indian diplomatic missions, fired back, engaging the attackers for over an hour. The initial ITBP counterattack killed two of the intruders, while the other two armed men fled across the street and took refuge in a house. Indian special forces personnel then surrounded the building while the attackers continued to fire at the consulate and the Indian security personnel. Before dying, the two individuals wrote in their own blood on the wall that their motivation for the attack was the hanging of Afzal Guru, the same claimed motive as the attack earlier in the weekend at the Pathankot Airbase. None of the Indian consular staff was hurt in the attack, but eight ITBP security personnel were injured. The Indian government has no doubt that the same group carried out both attacks—the one at Pathankot Airbase and the one in Mazar-i-Sharif, Afghanistan—but others disagree.58

Analytical Assessment

While the attack in Afghanistan failed due to the IBTP’s alertness, the attack at the Pathankot Airbase failed in spite of the lack of security of the facility and the initial investigation’s ineptness. The actions of some retired military cooks may have caused the failure of the militants to achieve their objective at Pathankot. Two cells, most likely from the same organization, attempted to attack two targets on the same weekend at locations several hundred miles apart and in different countries. One of the attacks—at the Pathankot Airbase—was a complex attack with two separate cells operating independently. Each cell failed to accomplish its assigned mission, albeit at a cost of several Indian security personnel killed or wounded. In the corresponding mission in Afghanistan, the four attackers never made it into the consulate due to the alertness of the IBTP providing security. This attack failed despite the distraction of a televised major sporting event that captivated the attention of most Afghans as well as most of the Indian consulate staff. In the primary attack, at the Pathankot Airbase, the six infiltrators never made it closer than about 700 meters to the runway, where they hoped to destroy the IAF planes and helicopters. The IAF had flown all serviceable aircraft out of the airbase the night before, so there were very few targets left for the intruders to hit. Security personnel then guarded the remaining grounded aircraft and any other high-value targets on the airbase. The cell of four members fell behind schedule when one of their victims, a taxi driver, crashed his cab. This unforeseen event created a need to carjack another vehicle in order to continue the mission. Unluckily for the carjackers, the vehicle belonged to a police officer who began to alert authorities of the terrorist presence in the local area. A lost walkie-talkie prevented better coordination between the two groups, but the cells initiated their plan despite the communications breakdown. In stark contrast to the

143 UNCLASSIFIED

Threat Action Report

failure of the DSC guards, a UAV with a thermal camera spotted the group of four as the second group scaled the perimeter wall. Soon after this group began moving within the base, a QRT confronted it. The sudden appearance of intruders alarmed base personnel who observed them; especially DSC cooks who, as previously noted, took matters into their own hands and killed one of the intruders. Little time passed before additional security personnel arrived and cornered the remaining three individuals in that cell. While the Pathankot airbase seemed to fail to take precautions, national-level intelligence agencies were aware of an impending attack in Northwest India. The deployment of the Black Cat commandos demonstrated the Indian government’s realization of an upcoming militant operation against an Indian military facility. This information failed, however, to reach the lowest levels of the military and the police ignored possible signs of militants. The Indian security forces were unaware either of the number of intruders or the number of cells on the base. Authorities at first thought all of the intruders had been eliminated, since they had already broken into two separate groups before the first hostile contact. Two attackers remained at large, however, and took refuge in an unoccupied barracks that the Indian Figure 11. Soldier standing guard at the Pathankot Airbase security personnel did not search immediately. The oversight occurred because of the commander’s focus on protecting important buildings and infrastructure. After laying low for about 12 hours, the smaller element ambushed the Indian security forces from inside its two-story hiding-place. Then, based on guidance from their chain of command, Indian security personnel methodically eliminated the attackers to reduce the likelihood of incurring additional casualties, and painstakingly searched the entire airbase for any additional intruders. Other lessons learned:  The Border Security Force failed to seal off the infiltration point that the JeM cells used the previous July, enabling intruders who struck in January to cross the border at the same location. Once a security weakness is found, it must be immediately eliminated to prevent future exploitation by a threat actor.  Each BSF company was charged with responsibility for protecting an expanse of terrain that exceeded the capabilities of 100-man units. Lack of manpower resulted in fewer roving patrols, rendering the border vulnerable to infiltration.  Much of the night vision equipment for the BSF was inoperable. Proper maintenance of existing equipment and/or the purchase of additional equipment would allow the BSF to see the infiltrators during periods of limited visibility. Even after authorities learned of an impending border intrusion, at least four intruders found a way to elude the BSF and cross the border.  The local police discounted a local incident report. The Punjab police failed to take the reported carjacking seriously enough, mainly because they doubted a colleague’s professional judgement.

144 UNCLASSIFIED

Threat Action Report

Even reports that may not seem credible need to be passed to higher headquarters, in this case to the Indian intelligence agencies, for review. The presence of a stolen police vehicle 500 meters from the Pathankot Airbase on 1 January 2016—almost 14 hours before the initial firefight—received insufficient attention by installation authorities and security forces.  Upon report of possible terrorist activity, local security personnel require augmentation by qualified personnel equipped to handle the emergency. While the DSC is composed of retired military personnel, they are not trained to confront an organized militaristic group. Even though many of the DSC personnel displayed outstanding personal courage, too many lost their lives. The majority of the Indian security personnel killed at Pathankot belonged to the DSC.  A single commander should be in charge of operations and resource coordination. There seemed to be no one commander in charge at the Pathankot Airbase. The Indian government sent in highly-trained commandos from New Delhi—possible to justify their recent change of mission from VVIP duties to an anti-terrorism mission—but the NSG commandos had no personal knowledge of the terrain and were not accountable to the local chain of command. Many local army units remained idle during the operation, leaving the underqualified NSG to fend for itself in guarding the remaining aircraft and other high-value targets at the airbase. Regular Army units stationed in the Pathankot area may have provided better security.59

TRAINING IMPLICATIONS

While the actions of the attackers at the Pathankot Airbase exhibit some characteristics of a raid, the episode was actually an assault because the six perpetrators had no intention of exfiltrating the airbase after accomplishing their mission of destroying aircraft parked on the runways. The suicide factor is confirmed by the call one team member made to his mother, advising her that he would not .60  The cliché that a plan never survives first contact proved valid for the Pathankot episode. In this case, the taxi driver purposely wrecked his vehicle to deprive the cell of its planned mode of transportation. The militant cell were then compelled to carjack another vehicle in order to reach the airbase. While setting up a comparable set of circumstances might be difficult in a US training environment, the opposing force (OPFOR) could be given the latitude to adjust its plans, provided it continues to adhere to the intent of training objectives.  In training US units, a small OPFOR cell could attempt to infiltrate a command post, logistics point, airfield, or other rear area element to destroy equipment. This would test out the security of not only the local units, but the military police conducting roving patrols in the rear areas.  This attack contains parts of two examples found in the TRADOC G2 Handbook No. 1.07 (Change 3), A Soldier’s Primer to Terrorism TTP, published in August 2012. The two examples are titled “IED Bomb: Decoy and Primary” and “IED Bomb: Multiple Bombs,” and are located on pages 59– 60 of the handbook.  This attack could be part of some events found in the Decisive Action Training Environment (DATE) for training at both home station and the combat training centers. These events include “Border Incidents Cause a Resumption of Hostilities Between Two Countries” on page 3-5, “Local Army Helicopter Shot Down by Insurgents” on page 3-30, and “Port Attacked” on page 3-52.

145 UNCLASSIFIED

Threat Action Report

While not identical, these events found in DATE could be modified to create a similar training activity to what took place at the Pathankot Airbase.

Related Products

Other examples of attacks by small units can be found in previous Threat Reports (TR) and Threat Action Reports (TAR) published by ACE Threats Integration. These include  TAR—Janaale al-Shabaab Attack (Somalia)  TR—Camp Bastion Attack Oct 2012 Update (Afghanistan)  TR—Benghazi Attack (Libya)  TR—Attack at PAF Base Minhas Nov 2012 (Pakistan) See also the Red Diamond Newsletter, which contains current articles on a variety of topics useful to both soldiers and civilians ranging from enemy tactics and techniques to the nature and analysis of various threat actors. For detailed information on weapons and equipment, see the Worldwide Equipment Guide. To see more products from ACE-TI, visit the Army Training Network (ATN) with CAC access: https://atn.army.mil/dsp_template.aspx?dpID=377

POC

Author H. David Pendleton 913-684-7946 (COMM) 552-7946 (DSN)

TRADOC G-2 Analysis and Control Element Threats Integration (ACE-TI) 803 Harrison Drive, BLDG 467 Fort Leavenworth, KS 66027

Jon Cleaves, ACE-TI Director Jennifer Dunn, ACE-TI Deputy Director Jon Moilanen, ACE-TI Operations

146 UNCLASSIFIED

Threat Action Report

Note: Not all references listed in this publication are readily available to the public; some require a government common access card (CAC) to view.

References

ANI. “Six terrorists neutralised, combing ops on for safety purpose: Parrikar on Pathankot attack.” Business Standard. 5 January 2016. ANI. “Will be difficult for Pak’s JIT to link JeM’s role in Pathankot attack: Defence Expert.” NewsX. 27 March 2016. Bassi, Assem. “Bodies and ruins: Inside the Pathankot airbase, tales of a fierce fight.” Hindustan Times. 6 January 2016. Bassi, Assem and Vinay Dhingra. “Mop-up ops amid sporadic firing in Pathankot, Parrikar rushed to airbase.” Hindustan Times. 4 January 2016. Bassi, Assem and Vinay Dhingra. “2 terrorists inside Pathankot airbase, security ops in final stage.” Hindustan Times. 4 January 2016. Chauhan, Neerai. “Pathankot terror attack: Operations under way to neutralize two terrorists, government says.” The Times of India. 3 January 2016. Gupta, Muskesh. “Death toll from militant assault on Indian air base grows to at least 10.” Reuters. 3 January 2016. Gupta, Muskesh. “Gunfire, blasts at Indian air base, two militants still at large: TV.” Reuters. 3 January 2016. Gupta, Muskesh. “Operation to secure Pathankot air base continues – IAF.” Reuters. 3 January 2016. Hindustan Times. “Pathankot attack: From BSF to air force, many officers set to face action.” 6 January 2016. Nair, Rupam Jain and Krista Mahr. “Indian policeman: Militants abducted me before base attack.” Reuters. 5 January 2016. Ojha, Sangeeta. “Pathankot terrorists trained much better than 26/11 attackers: Report.” India Today. 4 January 2016. Reuters. “Operation to secure Indian air base continues: air force.” 3 January 2016. Reuters. “UPDATE 2-India air base attacks threatens Pakistan talks, fifth gunman killed.” 4 January 2016. Reuters. “What India needs to learn from the Pathankot air base attack.” 8 January 2016. Sura, Ajay. “’Pathankot response could’ve been better’.” The Times of India. 5 January 2016. The Times of India. “Combing operations on at Pathankot air base.” 6 January 2016. The Times of India. “Pathankot air base attack: 6 terrorists killed, combing still on.” 5 January 2016. The Times of India. “Pathankot Air Force base terror attack: Latest updates.” 2 January 2016. The Times of India. “6 terrorists who attacked Pathankot Air Force base neutralized, says Manohar Parrikar.” 5 January 2016. Vuradarajan, Tunku. “Reverse swing: Five lessons from Pathankot.” The Indian Express. 10 January 2016.

Figure Credits

Figure 1. Disputed areas between China, India, and Pakistan. Source: US Central Intelligence Agency. 2 September 2015. Figure 2. JeM Flag. Source: Wikimedia Commons. Used under the originator’s released into the public domain for any purpose, without any conditions, unless such conditions are required by law. 12 September 2008. Figure 3. Punjab district map. Source: Wikimedia Commons. Used under the Creative Commons Attribution-Share Alike 4.0 International license. 6 January 2016. Figure 4. Indian Prime Minister Nrendra Modi and Pakistani Prime Minister Sharif during their 25 December 2015 meeting. Source: Voice of America. 26 December 2015. Figure 5: Unoccupied BSF watchtower on the India-Pakistan border. Source: Wikimedia Commons. Used under the Creative Commons Attribution 3.0 Unported License, Version 1.2 or later. 13 January 2015. Figure 6. India NSG Black Cat commandos. Source: Wikimedia Commons . Used under the Creative Commons Attribution-Share Alike 4.0 International License. 26 January 2015. Figure 7. Pathankot Airbase attack. Source: ACE-TI. 28 March 2016. Figure 8. Event sequence on 2–3 January 2016. Source: ACE-TI. 28 March 2016. Figure 9. Armored car moves to Pathankot to support the search for the militants. Source: Voice of America. 19 February 2016. Figure 10. A military honor guard pays final respects to one of the security personnel killed during the attack. Source: Voice of America. 4 January 2016. Figure 11. Soldier standing guard at the Pathankot Airbase. Source: Voice of America. 5 January 2016.

147 UNCLASSIFIED

Threat Action Report

Endnotes

1 Thomas A. Marks. “Jammu & Kashmir: State Response to Insurgency – The Case of Jammu.” South Asia Terrorism Portal. Accessed 12 April 2016. 2 National Counter Terrorism Center. “Jaish-E-Mohammed (JeM).” September 2013; South Asia Terrorism Portal. “Jaish-e- Mohammed (Army of the Prophet).” Accessed 12 April 2016. 3 National Counter Terrorism Center . “Jaish-E-Mohammed (JeM).” September 2013; The Investigative Project on Terrorism. “Profile: Jaishe-e-Mohammed (JEM).” Accessed 12 April 2016; Mapping Militant Organizations. “Jaish-e-Mohammad.” Stanford University. 25 June 2015. 4 National Counter Terrorism Center. “Jaish-E-Mohammed (JeM).” September 2013; South Asia Terrorism Portal. “Jaish-e- Mohammed (Army of the Prophet).” Accessed 12 April 2016; Zee News. “Pathankot attack: Sartaz Aziz accepts Masood Azhar under ‘protective custody in Pak’; praises Hafiz Saeed.” 23 February 2016. 5 South Asia Terrorism Portal. “Jaish-e-Mohammed (Army of the Prophet).” Accessed 12 April 2016; India Today. “United Jihad Council claims responsibility for Pathankot attack.” 4 January 2016; Rupam Jain Nair and Krista Mahr. “Defence minister says six militants killed in Pathankot base operation.” Reuters. 5 January 2016; News 786. “United Jihad Council New Video Warns of More Attacks Like Pathankot; Threatens to Strike at Key Military Facilities.” 11 January 2016; Nazir Masoodi. “’Highway Squad’ Attacked Pathankot Base, Claims United Jihad Council.” NDTV. 4 January 2016; BBC. “Pathankot: Kashmir-based militant coalition claims attack.” 4 January 2016. 6 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015; South Asia Terrorism Portal. “Incidents and Statements involving Jaish-e-Mohammed: 1999-2012.” Accessed 12 April 2016. 7 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015. 8 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015. 9 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015. 10 Anti-Defamation League. “Jaish-e-Mohammed.” Accessed 12 April 2016; Barry Bearak. “26 Die as Suicide Squad Bombs Kashmir Legislative Building.” The New York Times. 2 October 2001; Mapping Militant Organizations. “Jaish-e- Mohammad.” University of Stanford. 25 June 2015; South Asia Terrorism Portal. “Incidents and Statements involving Jaish- e-Mohammed: 1999-2012.” Accessed 12 April 2016. 11 Anti-Defamation League. “Jaish-e-Mohammed.” Accessed 12 April 2016; BBC. “2001: Suicide attack on Indian parliament.” 13 December 2001; Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015; South Asia Terrorism Portal. “Incidents and Statements involving Jaish-e-Mohammed: 1999-2012.” Accessed 12 April 2016. 12 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015; BBC. “Timeline: Daniel Pearl kidnap.” 15 July 2002. 13 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015. 14 Anti-Defamation League. “Jaish-e-Mohammed.” Accessed 12 April 2016; BBC. “Gunmen attack Pakistan school.” 5 August 2002; Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015; Dawn. “Six killed in attack on Murree school.” 6 August 2012. 15 Anti-Defamation League. “Jaish-e-Mohammed.” Accessed 12 April 2016; BBC. “Deadly grenade attack at Pakistan hospital.” 9 August 2002; Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015; Dawn. “Islamabad: Attack on Taxila chapel widely condemned.” 11 August 2002. 16 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015; South Asia Terrorism Portal. “Incidents and Statements involving Jaish-e-Mohammed: 1999-2012.” Accessed 12 April 2016; CNN. “Musharraf survives two-pronged attack on convoy.” 25 December 2003. 17 Anti-Defamation League. “Jaish-e-Mohammed.” Accessed 12 April 2016; Tampa Bay Times. “Mosque attack leads to 5 deaths, 28 injuries.” 31 May 2005. 18 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015; South Asia Terrorism Portal. “Incidents and Statements involving Jaish-e-Mohammed: 1999-2012.” Accessed 12 April 2016. 19 Anti-Defamation League. “Jaish-e-Mohammed.” Accessed 12 April 2016; Mapping Militant Organizations. “Jaish-e- Mohammad.” University of Stanford. 25 June 2015. 20 Mapping Militant Organizations. “Jaish-e-Mohammad.” University of Stanford. 25 June 2015. 21 The Times of India. “Terror attacks in Punjab since 2001.” 2 January 2016. 22 Rohan Dua. “’Pathankot base was to be hit last July’.” The Times of India. 13 January 2016.

148 UNCLASSIFIED

Threat Action Report

23 The Times of India. “PM Modi meets Nawaz Sharif in surprise Lahore visit, Pak hails ‘goodwill gesture’.” 25 December 2015; The Times of India. “PM Modi to make surprise stopover in Pakistan, meet Nawaz Sharif.” 25 December 2015. 24 The Times of India. “PM Modi meets Nawaz Sharif in surprise Lahore visit, Pak hails ‘goodwill gesture’.” 25 December 2015; The Times of India. “PM Modi to make surprise stopover in Pakistan, meet Nawaz Sharif.” 25 December 2015; The Times of India. “’Climate change’ in India-Pakistan ties: PM Narenda Modi, Nawaz Sharif shake hands in Paris.” 30 November 2015. 25 Shruti Singh. “Pathankot attack: What has happened over the last 50 hours.” India Today. 4 January 2016; Mukesh Gupta and Rupam Jain Nair. “India works to disarm explosive in final stages of air base operation.” Reuters. 4 January 2016; BBC. “Pathankot attacks: Pakistan, India reschedule peace talks.” 14 January 2016. 26Yudhvir Rana. “Intrusion threat: High alert on border.” The Times of India. 31 December 2015; Rohan Dua. “Punjab had intel 5 days before Pathankot strike.” The Times of India. 5 January 2016; Sangeeta Ojha. “Five terrorist who attacked Pathankot air base killed.” India Today. 4 January 2016; Hindustan Times. “10 lessons we can learn from the Pathankot attack.” 6 January 2016; Hindustan Times. “Gaping holes along border, says BSF’s Pathankot attack report to Centre.” 5 January 2016; Neerai Chauhan. “Agencies decoded Pathankot attack plan on Friday morning: Sources.” The Times of India. 3 January 2016. 27 Rajesh Ahuja. “NIA has proof JeM leadership was in loop for Pathankot strike: Sources.” Hindustan Times. 28 March 2016. 28 Harkirat Singh, Assem Bassi, and Vinay Dhingra. “Attack on Indian air force base at Pathankot, Punjab; 5 terrorists, 3 security men killed.” SOTT. 2 January 2016; Neeraj Chauhan. “Agencies decoded Pathankot attack plan on Friday morning: Sources.” The Times of India. 3 January 2016; Yudhvir Rana and Rohan Dua. “Gurdaspur, Pathankot attackers infiltrated at the same point?” The Times of India. 3 January 2016; Assem Bassi. “Pathankot attack: Ops at ‘mature stage’ as gunfight continues.” Hindustan Times. 3 January 2016; Rohan Dua and Ydhir Rana. “Gurdaspur attackers had breached border at Bamiyal outpost.” The Times of India. 30 July 2015; Rohan Dua. “Pathankot air base attackers strolled over garlic, wheat fields in Bamiyal.” The Times of India. 7 January 2016; Press Trust of India. “Pathankot attack: Terrorists may have sneaked in through Bamiyal village.” India.com. 2 January 2016: India TV News. “BSF shot Intruder near Bamiyal border in Punjab.” 21 January 2016. 29 Sangeeta Ojha. “Five terrorists who attacked Pathankot air base killed.” India Today. 4 January 2016; Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; Mukesh Gupta and Rupam Jain Nair. “India works to disarm explosive in final stages of air base operation.” Reuters. 4 January 2016. 30 Chitleen K. Sethi and Rajesh Ahuja. “Two terror teams may have attacked Pathankot using different vehicles.” Hindustan Times. 4 January 2016; Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; The Times of India. “Timely intelligence on Pathankot attack saves Modi govt the blushes.” 3 January 2016; The Times of India. “Punjab border area on alert after senior police officer’s abduction.” 1 January 2016; The New Indian Express. “Pathankot Operation Nears Completion, 7 Securitymen martyred.” 3 January 2016; The Times of India. “Agencies intercepted 4 calls, including one to a terrorist’s mother.” 3 January 2016; Shishir Gupta. “Pathankot attack: Parrikar poses tough queries on infiltration.” Hindustan Times. 5 January 2016; Chitleen K. Sethi. “Did a lost walkie- talkie save the day at Pathankot?” Hindustan Times. 9 January 2016. 31 Rohan Dua. “Punjab on alert after Gurdaspur cop’s ‘abduction.” The Times of India. 1 January 2016; Rohan Dua. “Fidayeen returned to kill me, says Gurdaspur SP.” The Times of India. 5 January 2016; Rupam Jain Nair and Douglas Busvine. “Missed clues and lax security in runup to Pathankot air base attack.” Reuters. 4 January 2016; Assem Bassi and Vinay Dhingra. “Pathankot: Search ops to continue as 5th terrorist killed.” Hindustan Times. 5 January 2016; Bharti Jain. “Gurdaspur SP talked his way to freedom from terrorists.” The Times of India. 3 January 2016; Shishir Gupta. “Pathankot attack: Parrikar poses tough queries on infiltration.” Hindustan Times. 5 January 2016; Hindustan Times. “Missed clues, security gaps in run-up to Pathankot airbase attack.” 5 January 2016; Hindustan Times. “’Revenge for Afzal’: Messages in blood link Mazar- e-Sharif to Pathankot.” 6 January 2016; Neerai Chauhan. “Agencies decoded Pathankot attack plan on Friday morning: Sources.” The Times of India. 3 January 2016; The Times of India. “Agencies intercepted 4 calls, including one to a terrorist’s mother.” 3 January 2016; The Times of India. “Timely intelligence on Pathankot attack saves Modi govt the blushes.” 3 January 2016; The Quint. “Pathankot Attack: NIA Focuses on 10 Points to Unravel Plot.” 11 January 2016; The Indian Express. “Pak-based Jaish-e-Mohammad ‘handlers’ identified in Pathankot terror strike.” 7 January 2016. 32 Shruti Singh. “Pathankot attack: What has happened over the last 50 hours.” India Today. 4 January 2016; Rupam Jain Nair and Douglas Busvine. “Missed clues and lax security in runup to Pathankot air base attack.” Reuters. 4 January 2016; Hindustan Times. “Missed clues, security gaps in run-up to Pathankot airbase attack.” 5 January 2016; Rohan Dua. “Fidayeen returned to kill me, says Gurdaspur SP.” The Times of India. 5 January 2016; Bharti Jain. “Gurdaspur SP talked his way to freedom from terrorists.” The Times of India. 3 January 2016. 149 UNCLASSIFIED

Threat Action Report

33 Ajay Sura. “’Pathankot response could’ve been better’.” The Times of India. 5 January 2016; Rohan Dua. “Punjab on alert after Gurdaspur cop’s ‘abduction’.” The Times of India. 1 January 2016; Harkirat Singh, Assem Bassi, and Vinay Dhingra. “Attack on Indian air force base at Pathankot, Punjab; 5 terrorists, 3 security men killed.” SOTT. 2 January 2016; The Times of India. “Agencies intercepted 4 calls, including one to a terrorist’s mother.” 3 January 2016; BBC. “Why India’s response to Pathankot attack was ‘a debacle’.” 6 January 2016; The Times of India. “Planes left Pathankot air base after intelligence alert.” 6 January 2016; Neerai Chauhan. “Agencies decoded Pathankot attack plan on Friday morning: Sources.” The Times of India. 3 January 2016; The Times of India. “How NSG commandoes neutralized the terrorists at Pathankot Air Force base.” 5 January 2016; Assem Bassi. “Pathankot attack: Ops at ‘mature stage’ as gunfight continues.” Hindustan Times. 3 January 2016; The Times of India. “Punjab terror attack: For 24 hours security agencies failed to trace terrorists.” 2 January 2016; The Times of India. “Timely intelligence on Pathankot attack saves Modi govt the blushes.” 3 January 2016; Deeptiman Tiwary. “Pathankot attack: Terrorists hid for 20 hours before strike, says Home Ministry official.” The Indian Express. 9 January 2016. 34 Rupam Jain Nair and Douglas Busvine. “Missed clues and lax security in runup to Pathankot air base attack.” Reuters. 5 January 2016; Hindustan Times. “Missed clues, security gaps in run-up to Pathankot airbase attack.” 5 January 2016; Aseem Bassi and Vinay Dhingra. “Pathankot: Search ops to continue as 5th terrorist killed.” Hindustan Times. 5 January 2016; Mukesh Gupta and Rupam Jain Nair. “Militants attack Pathankot air base, 7 dead.” Reuters. 2 January 2016; Neerai Chauhan. “Agencies decoded Pathankot attack plan on Friday morning: Sources.” The Times of India. 3 January 2016; Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; DNA. “Pathankot attack: Militants took food in air force mess, slept in barracks: Sources.” 5 January 2016; Shruti Singh. “Pathankot attack: What has happened over the last 50 hours.” India Today. 4 January 2016; Sangeeta Ojha. “Five terrorists who attacked Pathankot air base killed.” India Today. 4 January 2016; Press Trust of India. “Locals Paid Rs. 20 To Enter Pathankot Base for Cattle Grazing: Intel Report.” NDTV. 12 January 2016; CoinMill.com – The Currency Converter. Rate as of 16 February 2016; Praveen Swami. “Pathankot terror attack: Terrorists hid overnight in airbase shed.” The Indian Express. 13 January 2016. 35 The Times of India. “Agencies intercepted 4 calls, including one to a terrorist’s mother.” 3 January 2016. 36 Bharti Jain. “Pathankot terror attack: ‘Fidayeen came in batches, hid in grass’.” The Times of India. 5 January 2016; Rupam Jain Nair and Douglas Busvine. “Missed clues and lax security in runup to Pathankot air base attack.” Reuters. 5 January 2016; Hindustan Times. “Missed clues, security gaps in run-up to Pathankot airbase attack.” 5 January 2016; BBC. “Pathankot: Gunmen attack India air force base near Pakistan border.” 2 January 2016; Shishir Gupta. “Pathankot attack: Parrikar poses tough queries on infiltration.” Hindustan Times. 5 January 2016; Chitleen K. Sethi and Rajesh Ahuja. “Two terror teams may have attacked Pathankot using different vehicles.” Hindustan Times. 4 January 2016; Chitleen K. Sethi. “Did a lost walkie-talkie save the day at Pathankot?” Hindustan Times. 9 January 2016; Praveen Swami. “Pathankot terror attack: Terrorists hid overnight in airbase shed.” The Indian Express. 13 January 2016; Sudhi Ranjan Sen. “How the Two Groups of Pathankot Terrorists Divided the Attack.” NDTV. 8 January 2016; Deeptiman Tiwary. “Pathankot attack: Terrorists hid for 20 hours before strike, says Home Ministry official.” The Indian Express. 9 January 2016; Presley Thomas. “2 terrorists sneaked into Pathankot base 48 hours before attack.” Hindustan Times. 21 February 2016. 37 The Times of India. “Planes left Pathankot air base after intelligence alert.” 6 January 2016; Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; DNA. “Pathankot attack: Militants took food in air force mess, slept in barracks: Sources.” 5 January 2016; Hindustan Times. “‘Militants were heavily armed, began spraying us with bullets’.” 4 January 2016; The New Indian Express. “Pathankot Operation Nears Completion, 7 Securitymen Martyred.” 3 January 2016; Mukesh Gupta and Krista Mahr. “Operation to flush out Indian air base attackers enters second night.” Reuters. 3 January 2016; Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; Rupam Jain Nair and Douglas Busvine. “Missed clues and lax security in runup to Pathankot air base attack.” Reuters. 4 January 2016; Hindustan Times. “Missed clues, security gaps in run-up to Pathankot airbase attack.” 5 January 2016; Aseem Bassi and Vinay Dhingra. “Pathankot: Search ops to continue as 5th terrorist killed.” Hindustan Times. 5 January 2016; Mukesh Gupta and Rupam Jain Nair. “Militants attack Pathankot air base, 7 dead.” Reuters. 2 January 2016; Neerai Chauhan. “Agencies decoded Pathankot attack plan on Friday morning: Sources.” The Times of India. 3 January 2016; Shruti Singh. “Pathankot attack: What has happened over the last 50 hours.” India Today. 4 January 2016; Sangeeta Ojha. “Five terrorists who attacked Pathankot air base killed.” India Today. 4 January 2016; Press Trust of India. “Locals Paid Rs. 20 To Enter Pathankot Base for Cattle Grazing: Intel Report.” NDTV. 12 January 2016; Praveen Swami. “Pathankot terror attack: Terrorists hid overnight in airbase shed.” The Indian Express. 13 January 2016; Presley Thomas. “2 terrorists sneaked into Pathankot base 48 hours before attack.” Hindustan Times. 21 February 2016. 150 UNCLASSIFIED

Threat Action Report

38 The New Indian Express. “Pathankot Operation Nears Completion, 7 Securitymen Martyred.” 3 January 2016; The Times of India. “Punjab terror attack: 4 terrorists killed in gunbattle at Air Force base in Pathankot.” 2 January 2016; Shruti Singh. “Pathankot attack: What has happened over the last 50 hours.” India Today. 4 January 2016. 39 DNA. “Pathankot attack: Militants took food in air force mess, slept in barracks: Sources.” 5 January 2016; Sangeeta Ojha. “Five terrorists who attacked Pathankot air base killed.” India Today. 4 January 2016; DNA. “Pathankot attack: Militants took food in air force mess, slept in barracks: Sources.” 5 January 2016; Harkirat Singh, Aseem Bassi, and Vinay Dhingra. “Attack on Indian air force base at Pathankot, Punjab; 5 terrorists, 3 security men killed.” SOTT. 2 January 2016; BBC. “Pathankot: Gunmen attack India air force base near Pakistan border.” 2 January 2016; New Indian Express. “Pathankot Operation Nears Completion, 7 Securitymen Martyred.” 3 January 2016; The Times of India. “How NSG commandoes neutralized the terrorists at Pathankot Air Force base.” 5 January 2016; Sangeeta Ojha. “Five terrorist who attacked Pathankot air base killed.” India Today. 4 January 2016; Aseem Bassi. “Pathankot attack: Ops at ‘mature stage’ as gunfight continues.” Hindustan Times. 3 January 2016. 40 DNA. “Pathankot attack: Militants took food in air force mess, slept in barracks: Sources.” 5 January 2016; Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; BBC. “Pathankot: Gunmen attack India air force base near Pakistan border.” 2 January 2016; Sangeeta Ojha. “Five terrorist who attacked Pathankot air base killed.” India Today. 4 January 2016; Reuters. “Sixth militant killed at Pathankot air base – home ministry source.” 3 January 2016; Aseem Bassi, Vinay Dhingra, and Rajesh Ahuja. “Pathankot final assault: Forces ready with rocket launchers, choppers.” Hindustan Times. 4 January 2016. 41 Aseem Bassi, Vinay Dhingra, and Rajesh Ahuja. “Pathankot final assault: Forces ready with rocket launchers, choppers.” Hindustan Times. 4 January 2016; Mukesh Gupta and Krista Mahr. “Operation to flush out Indian air base attackers enters second night.” Reuters. 3 January 2016; The Times of India. “Planes left Pathankot air base after intelligence alert.” 6 January 2016; Sangeeta Ojha. “Five terrorists who attacked Pathankot air base killed.” India Today. 4 January 2016; New Indian Express. “Pathankot Operation Nears Completion, 7 Securitymen Martyred.” 3 January 2016; Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; The Times of India. “How NSG commandoes neutralized the terrorists at Pathankot Air Force base.” 5 January 2016; Hindustan Times. “Pathankot attack: Parrikar admits security lapses; Sharif assures prompt action.” 6 January 2016. 42 Sangeeta Ojha. “Five terrorists who attacked Pathankot air base killed.” India Today. 4 January 2016. 43 The Times of India. “Pathankot terror attack: Security beefed up in J&K.” 3 January 2016. 44 Sangeeta Ojha. “Five terrorists who attacked Pathankot air base killed.” India Today. 4 January 2016. 45 Neerai Chauhan. “Pathankot attack: Six JeM terrorists identified, cops retrace their route.” The Times of India. 4 January 2016; Bharti Jain. “Help NIA identify these Pathankot attackers.” The Times of India. 21 March 2016; Rahul Tripathi. “Pathankot attack: India to share DNA report of militants with Pakistan’s JIT.” Hindustani Times. 28 March 2016. 46 Press Trust of India. “After Pathankot Attack, More Laser Walls Along Indo-Pak Border.” NDTV. 17 January 2016. 47 Press Trust of India. “After Pathankot Attack, More Laser Walls Along Indo-Pak Border.” NDTV. 17 January 2016. 48 Hindustan Times. “After Pathankot attack, NSG to revise SoPs to defuse bombs, IEDs.” 12 February 2016. 49 Hindustan Times. “NSG pulls out 600 commandoes from VVIP duties for anti-terror ops.” 15 February 2016; BBC. “Why India’s response to Pathankot attack was ‘a debacle’.” 6 January 2016. 50 India TV. “Pathankot attack: Pak PM Nawaz Sharif ‘orders probe into leads provided by India’.” 8 January 2016; Deccan Chronicle. “Pakistan arrests 3 suspects, forms joint investigation team to probe Pathankot attack.” 11 January 2016; BBC. “Pathankot attack: Pakistan says arrests Jaish-e-Mohammad militants.” 13 January 2016; BBC. “Pathankot attack: Pakistan raids Jaiesh-e-Mohammad schools.” 15 January 2016; Reuters. “Militant who claimed responsibility for Pathankot attack warns Pakistan against crackdown.” Business Insider. 21 January 2016; Hindustan Times. “Pakistan has detained Pathankot suspects, details can’t be shared: NIA.” 30 March 2016. 51 BBC. “Pathankot attacks: Pakistan, India reschedule peace talks.” 14 January 2016. 52 Indian Defence News. “No Building in 100 Meter Radius Outside Trishul Airbase.” 13 April 2016. 53 Abhishek Pandey. “The Story of 8 Martyrs of Pathankot Attacks Who Gave Their Lives For The Nation.” ZealPeal. 4 January 2016; NDTV. “NSG Lieutenant Colonel Among 7 Martyred in Pathankot Attack, Funeral Today.” 4 January 2016; The Times of India. “Pathankot attack: 3 securitymen injured in fresh blast, 7 bravehearts martyred.” 3 January 2016; World News India. “Pathankot Attack: Heroes Who Lost Their Lives.” 5 January 2016; Harshmeet Singh. “Sepoy Mohit Singh, Lance Naik Phoolwant Singh, Sepoy Sanjeevan Singh – The Pathankot Martyrs Who Protected Us Till Their Last Breath.” Great Indian Heroes. 4 January 2016. (Link is not accessible from a US government computer.) 54 The Times of India. “Pathankot attack: Commonwealth gold medalist Fateh Singh martyred.” 3 January 2016; Press Trust of India. “Parkash Singh Badal meets bereaved families of personnel killed in Pathankot.” India.com. 4 January 2016; 151 UNCLASSIFIED

Threat Action Report

Anju Agniholtri Chaba and Chak Sharif. “Pathankot martyr: First home posting in 30 years cut short.” The Indian Express. 4 January 2016; Yudhvir Rana. “Bombs, bullets and bravery in Pathankot: Story of our heroes.” The Times of India. 4 January 2016; The Tribune. “Two from Himachal martyred in Pathankot attack.” 3 January 2016. 55 Hindustan Times. “Pathankot martyr Gursewak Singh cremated with full military honours.” 4 January 2016. 56 India.com. “Pathankot Attack: Martyred Lt. Colonel Niranjan Kumar to be cremated today; Siddarmaiah offers compensation to family.” 4 January 2016. 57 The Hindu. “Attack on Indian consulate in Afghanistan foiled.” 3 January 2016; Bashir Ansari. “Explosions, gunshots at Indian consulate in Afghan city Mazar.” Reuters. 3 January 2016; Bashir Ansari. “Afghan forces end siege near Indian consulate in Mazar-i-Sharif.” Reuters. 4 January 2016. 58 The Hindu. “Attack on Indian consulate in Afghanistan foiled.” 3 January 2016; Bashir Ansari. “Explosions, gunshots at Indian consulate in Afghan city Mazar.” Reuters. 3 January 2016; Bashir Ansari. “Afghan forces end siege near Indian consulate in Mazar-i-Sharif.” Reuters. 4 January 2016; Hindustan Times. “’Revenge for Afzal’: Messages in blood link Mazar-e-Sharif to Pathankot.” 6 January 2016. 59 Rahul Singh. “Questions raised over special forces not being deployed in Pathankot.” Hindustan Times. 6 January 2016. 60 The Times of India. “Agencies intercepted 4 calls, including one to a terrorist’s mother.” 3 January 2016; Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. Pgs 3-20 to 3-21 and 3-36 to 3-40.

152 UNCLASSIFIED

RED DIAMOND ARTICLES

TRADOC G-2 ACE THREATS INTEGRATION

Red Diamond

INTRODUCTION—Red Diamond

TRADOC G-2 ACE Threats Integration is the originator and producer of the Red Diamond newsletter. This monthly publication is e-distributed by the TRADOC G-2 Operational Environment Enterprise (OEE) to provide current and recurring analysis of threats throughout the world and the implications for representing or replicating those threats in US Army training, professional education, and leader development. Observations and lessons learned on threats identify tactics and techniques employed in engagements, battles, or long-term activities that include regular, irregular, or hybrid forms of conflict among state and non-state actors. Articles published in the Red Diamond are researched and referenced from open source information, and support the US Army and TRADOC charter to describe a realistic, robust, and relevant opposing force (OPFOR) as an adversary or enemy in probable or known operational environments for training to Army readiness standards. Red Diamond augments the Army’s Training Circular 7-100 series on OPFOR tactics, techniques, and force structure, as well as unclassified data on weapon systems and equipment capabilities presented in the TRADOC G-2 Worldwide Equipment Guide. Actions, capabilities, and limitations of threats in these articles are a foundation for the challenging rigor of complex conditions in the US Army’s Decisive Action Training Environment (DATE) produced by TRADOC G-2.

154 UNCLASSIFIED

Red Diamond

Contents

INFOWAR: North Korean Capabilities, Part 2 of 2 (Jan 2015 ...... 157 Wadi al Deif and al Hamadiyah Military Base Attacks (Feb 2015) ...... 164 People’s Liberation Army: Challenges to US Warfighting Functions (Jun 2015) ...... 170 Fight for HAMA 2014 (Jul 2015) ...... 174 WEG: Chinese SLC-2 Artillery Locating Radar (Aug 2015) ...... 180 Threat Tactical Vignette: Recon and Raid (Sep 2015) ...... 184 Cartel Warfare: Analyzing Mexican Drug Trafficking Organizations (Oct 2015) ...... 195 Russian Tactics in Syria (Nov 2015) ...... 202 Mission Command Training Program: Warfighter Exercise (WFX) 16-2 (Feb 2016) ...... 207 DATE-Based Scenario Concepts for Training (Apr 2016) ...... 215 Hotel al Shabaab: Why and How the Group Targets Hotels (May 2016) ...... 223 JMRC DATE Rotation 16-04: Saber Junction 16-04 (May 2016) ...... 229 Antilanding Operations and Threats to Aircraft (Jun 2016) ...... 236 New Egyptian Plague: ISIL and the Sinai Province (Jun 2016) ...... 241 Threat 2025+: Hybrid Threat Blueprint Two (Jul 2016) ...... 250 Militia Battalions in the Ukrainian Conflict, Part 2: Pro-Russia Units (Aug 2016) ...... 255

155 UNCLASSIFIED

Red Diamond http://eoimages.gsfc.nasa.gov/images/imagerecords/58000/58069/Korea.A2002091.0240.500m.jpg

North Korean Capabilities

Part 2 of 2 by H. David Pendleton, TRISA- CTID (CGI Ctr) Introduction This is the second in a two-part series on North Korean Information Warfare (INFOWAR) capabilities. In part one, published in November 2014 in the Red Diamond, a historical examination of recent North Korean INFOWAR attacks described three of the INFOWAR capabilities: Electronic Warfare, Computer Warfare, and Information Attack. This article will examine the other four INFOWAR capabilities— Deception, Physical Destruction, Protection and Security Measures, and Perception Management—as well as an analytical assessment and a review of potential training implications. Deception Deception activities as defined by Training Circular (TC) 7-100.2, Opposing Forces Tactics, include measures designed to mislead adversaries by manipulation, distortion, or falsification of information. The aim of Deception is to influence opponents’ situational understanding and lead them to act in a manner that favors the adversary or is prejudicial to their own interests. Deception measures are a part of every military operation, and are also used to achieve political and economic goals. The international media may be a target for deceptive information at the operational level, being fed false stories and video that portrays tactical-level actions with the goal of influencing operational or even strategic decisions.1 North Korea has made extensive use of Deception since the Korean War in 1950–1953, especially methods that have low cost but high payoff. The Korean People’s Army (KPA) uses underground shelters and tunnels to operate to avoid detection by satellite and decoys at all their air bases that use old MiG-15 and MiG-21 aircraft. In 2010, a DPRK military manual smuggled out of North Korea gave instructions on various Deception techniques including radar-absorbing paint to help conceal jets, warships, and tanks; bogus paved runways; Figure 1. North Korea Propaganda Urban Setting decoy fabrication; and how to make stationary units appear as units on the move.2

The DPRK also uses deception for reasons outside the military, especially for foreign tourists visiting North Korea. The DPRK uses the money the visitors pay to visit North Korea to gain hard currency. DPRK

157 UNCLASSIFIED

Red Diamond

officials attempt to shape the visit by limiting access to only those areas approved by the North Korean government. See figure 1. These orchestrated tours provide the visitors with an overly favorable view of the living conditions in the DPRK. Often these attempts at deception are blatant and the visitors accidently get to see the unadulterated view of North Korea with its absence of cars, low-quality housing, and a diet so poor that the North Koreans are substantially shorter in stature than their cousins to the south. Until recently, the DPRK government denied the existence of any forced labor camps in North Korea. On 8 October 2014, a North Korean foreign ministry official stated that while there were no political prisons in the DPRK, there were “reform through labor” camps where citizens go to improve their mentality and look at their wrongdoings. Estimates of North Korean prisoners in these camps range from 50,000 to 200,000.3 Protection and Security Measures The purpose of INFOWAR protection and security measures is to protect one’s own information infrastructure, maintain capabilities for effective command and control (C2), and deny protected information to other actors. INFOWAR Protection and Security Measures include: information collection, processing, and utilization; reconnaissance and counter-reconnaissance; information and operational security; force protection; and secure use of information-collection and processing systems. Information and Operations Security North Korea does an excellent job in information and operations security because the DPRK government controls what information flows inside and outside of the country. One of the most difficult feats to achieve by other countries is cyber reconnaissance of North Korea because there are so few Internet connections from the DPRK to the outside world. North Korea also uses websites hosted in China and other countries possibly to avoid their systems from becoming a target by other countries. With so few Internet connections, the North Korean government has fewer openings to guard against outside intrusion. The DPRK Internet architecture allows the North Koreans to conduct offensive INFOWAR over the Internet to the rest of the world, often through another country, while simultaneously somewhat easily maintaining its own computer network defenses.6 The DPRK operates an effective internal information operations (IO) campaign that uses propaganda and other methods against its own citizens that bolsters national pride while deceptively encouraging each North Korean to distrust any person from a foreign country. Anyone that questions the DPRK IO campaign may be sent to one of the political prison camps. To protect their own citizens from the receipt of information from foreign sources, the DPRK cyber infrastructure operates two systems. The outward system that is the Internet familiar to the rest of the world is only available to a very limited number of North Koreans approved by the government and these individuals’ activities are closely monitor. Foreign visitors, especially those in Pyongyang, can also access the normal Internet. The vast majority of North Koreans with access to the Internet can only use the Kwangmyong or a nationwide intranet only found in the DPRK. The Kwangmyong only allows the users to reach selected Internet websites approved by the North Korean government. Most of these websites are run by a DPRK government agency including the top three most visited websites: the Korean Central News Agency (KCNA); Rodong, another North Korean news website, and Naenara, North Korea’s official website.7

158 UNCLASSIFIED

Red Diamond

While there are now approximately 1.5 to 2 million mobile phone users in North Korea, the DPRK government does not allow the phones to connect to the Internet. Additionally, almost all cellular phone data plans available in the DPRK can only make domestic calls. Unauthorized cell phones can be found in the gray market and some Chinese cell phones are also in operation. If necessary, the North Korean government reserves the ability to make all cellular networks available for military use.8 Camouflage, Concealment, Cover, and Deception For many decades, North Korea has shown a fondness for camouflage, concealment, cover, and deception at the tactical, operational, and strategic levels. Due to the inability for the DPRK to take control of the air space, the KPA’s survival will mostly be based on the inability of those in the air to discern military targets from civilian targets. While many factories and military positions have been built underground all along the DMZ, there are approximately 20 tunnels that cross the shared border between the two Koreas. Four of the tunnels have been discovered in the last 50 years. The DPRK often deflects the criticism of any tunnels found by calling them mining sites.9 Perception Management Perception management involves measures aimed at creating a perception of truth that furthers an actor’s objectives. Perception Management integrates several widely differing activities that use a combination of true, false, misleading, or manipulated information. Enemy or foreign audiences, as well as an actor’s own public, may be the targets. Perception Management can include misinformation, media manipulation, and psychological warfare (PSYWAR). PSYWAR is the capability and activities designed to influence selected friendly, neutral, and/or hostile target audiences’ attitudes and behaviors in support of the actor. PSYWAR can target either specific decision-making systems or the entire information system of the target audience, while influencing key communicators and decision makers. Such attacks target an enemy’s perceived centers of gravity. The DPRK is the most closed and security- conscious society in the world and attempts to manage the perception of North Korea both inside and outside the country. The Korean government controls all media in the state whether it is newspapers, television shows, or radio broadcasts. Radios sold in North Korea can only be tuned to government-approved stations. Movies shown in the theaters must be approved by the DPRK government. Even the animation industry that makes cartoons must conform to governmental standards and control. The government ensures that artists only make products that meet the approved themes and are not influenced by foreigners.

Pictures of Kim Il Sung, Kim Jong Il, and Kim Jung Un dominate the cityscape in all North Figure 2. North Korean billboard Korean countries. The North Korean people

159 UNCLASSIFIED

Red Diamond

are taught to love their leaders by creating a cult of personality by calling them “The Great Leader,” “Eternal President,” and “Supreme Leader” respectively. The DPRK’s Unit 204 is responsible for propaganda for North Korea. DPRK propaganda includes the use of posters, traditional media outlets, websites, and social media to internally shape the views of the North Korean citizens. See figure 2. In addition, Unit 204 also attempts to persuade foreign audiences to look upon the DPRK in a positive manner. Unit 204 posts propaganda videos not only to internal websites that North Korean citizens can access, but international websites also such as YouTube. North Korea Today also has profiles on Twitter and Facebook for external consumption even though the latter only had 33 “likes” as of 8 October 2014. North Korea even alters the photos of their past president, Kim Jong Il, to make him appear younger and healthier in attempt to change the North Korean people’s perception of their leader. The DPRK can air deliver leaflets to South Korea through a variety of methods including balloons and unmanned aerial vehicles (UAVs). American military personnel and South Koreans have found these propaganda leaflets for decades in the DMZ and just south of the border between the two countries.10 Physical Destruction Physical Destruction, as an INFOWAR element, involves measures to destroy critical components of the enemy’s information infrastructure. Adversaries will integrate all types of conventional and precision weapon systems to conduct destructive fires, including fixed and rotary-wing aviation, artillery, multiple rocket launchers, surface-to-surface missiles, electromagnetic pulse (EMP) weapons, and improvised explosive devices (IED). Physical Destruction activities can be integrated with jamming to maximize their effects. Specific missions are carefully timed and coordinated through the INFOWAR plan and actions of the supported units. Direct action missions by North Korean Special Purpose Forces (SPF) would be one of the options for physical destruction missions against INFOWAR targets. The North Korean military fields a vast number of SPF forces compared to the militaries of most other countries. See table 1.

Table 1. North Korean missile data (examples) DPRK Missile Range Payload Warhead Circular Launcher/ Likely Status (KM) (KG) (Type) Error Fuel Targets Probable (CEP) (Meters) KN-02 (Modified 100-120 250-500 Conventional 100-200 Mobile, Tactical Testing SS-21 Scarab) Solid Fuel Targets in South Korea KN-08 160-200 125-175 Conventional 100-300 Mobile, South Possibly Unknown Korea Fake Kwasong-5 300-320 1,000 Conventional, 800-1,000 Mobile, South Deployed; (SCUD-B) possible NBC Liquid Fuel Korea Exported Hwasong-6 500 700-770 Conventional, 700-2,000 Mobile, South Deployed, (SCUD-C) (Calculated) possible NBC Liquid Fuel Korea Exported

160 UNCLASSIFIED

Red Diamond

DPRK Missile Range Payload Warhead Circular Launcher/ Likely Status (KM) (KG) (Type) Error Fuel Targets Probable (CEP) (Meters) Hwasong-6 500 700-770 Conventional, 700-2,000 Mobile, South Deployed, (SCUD-C) (Calculated) possible NBC Liquid Fuel Korea Exported Nodong-1 500-1,000 600-700 Conventional, 1,000- Mobile, Japan Deployed, (Calculated) possible NBC 4,000 Liquid Fuel Exported (SCUD E) Taepondong-1 2,500- 75-750 Conventional, 1,000- Mobile, Guam, Possibly (R-27/SS-N-6) 10,000 possible NBC 2,500 Liquid Fuel Japan, Deployed, (Estimated) Okinawa Exported Hwasong-7 700-1,000 500-750 Conventional, 700 Mobile, South Deployed, (SCUD-D) (Calculated) no info on Liquid Fuel Korea Exported other types Taepodong-1 2,200 50-150 Conventional, Unknown Fixed, Guam, Testing, (Paektusan-1) (Calculated) possible NBC Liquid Fuel Japan, Possibly Okinawa Deployed, Exported Musudan BM-25 3,200-4,000 500-1,000 Conventional, 1,600-? Unknown Guam, Unknown (SCUD F) possible NBC Japan, Okinawa Taepodong-2 6,000- 100-1,000 Conventional, 2,000- Fixed, United R&D, 15,000 possible NBC 5,000 Liquid Fuel States Testing, (Estimated) Prototype

North Korea possesses a number of weapons that can be used to conduct INFOWAR by destroying the information infrastructure. These weapons range from a battery-driven electro-magnetic pulse (EMP) device that can disrupt electric devices, including computers, at short range to missiles that could be used against larger physical targets of various sizes. The DPRK can produce a high-altitude EMP (HEMP) through a nuclear detonation and has enough plutonium on hand to build approximately four to ten nuclear weapons.4 North Korea operates a large number of missile weapons that can carry conventional or weapons of mass destruction (WMD) warheads with ranges from 100 to 6,000 km. These missiles are listed below with their capabilities. The current KPA missile inventory is approximately 700 to 1,000 missiles. This does not include the 100 to 150 missiles that are going through initial operational testing and evaluation or the 325 to 400 missiles intended for foreign military sales.5 Applicability to DATE Many of the capabilities found in North Korea can be found in the Decisive Action Training Environment (DATE), primarily in the fictitious countries of Ariana and Donovia. Ariana primarily operates Tier 2 equipment (10-20 years in age) with selected Tier 1 equipment capabilities. Donovia fields primarily Tier 1 and Tier 2 equipment throughout their military forces. This equipment composition holds true for equipment that can be used to conduct INFOWAR. DATE users, at the combat training centers (CTC) and at their home stations, can select the INFOWAR equipment necessary to achieve the commander’s training objective. Scenario developers can increase or decrease the amount and qua lity of the Red Force’s INFOWAR equipment to achieve the desired training effect. With the information

161 UNCLASSIFIED

Red Diamond

on INFOWAR capable equipment found in the WEG, the scenario writers can develop the level of difficulty necessary to train the friendly forces. Analytical Assessment While the North Korean conventional weapons continue to become more obsolete due to their age, the DPRK government continues to use its limited fiscal resources to improve their asymmetric warfare capabilities such as to wage INFOWAR against its enemies—South Korea, Japan, and the United States. Despite sanctions against North Korea, the DPRK continues to improve the seven core INFOWAR capabilities: Electronic Warfare; Computer Warfare; Information Attack; Deception; Physical Destruction; Protection and Security Measures, and Perception Management. During peacetime, North Korean perception management appears more focused on their own people than on any outside threat. North Korea conducts INFOWAR against both external enemies and their own citizens through the extensive use of perception management. The DPRK strictly controls the information disseminated internally to its own people. With the North Korean government firmly controlling Internet access, the people are limited in what information they receive from abroad, but it also reduces the number of openings that external agencies can seek access to the DPRK’s cyber activities. The lessons learned from internal perception management operations, however, could be used against external enemies in the event of actual conflict. North Korea continues to tests its INFOWAR capabilities through real-time attacks on South Korea’s networks, UAV surveillance south of the border between the two countries, and the testing of new rocket technology that could be used to physically attack important cyber systems. North Korea takes many of these actions in anticipation of or in response to joint exercises between the South Korean and American militaries. There is no indication that the DPRK will change its tactics and it is likely that these attacks will continue into the foreseeable future.11 Training Implications Chapter 7 of TC 7-100.2, Opposing Force Tactics, discusses INFOWAR. Like North Korea, the opposition force (OPFOR) will use a variety of actions to destroy, degrade, disrupt, deny, deceive, exploit, and influence the American military. The OPFOR will use the same seven INFOWAR elements—Electronic Warfare, Computer Warfare, Information Attack, Deception, Physical Destruction, Protection and Security Measures, and Perception Management—that the DPRK and KPA will use on the Korean peninsula. Realistic INFOWAR training in peacetime will better prepare American Army units to successfully fight and win the INFOWAR in the next conflict.12 OPFOR at the various CTCs can use some of the seven INFOWAR elements during actual exercises, but others are more difficult to replicate.  Electronic Warfare (EW): The OPFOR may be able to use some EW assets that can emulate DPRK EW systems including GPS jamming. For some locations, such as the Joint Maneuver Readiness Center (JMRC) in Germany, the host nation government may restrict electronic emissions/jamming as the electronic signatures may interfere with commercial and/or host nation electronic systems. These restrictions will make it impossible to fully replicate the EW that American military forces may face on the Korean peninsula.  Computer Warfare (CW): The CTCs now attempt to replicate CW during training exercises to give the friendly forces a realistic expectation of the actual cyber battlefield. Once again, it is difficult to fully replicate a CW attack if the friendly forces are actually connected to the Internet.

162 UNCLASSIFIED

Red Diamond

 Information Attack (IA): The CTCs are now doing a much better job of replicating IA against the units going through training as OPFOR hackers can attempt to enter the friendly computer systems to obtain or change the data on the websites.  Deception: The OPFOR makes extensive use of deception in its plans to influence the leaders on the other side to make poor decisions.  Physical Destruction: The OPFOR, through the Multiple Integrated Laser Engagement System (MILES) worn by individuals or mounted on vehicles, can replicate the physical destruction of targeted information systems.  Protection and Security Measures: Through the use of Operations Security (OPSEC) and other means, the OPFOR can operate similarly to how the KPA would operate in actual combat situations. Civilians on the Battlefield (COB) play at the CTCs would be a possible role to demonstrate the effects of North Korean propaganda. The cradle-to-grave North Korean propaganda machine would make it more difficult for US psychological operations (PSYOP) to affect the North Korean civilians. COBs would need to replicate this difficulty during training.  Perception Management: In conjunction with the deception campaign, the OPFOR can use an overall IO campaign to shape the perception of the OPFOR by the units undergoing training. Unlike the real world in North Korea, the OPFOR will not attempt to conduct Perception Management on its own forces.

Notes 1 United States Army, Training Circular (TC) 7-100.2, “Opposing Force Tactics,” December 2011, pp 7-4 and 7-7. 2 Steve Herman, “Secret Manual Gives Glimpse of North Korean Military Tactics,” Voice of America, 18 September 2010; Jane’s Sentinel Security Assessment, “Strategic Weapons Systems,” North Korea, 23 July 2014. 3 Newser, “North Korea: Yes, We Have Labor Camps,” 8 October 2014. 4 United States Army, “Information Environment Assessment (IEA),” Training and Doctrine Command (TRADOC) G2 Intelligence Support Activity (TRISA) Threats, June 2008. 5 Missile Threat, “KN-08,” Undated; Jane’s Sentinel Security Assessment, “Strategic Weapons Systems,” North Korea, 23 July 2014; United States Army, “Information Environment Assessment (IEA),” Training and Doctrine Command (TRADOC) G2 Intelligence Support Activity (TRISA) Threats, June 2008. 6 Hewlett-Packard Development Company, “Profiling an enigma: The mystery of North Korea’s cyber threat landscape,” HP Security Briefing, Episode 16, August 2014, pp 26 and 58. 7 Ashley Moreno, “Social Media in North Korea,” The Austin Chronicle, 11 March 2013; Rick Newman, “Here’s How Lousy Life Is in North Korea,” 12 April 2013; Darren Pauli, “NORKS hacker corps reaches 5,900 sworn cyber soldiers – report,” The Register, 7 July 2014; Peter Kujundzic, “In North Korea: No one said anything,” 15 October 2010: Hewlett-Packard Development Company, “Profiling an enigma: The mystery of North Korea’s cyber threat landscape,” HP Security Briefing, Episode 16, August 2014, p 13. 8 Office of the Secretary of Defense, “Military and Security Developments Involving the Democratic People’s Republic of Korea,” Annual Report to Congress, 2013; Ashley Moreno, “Social Media in North Korea,” The Austin Chronicle, 11 March 2013; Rick Newman, “Here’s How Lousy Life Is in North Korea,” 12 April 2013. 9 Paula Hancocks, “Is North Korea still digging tunnels to the South?,” CNN, 2 October 2014. 10 Hewlett-Packard Development Company, “Profiling an enigma: The mystery of North Korea’s cyber threat landscape,” HP Security Briefing, Episode 16, August 2014, pp 30-34. Facebook, “North Korea Today,” 8 October 2014; Strategy Page, “Murphy’s Law: Why Iran and North Korea Don’t Give A Damn,” 6 November 2013; Jane’s Sentinel Security Assessment, “Strategic Weapons Systems,” North Korea, 23 July 2014. i1 Hewlett-Packard Development Company, “Profiling an enigma: The mystery of North Korea’s cyber threat landscape,” HP Security Briefing, Episode 16, August 2014, pp 58-59. i2 United States Army Training Circular 7-100.2, “Opposing Force Tactics,” 9 December 2011, pp 7-2 and 7-3.

______

163 UNCLASSIFIED

Red Diamond

Wadi al Deif and al Hamadiyah Military Base Attacks

by Rick Burns, TRADOC G2 ACE-Threats Integration (BMA Ctr) On 14–15 December 2014, Jabhat al Nusra (JN) and Al Ahrar al Sham with their allies captured the strategically important Syrian Wadi al Deif and al Hamidiyah military bases in coordinated attacks. JN, Al http://1.bp.blogspot.com/Ahrar, and other allies spent two - yearsatD2Tn4d slowly seizing-_8/U key- camps allowing them to control the surrounding area, including small villages, isolating the two military bases. As they are situated along the xflbNbxLI/AAAAAAAADGs/PTwbOx5ZqTM/s1600/Photo%2B17.jpgM5 north-south, Damascus to Aleppo highway, and south east of the down Ma’arat al-Numan in Idlib province Syria, this forced their sustainment to come only by air.1 This was an important success for JN as it cemented its position as the dominant militant organization in Idlib province.2 It now controls most of the province at the expense of a shrinking Syrian regime military presence.3 Similar to ISIL in Raqqa province, JN has patiently contained Syrian forces over weeks and months and forced them to retreat from key areas. While JN has played the central role in operations in Idlib province, it operates with a coalition of other smaller groups. This article does not attempt to identify the discrete organizations involved in operations below the lead groups. JN led the offensive attack on the Wadi al Deif base and Ahrar al Sham led the assault on the al Hamidiyah base. Cutting the Supply Line The M5 highway has been highly contested for its strategic importance and because of JN’s continuing efforts to push Syrian forces completely out of Idlib province. In late spring 2014, the Syrian government concentrated units in Aleppo city and Deraa province, positioning fewer forces in Idlib province and leaving it vulnerable to attacks from opposition groups. This corresponded with JN’s spring 2014 offensive, attacking and seizing control of key Syrian positions as it moved north along M5 highway until it reached the al Hamidiyah and Wadi al Deif military bases. Cutting a key communication and supply route, opposition groups slowly increased pressure and stress on the ever more isolated defenders of the two camps. Khan Sheikhoun, a city straddling M5 highway, was the target of a major offensive beginning on 3 April 2014. JN, Suquor al Sham, , and smaller groups targeted 21 checkpoints and military bases within Khan Sheikhoun. On 26 May 2014 the final checkpoint was taken and the city fell to the opposition groups. On 23 May 2014, Syrian opposition forces seized the town of Hish, a major obstacle to controlling the M5 highway. Sham Legion seized the town, giving opposition groups increasing control of the M5 highway from Khan Sheikhoun to Ma’arat al Numan, with the exception of the al Hamidiyah and Wadi al Deif bases.4 These efforts are consistent with a commonly identified threat concept in which the threat seeks to force culmination of its enemy’s actions by conducting missions to negatively impact its sustainment or sustainment system.

164 UNCLASSIFIED

Red Diamond

Legend Enabling Functions 1 Threat The security elements position to provide early warning and/or isolate the objective. An OP Enemy (ENY) reports fires effects and ENY movements. 2 The suppression element degrades ENY ability Combat Outpost to defend and fixes ENY movement in north. [Recently Seized] 3 The fixing elements prevent significant ENY Observation Post movement within the objective. (OP) The feint indicates an assault from the south and Attack by Fire fixes ENY in south. ENY RES moves south. 4 The assault element penetrates ENY OBJ in Support by Fire north and secures the breach for exploitation. Action Functions Feint 5 The exploitation element destroys ENY C2 and logistics. Threat elements continue attack, seize Exploitation OBJ, and defeat ENY battalion. ENY soldiers Direction abandon positions and withdraw to south.

Figure 1. Dispersed attack: Tactical visualization (example)

165 UNCLASSIFIED

Red Diamond

A Dispersed Attack Coordination between JN and Ahrar al Sham led to successful simultaneous assaults on the al Hamidiyah and Wadi al Deif bases. Prosecuted in this fashion, these simultaneous assaults are definitive of a threat dispersed attack. In this case, their inability to ensure an integrated C2 network between the two attacks is noteworthy and should not be confused with a lack or inability to have previously coordinated these attacks. The dispersed offensive attack is characterized by fixing and isolating enemy combat power; using smaller, independent subordinate elements; simultaneously attacking at multiple, dispersed locations; and massing at the last possible moment.5 Al Hamidiyah Base Attack On 7 July 2014, operations began against al Hamidiyah military base. Ahrar al Sham executed an assault at the Taraf checkpoint, using TOW missiles to target tanks within the camp and the surrounding orchards as cover.6 Negotiating minefields surrounding the checkpoint, the opposition fighters made their way over earthen walls to take control of it. Among other things, the regime forces lost several T- 55 tanks. Once occupied, the Taraf checkpoint was used as a staging area for an assault on the Dahman checkpoint to the north. With a technique they would use over and over, opposition groups destroyed buildings to prevent future use by the regime forces. For several days after the attack, opposition groups fired TOW missiles at regime armor in the vicinity.7 From Taraf checkpoint, opposition forces conducted assaults on other checkpoints surrounding al Hamidiyah base. Capturing Dahman checkpoint on 9 July 2014, Ahrar al Sham destroyed buildings and collected supplies within the checkpoint. On 16 July 2014, opposition groups assaulted and occupied the al Midajin checkpoint. The Hanajak checkpoint fell soon after.8 On 15 October 2014, opposition groups detonated explosives in tunnels dug under the al Hamidiyah base and the al Dahrouj checkpoint.9 Opposition groups also captured the Gerbal Abo Ya’rob checkpoint.10 On 14 December 2014, Ahrar al Sham led the successful assault on the al Hamidiyah base. Ahrar al Sham launched assaults from the surrounding checkpoints it had captured over the preceding weeks. Additionally, fighters attacking the base utilized captured TOWs, T-55 tanks, and mortars to finally seize it.11 Opposition group control of the M5 highway facilitated success by isolating those defending the al Hamidiyah base. On 15 December 2014, the opposition fighters declared victory, stating they had captured 10 tanks and killed dozens of Syrian regime soldiers.12 Figure 1 shows what the attack may have looked like based on current threat doctrine. The dispersed attack objective is to bring enough combined arms force to bear to destroy the enemy’s will and/or capability to continue fighting. Al Ahrar did not have to destroy the entire enemy force defending the al Hamidiyah base, but destroy or degrade a key component of the enemy’s combat system, in this case, sustainment of the base and the ability of Syrian forces to command and control their actions.13 In the preceding months, Ahrar al Sham captured many of the combat outposts and villages surrounding the al Hamidiyah base, leaving it isolated and vulnerable. Additionally, Ahrar al Sham acquired tanks and other weapons from the occupied outposts. All of this was brought to bear on the al Hamidiyah offensive that began 14 December 2014. Ahrar al Sham did not completely destroy all of the Syrian defenders, but many were forced to retreat 30 kilometers south to the city of Morek. In a dispersed offensive attack, the fixing elements prevent the enemy defenders, reserves, and quick- response forces from interfering with the actions of the assault and exploitation elements. Opposition fighters used mortars and BGM-71 TOW missiles as a fixing element. Additionally, placing security units

166 UNCLASSIFIED

Red Diamond

along M5 highway north and south of al Hamidiyah base prevented reinforcements from entering the battle, allowing Ahrar al Sham to isolate its objective. The assault element seeks to destroy a particular part of the enemy force or seize key positions. The purpose of the assault element, in part, is to create a window of opportunity for an exploitation element. Tanks acquired from combat outposts and motorized infantry composed the assault element. Finally, the exploitation element seeks to penetrate the enemy defensive forces, attacking and destroying the enemy’s support infrastructure before it has time to react. By the time the exploitation elements entered the al Hamidiyah base, many of the base’s

occupants had exfiltrated by either air or Figure 2. Ahrar al Sham occupation of Hamidiyah ground. Wadi al Deif Base Attack The Wadi al Deif military base, as with al Hamidiyah military base, had been a target for JN and other groups for two years. Positioned on the east side of the M5 highway, it had been used by the Syrian military to attack opposition positions in the surrounding countryside.14 In October 2012, JN and other opposition groups captured the city of Ma’aret al Numan and other villages surrounding the Wadi al Deif base.15 After months of fighting, the Syrian army was able to regain control of much of the area in April 2013. Neither side was, however, able to gain complete control of the M5 highway. On 14 May 2014, opposition groups detonated a bomb in a tunnel dug underneath the base, destroying the western entrance and killing 35-100 Syrian soldiers.16 On 14 December 2014, JN fighters began their part in the successful dispersed offensive attack against Wadi al Deif military base. JN sources indicate the attack included at least 12 tanks, artillery, TOW missiles, and mortars. YouTube videos show soldiers moving to the attack in small pickup trucks, in tanks, and on foot.17 In addition to successfully taking a strategic military base, JN captured tanks and other weapons left behind by the retreating soldiers. With practice and time, JN will continue to improve its capabilities in using such captured resources as tanks and other heavy weaponry. Implications Figure 3. JN Occupation of Wadi al Deif JN has shown an understanding of the importance of controlling key terrain in its effort to win against the Syrian military. Overmatched in air power, it has focused on isolating ground elements and forcing retreat from critical areas on the battlefield. Over a two-year period, opposition groups intentionally

167 UNCLASSIFIED

Red Diamond

captured towns and villages along the M5 highway on their way to attacking an ever more isolated al Hamidiyah and Wadi al Deif. Cutting lines of communication is a basic characteristic of the hybrid threat as demonstrated by JN in Idlib province.18 The battles for al Hamidiyah and Wadi al Deif military bases represent a dispersed offensive attack as described in hybrid threat doctrine.19 The primary objective of the dispersed attack is to take advantage of a window of opportunity to bring enough combined arms force to bear to destroy the enemy’s will and/or capability to continue fighting. To achieve this, the hybrid threat does not necessarily have to destroy the entire enemy force, but just destroy or degrade a key component of the enemy’s combat system.20 In order to Figure 3. JN Occupation of Wadi al Deif defeat the Syrian defenders, JN and Ahrar al Sham captured smaller combat outposts surrounding the bases with the accompanying stockpiles of weapons and ammunition, weakened the bases with regular attacks, attacked from multiple directions, and conducted a final simultaneous attack that prevented reinforcements from either of the bases to the other. Success in slowly cutting supply and communication lines and the increasing isolation also factored into the capitulation of the two military bases. A key characteristic of this dispersed attack was that it included two different threat actors who, while coordinating prior to the offensive, lacked an integrated C2 system for the duration of the attack and still defeated the Syrian defenders, a regular force who enjoyed overmatch.

References Al-Haj, Mustafa. “Jabhat al-Nusra Deals Syrian Regime Major Blow in Idlib.” Al Monitor. 19 December 2014. Aljazeera. “Opposition seizes key bases in Syria's north.” 16 December 2014. BBC Middleast. “Syria conflict: Rebels capture key Idlib army bases.” 15 December 2014. BBC News Middle East. “Syrian Conflict: Rebels Capture Key Idlib Army Bases.” 15 December 2014. Cafarella, Jennifer. “Jabhat al Nusra in Syria.” Institute for the Study of War. December 2014. Holmes, Oliver. “Around 180 Syrian soldiers, jihadists reported killed in battle for base.” Reuters. 16 December 2014. Reuters World News. “Around 100 Syrian Soldiers, 80 Jihadists Killed in Battle for Wadi Al-Deif Base.” 16 December 2014. Roggio, Bill and Caleb Weiss. “Al Nusrah Front, Ahrar al Sham Advance in Northwestern Syria.” The Long War Journal. 15 December 2014. VerifiedNews. “WWIII Syria Conflict Idlib Marrat al Numan the Battle of Wadi al Deif FSA Siege Syrian Army Relief.” 17 December 2014. Winter, Lucas. “Raqqa: From Regime Overthrow to Inter-Rebel Fighting.” FMSO. 2014 March. YouTube. “2014-12-15 Jabhat al-Nusra und verbündete Rebellen besetzen Wadi al-Deif.” 16 December 2014. YouTube. “FNN Syria Ma’arra Freeing Al Ma’arra Battles in Wadi Deif p 1.” 15 October 2014. YouTube. “Syria conflict: Al-Nusra Front captures Idlib army base.” 15 December 2014. YouTube. “Syria Rebel Factions Make Gains in Idlib.” 16 December 2014. YouTube. “Syrian al Qaeda-linked Group Makes Inroads Near Major Highway.” 15 December 2014. Reuters. “Syria Crisis: Khan Sheikhoun Under Army Control; Violence in Damascus.” 6 July 2012.

Notes 1 Mustafa al-Haj, “Jabhat al-Nusra Deals Syrian Regime Major Blow in Idlib, al Monitor, 19 December 2014. 2 Arutz Sheva, “Jabhat al-Nusra Seizes Key Army Base in Northwest Syria,” 15 December 2014. 3 AlJazeera, “Opposition Seizes Key Bases in Syria’s North,” 16 December 2014. 4 Nate Petrocine, “Rebel Operations in Idlib Province During the Spring of 2014,” Institute for the Study of War. 31 July 2014.

168 UNCLASSIFIED

Red Diamond

5 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Intelligence Support Activity (TRISA)-Threats, Complex Operational Environment and Threat Integration Directorate (CTID). 9 December 2011. Chapter 3. 6 While sources refer to “checkpoints” these more resemble combat outposts than mere checkpoints. 7 Nate Petrocine, “Rebel Operations in Idlib Province During the Spring of 2014,” Institute for the Study of War. 31 July 2014. 8 Nate Petrocine, “Rebel Operations in Idlib Province During the Spring of 2014,” Institute for the Study of War. 31 July 2014. 9 Scott Lucas, “Video: Insurgents Use Tunnel Bomb Against Regime Near al-Hamidiya Base in Idlib Province,” EA WorldView, 14 October 2014. 10 Nate Petrocine, “Rebel Operations in Idlib Province During the Spring of 2014,” Institute for the Study of War. 31 July 2014. 11 Bill Roggio and Caleb Weiss, “Al Nusrah Front, Ahrar al Sham Advance in Northwestern Syria,” The Long War Journal, 15 December 2014. 12 Bill Roggio and Caleb Weiss, “Al Nusrah Front, Ahrar al Sham Advance in Northwestern Syria,” The Long War Journal, 15 December 2014. 13 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Intelligence Support Activity (TRISA)-Threats, Complex Operational Environment and Threat Integration Directorate (CTID). 9 December 2011. P 3-10. 14 AlJazeera, “Opposition Seizes Key Bases in Syria’s North,” 16 December 2014. 15 David Enders, “Battle for Maaret al Numan Reveals Syrian Rebels’ Weak Spots,” McClatchyDC, 7 November 2012. 16 Mariam Karouny, “Massive Tunnel Bomb Hits Syrian Army Base: Video,” Reuters, 15 May 2014. 17 Bill Roggio and Caleb Weiss, “Al Nusrah Front, Ahrar al Sham Advance in Northwestern Syria,” 15 December 2015. 18 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Intelligence Support Activity (TRISA)-Threats, Complex Operational Environment and Threat Integration Directorate (CTID). 9 December 2011. Chapter 3. 19 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Intelligence Support Activity (TRISA)-Threats, Complex Operational Environment and Threat Integration Directorate (CTID). 9 December 2011. Chapter 3. 20 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Intelligence Support Activity (TRISA)-Threats, Complex Operational Environment and Threat Integration Directorate (CTID). 9 December 2011. Chapter 3.

______

169 UNCLASSIFIED

Red Diamond

People’s Liberation Army: Challenges to US Warfighting Functions

by Jennifer Dunn, TRADOC G-2 ACE Threats Integration (DAC) Much of the intelligence community’s analysis into China’s military force, the People’s Liberations Army (PLA), focuses on its maritime assets and capabilities. While this article will touch on these things in the overview sections, the bulk of this article will focus on the assets and capabilities of China’s ground forces, the PLA Army (PLAA).https://www.panjury.com/trials/people This article will address the PLAA’s capabilities through-s-liberation the lens of- thearmy US warfighting functions (WfF). Overview of Current Capabilities For the past two decades, China has devoted significant time and money to modernizing its military. The PLA that was once known for its outdated equipment, poor training, and personnel issues has been revamped thanks to regular increases in defense spending. It is now a much more capable military with advanced equipment and better training. While personnel training and reforms are partially responsible for this, much of the PLA’s growth in capability is due to the acquisition of new technologies and weapon systems. The PLA’s acquisition has focused on cyber-attack technologies, fourth-generation level platforms, and precision strike systems. The biggest capability advancement the PLA has demonstrated is its ability to conduct joint force operations. The PLA has placed significant focus on this area and has made noteworthy progress.1 On a more tactical level, the PLA has concentrated its advancements on its special operations forces (SOF) and increasing the amount of amphibious and army aviation units.

Additionally, it has procured more modern platforms for use by its ground forces—main Figure 1. Soldiers Chinese People's Liberation Army battle tanks (MBTs), armored vehicles, artillery, and air defense systems are all examples of systems that have been upgraded in recent years. Despite the advancement of its capabilities, analysis by the RAND Corporation shows that the PLA still has some significant weaknesses. These weaknesses fall into two broad categories: institutional and combat capabilities. The institutional weaknesses stem from ineffective command structures, lack of professionalism among personnel, and rampant corruption. The combat capability weaknesses include logistical and strategic airlift capabilities.2

170 UNCLASSIFIED

Red Diamond

Overview of Future Capability Development The PLA is likely to focus its future military development efforts on fleshing out its naval, air, missile, and space capabilities in addition to rectifying the above mentioned weaknesses.3 The naval capabilities that the People’s Liberation Army Navy (PLAN) is likely to focus on are those that support the expansion of its operations into the Pacific and Indian Oceans. Air defense, cruise missiles, and aircraft carriers are three areas that could enable the PLAN’s operations expansion. The People’s Liberation Army Air Force (PLAAF) is expected to receive the same emphasis as the PLAN. According to the Department of Defense, the PLAAF “will likely become a majority fourth-generation force within the next several years,” in addition to developing as many five-generation systems as possible.4 The PLAAF is also likely to improve its current UAV capabilities. The final areas of emphasis for future capability growth will be in China’s strategic missile force, and space and counterspace. China’s long-range strike capability is likely to be improved by the deployment of intermediate-range ballistic missile systems.5 China’s space/counterspace capability will continue expanding through many space-based capabilities such as intelligence, surveillance, and communication systems. According to IHS Jane’s, the PLA has a goal to conduct all future campaigns simultaneously on land, at sea, in the air, in space, and within the electronic sphere.6 The PLA’s effort to reach this goal is evidenced by the areas of future capabilities discussed above. Challenges to US Warfighting Functions Mission Command—The primary way the PLA will challenge the US Army’s mission command (MC) is through anti-access and area denial (AA/AD) operations. AA/AD presents a challenge to Army MC because synergy between all joint forces is essential in any operation where US forces will be engaged with Chinese forces. If the PLA can be successful with its AA/AD strategies, it could prevent successful synergy between US forces. China’s existing systems and forces have the ability to not Figure 2. Chinese tanks at training base only deny freedom of movement to key areas where the potential for conflict is high, but they can challenge US access to the theater of operations. Systems such as China’s Dong Fen-21D, a medium-range ballistic missile, advanced stealth-like aircraft, and China’s renowned cyber capability all enable China’s efforts at AA/AD.7 While in practice this may seem less applicable to the US Army, China’s AA/AD efforts include its expanded amphibious force capabilities, something that applies to ground force operations. Additionally, China uses its space-based satellite assets to enable its AA/AD efforts to detect approaching foreign naval vessels.8 Intelligence—The PLA is taking significant steps to undermine the US Army’s intelligence capability. It not only has nearly thirty signals intelligence (SIGINT) and electronic intelligence (ELINT) stations around the world targeting the US and its allies, it has gone to great lengths to advance its information and cyber warfare capabilities.9 This is the primary way which the PLA presents a challenge to the US Army’s Intelligence WfF. China’s cyber capabilities are well known. The US Government is aware of a number of known cyber units operating for the Chinese government.10 The PLA has its own cyber forces that are

171 UNCLASSIFIED

Red Diamond

known to have targeted the US.11 And, as evidenced by past training exercises, the PLA has shown intent to use its cyber forces during conflict situations. Movement and Maneuver—The PLA’s extensive artillery arsenal could present a significant challenge to the US Army’s capability to conduct movement and maneuver. IHS Jane’s assesses that China’s inventory is greater than 13,000 individual pieces. China’s artillery systems are based on their Russian equivalents with minor modifications. The majority of the army is equipped with these types of systems. However, China has begun developing some more modern indigenous systems and is fielding some self- propelled pieces. However, only a small portion of the army is equipped with this modern inventory and only approximately 20% is equipped with self-propelled systems.12 Fires—The PLA’s greatest challenge to the US’s fires WfF is its ability to conduct counter-fires. The LD- 2000 used by the PLA is believed to possess a capability similar to US’s counter-rocket artillery mortar (C-RAM) capabilities.13 Artillery experts believe, however, that this system could potentially have extended range. Additionally, as discussed above, China is increasingly fielding self-propelled systems that have the ability to fire and move position before fire can be returned, keeping the systems protected from US counter-fires.14 Sustainment—The PLA’s biggest threat to the US’s sustainment capabilities are its fires and anti-armor capabilities. As previously discussed, the PLA has an extensive artillery arsenal and has demonstrated its intent to continue upgrades to its inventory, modernizing it over the coming years. The PLA’s anti-armor capabilities (discussed in “Protection” below) are also extensive and present a challenge to all US vehicles, particularly those present in LOG trails. Protection—The PLA’s anti-tank weapons systems present a challenge for the US WfF of protection because its inventory contains systems (HJ-12) capable of destroying armored systems up to 4km away.15 The PLA is equipping these anti-tank systems with its ground forces and ensuring armored personnel carriers carry the systems, each with 8 missiles on board. Engagement—In an effort to transition the PLA’s ground forces from a motorized army to a mechanized army, the PLA has acquired a number of new battle tanks and armored personnel carriers (APCs). China now produces the Type 99 MBT, the newer version of the Type 98, for its armor units.16 In 2010, it was reported that most of the PLA’s Type 62 light tanks had been put into storage.17 The majority of the PLA’s new APCs are designed to support amphibious units, evidence of the growth of these units in importance to the PLA. These new APCs are part of what has become known as a new family of infantry fighting vehicles (IFVs), the ZBDs. The ZBD-04, the ZBD2000, and the ZBD-09 are examples of these new assault vehicles. Training Implications The PLA recognizes that the US is not only one of its biggest strategic competitors, it has an exceptionally capable military force. This characteristic makes the US Army a good army to train against. Consequently, China conducts a number of training events in which the PLA OPFOR roleplays using what China believes to be US tactics and techniques.18 Additionally, the PLAA’s acquisitions are generally focused on systems designed to counter the US’s perceived strengths. For US training units, it is important to recognize that threats know US doctrine. Other countries’ forces actively train against US tactics and techniques, monitor US acquisitions, and create lessons learned on the US’s experiences in combat. They will use this information against the US in any direct conflict. This characteristic can be found in any threat actor depicted in ACE-TI threat doctrine and training materials,

172 UNCLASSIFIED

Red Diamond

such as the TC 7-100 series for threat tactics and organization, the Decisive Action Training Environment (DATE), or the Worldwide Equipment Guide (WEG). For More Information ACE-TI will publish a Threat Tactics Report on China later this summer. This document will provide an in- depth look at the PLAA’s capabilities and provide detailed information about the PLAA’s tactics.

Notes 1 “Jane's Sentinel Security Assessment - China And Northeast Asia,” IHS Jane’s, 6 April 2015. 2 Michael S. Chase, et al, “China’s Incomplete Military Transformation: Assessing the Weaknesses of the People’s Liberation Army (PLA),” RAND Corporation, 2015. 3 Michael S. Chase, et al, “China’s Incomplete Military Transformation: Assessing the Weaknesses of the People’s Liberation Army (PLA),” RAND Corporation, 2015. 4 “Military and Security Developments Involving the People’s Republic of China, 2014,” Office of the Secretary of Defense, 24 April 2014. 5 “Military and Security Developments Involving the People’s Republic of China, 2014,” Office of the Secretary of Defense, 24 April 2014. 6 “Jane’s World Armies – China.” IHS Jane’s. 24 February 2015. 7 Benjamin Cone, “Mission Command and Antiaccess/Area Denial: Implications for Joint Command and Control,” Naval War College, 20 May 2013. 8 “NIDS China Security Report 2014,” National Institute for Defense Studies, Japan. 2014. 9 “Jane’s World Armies – China,” IHS Jane’s, 24 February 2015. 10 “NIDS China Security Report 2014,” National Institute for Defense Studies, Japan. 2014. 11 David E. Sanger, David Barboza, and Nicole Perlroth, “Chinese Army Unit is Seen as Tied to Hacking Against US,” NY Times, 18 February 2013. 12 “Jane’s World Armies – China,” IHS Jane’s, 24 February 2015. 13 Carlo Kopp, “Counter-Rocket Artillery Mortar Futures,” Defence Today, October 2010. 14 Anthony H. Cordesman, “Chinese Strategy and Military Power in 2014: Chinese, Japanese, Korean, Taiwanese, and US Perspectives,” Center for Strategic International Studies, 2014. 15 Jeffrey Lin and P.W. Singer, “For Sale: A New Chinese Tank Killer,” Popular Science, 10 July 2014. 16 Lt Gen JS Bajwa, “Modernization of the Chinese Army,” India Defence Review, 11 January 2015. 17 “Jane’s World Armies – China,” IHS Jane’s, 24 February 2015. 18 The US force is often referred to as the “blue force” in its own training events, and the PLAA OPFOR (the PLAA enemy) is also referred to as the blue force in PLA terminology.

______

173 UNCLASSIFIED

Red Diamond

by Jerry England, TRADOC G-2 ACE Threats Integration (DAC) In early 2014 the Syrian government’s Syrian Arab Army (SAA), with help from local National Defense Forces (NDF) and foreign militias, were able to protect the Hama airbase from opposition forces in Hama’s capital and the surrounding area and allow operations to continue.1 By the summer, however, when governmental opposition groups consisting of the Free Syrian Army (FSA) and Jabhat al Nusra (JN) put aside their ideological differences and decided to work together in a new offensive against the province, the regime’s inability to defend it was exposed.2 This agreement coincided with the attack on the Iraqi city of Mosul by the violent extremist organization known as the Islamic State in Iraq and the Levant (ISIL). ISIL’s success in Mosul gave the Syrian opposition a window of opportunity as Iraqi militia fighters left Syria to defend their homeland. The Iraqi fighters’ departure for home weakened the already limited combat power of the pro-regime fighters and allowed the opposition groups against the Syrian government to penetrate farther south. This report will discuss the Syrian army’s response to the tactical situation in Hama in 2014 and the techniques employed to defend the area. Syria’s Hama province, due to its central location and its key infrastructure, would give a commanding advantage to the group that wrested it from the regime. The Hama airbase, a key component of the Syrian government’s air campaign, flew an estimated 15 fixed-wing and rotary-wing aircraft sorties out of the facility daily.3 The city of Mhardah, a predominantly Christian city, contains one of the largest electrical power plants in the country providing an estimated seven percent of Syria’s electrical power. Additionally, there was a suspected barrel bomb facility near Hama city.4 Barrel bombs are improvised munitions composed of simple metal containers filled with explosives and shrapnel. Human rights groups attributed a large number of civilian casualties to barrel bombs, which are notoriously inaccurate, and the regime relied on them to conduct preparatory fires when conducting attacks. Not only did Hama hold the airbase, the province supported a number of army bases, contain several ammunition depots, and served as a key logistics hub to support governmental forces fighting north in Aleppo. When opposition groups began their offensive on Hama province in the summer of 2014, the protection of these key facilities became an important factor in the government deciding to commit reinforcements Figure 1: Syrian Arab Army fire an S-60 Towed to the area. AA gun on a town in Northern Hama Province

174 UNCLASSIFIED

Red Diamond

Defense of Hama The Syrian regime maintained an area defense using both regular and NDF troops at military installations and area villages. The Syrian governmental forces designed their area defense to deny key areas to the opposition including two major highways, the Mharda power plant, and the Hama airbase. In a war of attrition, the area defense is used to inflict losses on the enemy, while retaining ground and protecting combat power.5 Traditionally, the Syrian Arab Army’s 3rd Corps, a heavy force consisting of four armor brigades and four mechanized infantry brigades, provided operational control for the area. Due to severe losses fighting in other parts of the country, the 3rd Corps had dwindled to less than 50 percent strength.6 The NDF fighters, formerly known as “popular committees,” consisted of local groups recruited into service by the Assad regime. Some of these groups received two to four weeks of training from Iranian and Hezbollah advisors and then integrated into the Syrian Army.7 The quality and performance of these forces were mixed. The Syrian regime billed the NDF fighters as heroes defending their homeland and integrated them into military operations when possible. Some reports, however, accused the NDF fighters of looting and abusing their power. Most NDF fighters suffered from inexperience and could not defend against the JN and FSA raiding techniques. An Iranian general, in his captured memoirs before he died in Damascus, described the NDF as unreliable in combat situations.8 Despite a lack of training and limited equipment, the Syrian government assigned the NDF to provide security to their areas of responsibility. Many NDF checkpoints consisted of fewer than 12 fighters outfitted with small arms such as rifles and rocket-propelled grenades. The NDF fighters also used a combination of military and civilian tactical vehicles, some armed with heavy machine guns. These NDF patrols served as the regime’s eyes and ears with the responsibility to secure long stretches of highway, small villages, and quarters in Hama’s major cities. The defensive posture in Hama epitomized the Syrian regime’s “win by not losing” strategy, which some analysts referred to the patrolling as “an army in all corners.”9 The regime conducted access control operations that traded time for the opportunity to attack the opposition when and where the opposition forces were most vulnerable. In support of the area defense, the Syrian Air Force conducted air strikes against known concentrations of enemy fighters and their sympathizers. The air force wanted to degrade the opposition groups’ ability to mount offensive operations and cause unacceptable risks for any of the anti-government supporters. The NDF performed to free up regular SAA units to conduct offensive operations either in strategically important fronts throughout Syria or against known enemy safe havens. Despite the presence of the pro-regime troops in Hama, JN and FSA fighters infiltrated into Halfaya, a city in Hama province, and established a base of operations to conduct raids and ambushes throughout the province. The Opposition Attacks With government security forces degraded, opposition groups consisting of FSA and JN launched operation “Badr al Sham” against Hama province and the military structure supporting it. The opposition fighters wanted to seize the power plant in Mharda and attack the airbase in Hama city. Included among its targets was the suspected barrel bomb production facility, north of Hama city. The JN and FSA fighters established support zones and secured lines of communication in cities within Hama province’s boundaries that held large populations of Sunni sympathizers. The opposition forces designed perception management operations that highlighted the regime’s brutality against Sunnis to garner influence with the Sunni population, and imposed fear on non-aligned parties as a means to maintain security and ensure support in these friendly areas. In southern Idlib and northern Hama provinces, opposition groups established support areas in Morek, Lataminah, and Kifr Zita. The opposition fighters

175 UNCLASSIFIED

Red Diamond

infiltrated into Halfaya, massing troops for offensive operations in villages along the Orontes River and the Hama Latakia highway.10 Many of the outposts and small villages fell to the opposition fighters as the regime fighters barricaded themselves in their security outposts, or simply dispersed into the countryside. At the Serthel checkpoint, the opposition forces used captured Syrian Army equipment to overrun the government force’s outpost.11 Throughout the summer of 2014, rebel forces and pro- regime fighters fought in the villages north of Hama city including al Jadida, Tayyibat al Imam, Khattab, and most notably Halfaya. The Khattab ammunition depot fell in late July with opposition forces capturing ammunition in their crates, various artillery pieces, and some armored vehicles.12 Armed with captured Syrian equipment, the opposition force Figure 2: NDF Soldiers with truck mounted heavy advanced to within four kilometers of the machine gun advance in Northern Hama Hama airbase, close enough to engage the base with BM-21 grad missiles mounted on medium trucks.13 Counterattack The Syrian government dispatched elements of the 4th armored division and an elite special forces unit known as the Tiger Brigade to Hama. In addition to these forces, the national defense forces received augmentation by additional Iranian advisors and an array of foreign fighters coordinated by the Iranian Revolutionary Guard Corps (IRGC). Using a combination of air and ground forces, the Tiger Brigade systematically attacked areas containing large concentrations of opposition forces in Hama province. The air campaign intensified with sorties against individual and area targets using attack fixed wing aircraft and helicopters. The Syrian Air Force dropped barrel bombs killing dozens in opposition-controlled areas such as Kifr Zita and Morek.14 In addition to the air campaign, the Syrian regime adopted more aggressive tactics to meet with and engage the enemy. The techniques employed were likely a result of the Iranian advisors’ suggestions to crack open opposition defenses with specially trained “line breaker” troops which were fast-moving troops ordered to sweep ahead of armored vehicles and defeat antitank missile teams. These techniques were viewed by Syrian military officials as successful when Hezbollah used them in a regime offensive in the Qalamoun Mountains in 2013.15 Figure 3: Syrian Air force barrel bombs en route to an unknown target Analysis of pro-Syrian regime videos shows small groups of ten to twenty infantry attacking positions with support from heavy machine guns and tanks on the edges of population centers.16 Typically, ground forces advanced after rebel fighting positions were sufficiently degraded by aerial bombardment. Using preemptive strikes against concentrations of enemy troops and equipment as well as suspected support facilities such as medical clinics and food

176 UNCLASSIFIED

Red Diamond

distribution sites, the air force isolated and reduced the rebel forces.17 The air force also targeted specific heavy weapons such as tanks and antiaircraft guns. The Syrian governmental forces may have used barrel bombs, some of which contained chlorine gas, to punish the civilian population for supporting the fighters. Without precision guided munitions, the Syrian Air Force caused large number of civilian casualties due to their inaccuracy. After the bombardment, Syrian governmental ground forces assaulted enemy fighting positions using fire and maneuver techniques. Ground forces used mortars, artillery, and short-range missiles against remaining opposition targets to dislodge the enemy from its positions and allow the infantry to close within the effective range of their small arms and anti-armor 18 weapons. The pro-governmental forces Figure 4: Syrian Arab Army use ZSU-23 AA gun and used heavy weapons at maximum BMD-1 fighting vehicle in Northern Hama Province standoff distances to protect combat power. Artillery and multiple launch rocket systems shelled villages throughout the offensive operations, removing enemy defensive positions for the attacking forces and closing off escape routes for the opposition. In larger towns heavy weapons were cautiously moved close to the main battle zone to provide support for advancing infantry. T-55 main battle tanks (MBTs), in coordination with dismounted observers, engaged opposition fighting positions that were particularly well-defended. Using heavy guns mounted on medium trucks, the regime forces fired on enemy positions and also acted as spotters for tanks to fire their main gun. Dismounted radio operators directed the tanks into fighting positions and oriented the guns to their target. The pro-government units only advanced after the threat was either destroyed or neutralized. Infantry cleared roads, patrolled ditches, and inspected culverts for improvised explosive devices (IEDs) in order to protect the tanks. The exploitation force cleared the fighting positions, defused booby traps, and performed site exploitation operations by taking images of enemy weapons, ammunition, and equipment left behind by the fleeing opposition fighters. This last step provided the Syrian government the evidence needed to support the claims of a large amount of foreign assistance to the anti-government opposition groups. The Syrian regime’s surge took back the cities of Khattab, Jadidah, and Zalaqiyat within a few days of the reinforcement’s arrival and initiated a pursuit of enemy forces to the north toward the cities of Morek and Lataminah.19 The Syrian Army, along with the NDF, continued the offensive and forced the rebels out of the Hama through a combination of maneuver and fires. Once the opposition forces were no longer a threat, NDF units moved into the newly “liberated” villages and conducted security operations, coordinated relief, and conducted displaced persons operations.20 By September 2014, the Syrian regime controlled the cities of Tayyibat al Imam, Halfaya, and Al Boida and secured the east–west corridor from Suran to Halfaya. With the area south of the river bend secured, the Syrian Air Force unleashed aerial attacks on the cities of Morek and Kifr Zita, known opposition strongholds.21

177 UNCLASSIFIED

Red Diamond

Figure 5: Syrian Regime Operations in Hama Province 2014 (estimate), ACE Threats Integration 2015

Table 1. Syrian and NDF Force Estimated capabilities for a BTG22

Ground (Divisional) Aerial23 Fires BMD/BTR24 100 (est.) Su-22 Ground 7-8 Daily Sorties D-30 122-mm 45 (est.) Armored vehicles attack Towed Gun T-55/T-72 Tanks 100 (est.) Su-24 Multi-Role 7-8 Daily Sorties 9A52-2 300-mm UNK MRL RPG-7/29 27 (est.) MIG-29 Multi-Role 7-8 Daily Sorties Zu-23 AA gun UNK Fighter Light Trucks 12 Mi-8/17 Multi-Role 7-8 Daily Sorties ZSU-23-4 UNK Helicopter 9P135 ATGM 12 Mi-24 Attack 7-8 Daily Sorties Fagot Helicopter Implications The Syrian regime used a variety of organizations to conduct defensive and offensive operations, including non-state actors and local militias. Syrian Air Force assets served as a key component in the regime’s defense. An extra-regional force entering Syria will require neutralization of the opposition air assets, either through lethal force or an international agreement, is critical for freedom of movement in Syria. Cover, concealment, camouflage, and deception are required for forces faced with a dangerous aerial threat. Information operations designed to counter Syrian propaganda and highlight government brutality against its own citizens are important for gaining support both within Syria and globally. The presence of foreign fighters and their trained proxies means that the nature of the conflict will

178 UNCLASSIFIED

Red Diamond

potentially change if the central government is defeated and shifting alliances make it difficult for US forces to determine friend and foe.

Sources Bennet, Richard. “The Syrian Military: A Primer.” Middle East Intelligence Bulletin. September 2001. Holliday, Joseph. “The Assad regime From Counterinsurgency to Civil War.” Middle East Report 8. Institute for the Study of War. 2013. Holliday, Joseph. “The Syrian Army Doctrinal Order of Battle.” Institute for the Study of War. February 2013 Kozak, Christopher.” “An Army in All Corners” Assad’s Campaign Strategy In Syria.” Institute for the Study of War. February 2013. Headquarters, Department of the Army. Training Circular 7-102, Operational Environment and Army Learning. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2014. US Army, TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. Worldwide Equipment Guide – Volume 1: Ground Systems. August 2014. US Army, TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. Worldwide Equipment Guide – Volume 2: Airspace and Air Defense Systems. August 2014.White, Jeffrey. “Syrian Air Force Operations: Strategic, Effective, and Unrestrained,” The Washington Institute, 11 December 2014.

Notes i Valerie Szybala with Chris Harmer, “Regime Air Activity in Hama: 1,800 Sorties in 50 Days,” Institute for the Study of War, 30 May 2014. 2 AFP, “Syria rebels advance on key airport in Hama province,” 29 July 2014. 3 Yalla Souriya, “#Syria, Sorties of warplanes and Helicopters in Northern hama,” 22 May 2014, Luftwaffe A.S, “Air Raids From Hama & Sh'eirat AFB's (1st Quarter 2014),” 8 April 2014. 4 AFP, “Syria rebels advance on key airport in Hama province,” 29 July 2014. 5 Headquarters, Department of the Army. Training Circular 7-102, Operational Environment and Army Learning. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2014. 6 Chris Kozack, “An Army In All Corners Assad’s Campaign Strategy in Syria,” April 2015. 7 Carter Center, “Syria: Pro-­­Government Paramilitary Forces,” 5 November 2013. 8 David Axe, “Iran transformed Syria’s army into a militia that will help Assad survive another year,” 14 December 2104. 9 Chris Kozack, “An Army In All Corners Assad’s Campaign Strategy in Syria,” April 2015. 10 Tom Perry, “Syrian forces win battle with rebels in Hama, Reuters,” 12 September 2014. i1 “Syria War Heavy Firefights And Clashes In Hama Syrian Civil War 2014! FSA VS SAA!,” YouTube, October 2014. i2 Scott Lucas, “Syria Daily, July 27: A Multi-Front Battle Between Assad’s Forces & Islamic State,” EA Worldview, 27 July 2014. i3 Syria: Direct, “Hama military airport key to controlling province,” 28 August 2014; Scott Lucas, “Syria Daily, July 30: Insurgents Close on Major Military Airport Near Hama,” EA Worldview, 30 July 2014. i4 Brown Moses, “Alleged Chemical Attack Tall as Sayyad,” YouTube, 28 August 2014. i5 LiveLeak, “Iran’s Agony in Syria - Captured document reveals infighting, manpower shortage,” 7 July 2014. i6 “Syrian Arab Army & NDF advance in Noth Hama, Syria,” YouTube, 20 September 2014; “Syrian NDF Civilians 2014 Syrian Army Tribute,” YouTube, 15 December 2014. i7 Jeffrey White, Syrian Air Force Operations: Strategic, Effective, and Unrestrained, The Washington Institute, 11 December 2014. i8 Syria: Direct, “Syria Direct: News Update 9-9-14,” 9 September 2014. i9 Xinhua, “Roundup: Syrian Troops Advance In Countryside Of Hama Province,” 16 September 2014. 20 “The anniversary of the siege of Al-Tulaysiyah in Hama province (NDFvideo),” YouTube, 28 April 2015. 21 “National Defense Force (Hama Province) in action NDF Hama im Einsatz,” YouTube, 23 April 2015. 22 Joseph Holliday, “The Assad regime From Counterinsurgency to Civil War,” Middle East Report 8. Institute for the Study of War, 2013. 23 Richard Bennet, “The Syrian Military: A Primer,” Middle East Intelligence Bulletin, September 2001. 24 Richard Bennet, “The Syrian Military: A Primer,” Middle East Intelligence Bulletin, September 2001.

179 UNCLASSIFIED

Red Diamond

by Walter Williams, TRADOC G-2 ACE Threats Integration (DAC) Artillery target acquisition is the process of detecting and locating hostile mortar, cannon, and rocket units with sufficient accuracy, reliability, and responsiveness for counterfire and counterbattery to be directed against an enemy unit. Artillery-locating radars (ALRs) or weapon-locating radars (WLRs) are probably the most reliable artillery target-acquisition systems. Normally they are assigned to field artillery units to support target acquisition, cannon or gun registration, as well as fire correction. The radars are designed to track the ballistic path of both hostile and friendly artillery, rockets, and mortar systems and use the data collected to calculate the point of origin and point of impact. They are almost impossible to deceive. However, any system that follows a non-ballistic, or altered ballistic, path may not be locatable to the same degree of accuracy, if at all. Older radars tracked the projectile in flight or used the position and time difference as the projectile passed through the radar’s split or dual beam. These systems were easily overloaded and multiple targets led to inaccurate locations or a complete inability to determine a location. The development and fielding of phased-array radars have effectively solved this problem. Recently, the marketing of the Chinese SLC-2 has caught the attention of ACE-TI analysts as a system noteworthy of informing the training audience. It has been marketed by Chinese arms exporters to foreign nations as a system that can quickly determine the location of enemy artillery systems and provide the geocoordinates to conduct counterbattery fire. It is also technically possible for the SLC-2 to track low-flying light aircraft such as UAVs and helicopters. However, the operational accuracy is affected due to changes in the flight path by the airframes and the limited azimuth and elevation sectors of the radar. System Capabilities and Characteristics The Chinese SLC-2 is seems to be similar to the US AN/TPQ-37 ALR in both appearance and performance. It also appears similar to the Chinese BL-904 ALR but with a better operational performance. The system can be used to track friendly artillery fire. The system calculates the impact error of friendly artillery rounds and provides automatic correction parameters for increased accuracy. The radar system is employed as a two-vehicle set. Various open-source material indicates the Dong Feng EQ2102 3.5 ton 6x6 truck is associated with the SLC-2 Radar set. One vehicle (2 personnel) carries the radar while the other vehicle (2 personnel) carries the command cabin and the system power supply. The command cabin contains equipment such as the operation and control panel, data processing equipment, computer monitors/displays, and radios.

180 UNCLASSIFIED

Red Diamond

System Proliferation The SLC-2 is not widely proliferated at the moment. The system continues to undergo extensive marketing and contracting for testing. For example, Sri Lanka contracted for five each SLC-2 Radar sets in 2006 presumably for testing and field trials. Thailand Royal Marines also conducted tests with the system. A 2013 threaded discussion on the Pakistan Defence website provides insight on the probable acquisition of the SLC-2 as part of a package deal with a Chinese SH-1 155-mm howitzer. Jane’s also reported the marketing of the NORINCO Artillery Master 155 Field Artillery Weapon System (FAWS) in the Middle East region” during IDEX 2015.1 The FAWS includes “command post vehicles, reconnaissance vehicles with advanced day/night sensor pods, a truck-mounted artillery locating and correction radar, and a meteorological system. Targets can be located rapidly using the ground-based elements, or the Sharp Eye-III unmanned aerial vehicle, which would typically be issued on the scale of three per battalion.”2 It is strongly suspected that the truck mounted ALR discussed is the SLC-2. Training Implications The introduction of the SLC-2 enhances the ability of a military force to rapidly detect and provide a geographic location of an enemy artillery unit conducting a fire mission. Recent technological advances in reconnaissance, surveillance, and target acquisition (RSTA) and fire control systems provide an adversary a capability to rapidly disseminate information on suspected enemy targets within one minute or less. This includes from the time of acquisition to computation by a fire direction center and the initial transmission of data to a firing battery. Under favorable conditions, the first artillery round may be on target within two to four minutes of acquisition. The desired identify-destroy cycle should not last any longer than six to ten minutes. Otherwise, in layman’s language, the hunter may become the hunted. US Army units conducting combined arms maneuver (CAM) operations would more than likely encounter an adversary or opposing force (OPFOR) possessing an ALR as part of a robust RSTA package as described in the preceding paragraph. Thus, there would have to be a paradigm shift of “they can’t do that” or “their equipment isn’t as good as ours” to one of “let’s look for the vulnerabilities or cycle times for the equipment” and see how to mitigate or defeat the capability. For example, a sound technique is to use an old yet viable capability such as sound ranging or even human reconnaissance elements (such as patrols or civilian) to passively locate a cannon or rocket- launched firing unit. Most modern-day sound ranging systems can be characterized as completely automated, EMP protected, accompanied by a meteorological unit, resistant to electronic jamming, and completely passive. Once the firing unit location has been detected, the location information is passed to an ALR section for greater accuracy to ensure a first round hit. This technique facilitates a shorter cycle time for the OPFOR ALR, thus reducing the vulnerability to detection by electronic intelligence (ELINT) collectors. Threat Doctrine Manifestations TC 7-100.4, Hybrid Threat Force Structure Organization Guide, June 2015, describes the hybrid threat that exists for the purpose of training US forces for potential combat operations. The hybrid threat force structure reflects the characteristics of military and irregular forces that may be present in an operational environment (OE). The SP Artillery Brigade Target Acquisition Battery located on the Army Training Network (ATN) has two each ALRs and two sound ranging systems along with meteorological equipment. The Ukrainian IL220U and the Russian IL219 are listed as the baseline ALRs for this force

181 UNCLASSIFIED

Red Diamond

structure. These would be considered to be tier 2 systems. The SLC-2 is a tier 1 system that can be substituted for the baseline systems. The countermortar/counterbattery platoon consists of two sections with an ALR in each section. The following page is a data sheet containing the requisite parametric data for the SLC-2.

Chinese Artillery Locating Radar SLC-2

Chinese SLC-2 Artillery Locating Radar with antenna erected

SYSTEM SPECIFICATIONS SYSTEM SPECIFICATIONS Alternative Designations None Scan Method Electronic Date of Introduction: INA Scan Type Sector (azimuth) Proliferation: At least 3 countries Scan Width -Hostile Fire (deg) 90 DESCRIPTION: Scan Width -Friendly Fire (deg) 22.56 Crew 4 Platform (Chassis) Dong Feng EQ2102 3.5 ton TRANSMITTER: 6x6 Engine Type Cummings 6BT5.9 Diesel Transmitter Type INA Chassis Length Overall (m) 7.49 Peak Power (kw) 45 Height Overall (m) 2.74 Frequency Band S-band (2-4Ghz) Width (m) 2.47 Modulation Type Pulsed Combat Weight (kg) 10,420 RECEIVER: Max On Road (km/h) 90 Noise Figure (dB) 3.5 Max Off-Road (km/h) INA Single Pulse Processing Coherent Cross Country (km/h) INA Multiple Pulse Processing Doppler Filters

Fording Depths (m) 1.0 PERFORMANCE (km) SPECIFICATIONS Detection Range (Mortar) 10.0 Radio INA Detection Range (Artillery) 35.0 Detection Range (Rocket) 50.0 RADAR: Detection Range (Missile) 50.0 Antenna Type Active Phased Array Emplacement Time (min) 10 (est) Polarization Vertical Displacement Time (min) 10 (est)

182 UNCLASSIFIED

Red Diamond

NOTES The system is similar to the US AN/TPQ-37 in both appearance and performance (as claimed by the manufacturer). The system can be used to track friendly artillery fire. The system calculates the impact error of friendly artillery rounds and provides automatic correction parameters for increased accuracy. The radar system is employed as a two-vehicle set. Various open-source material indicates the Dong Feng EQ2102 3.5 ton 6x6 truck is associated with the SLC-2 Radar set. One vehicle (2 personnel) carries the radar while the other vehicle (2 personnel) carries the command cabin and the system power supply. The command cabin contains the operation and control panel, data processing equipment, computer monitors/displays, etc.

References IHS Jane’s 360. Mastering the Art of Artillery [IDX15VP]. 21 February 2015. Pakistan Defence. Counter Battery Radars. 20 August 2013. Pakistan Military Review. Pakistan Army's A-100E 300mm Multi Barrel Rocket Launchers and SLC-2 active phased-array weapons locating radars during Azm E Nau Military Exercise. 19 November 2013. Security-Risks.com. Bangladesh Armed Forces Modernization and Upgradation. 12 July 2012.

Notes i IHS Jane’s 360. Mastering the Art of Artillery [IDX15VP]. 21 February 2015. 2 IHS Jane’s 360. Mastering the Art of Artillery [IDX15VP]. 21 February 2015.

______

183 UNCLASSIFIED

Red Diamond

Threat Tactical Vignette Recon and Raid by Jon H. Moilanen, TRADOC G-2 ACE Threats Integration (IDSI Ctr) Part 4 in RZ-CRZ Series The September 2015 Red Diamond newsletter article is the fourth article in this tactical vignette series. Focusing on reconnaissance and counterreconnaissance as economy of force actions, the screen mission incorporates both tasks as integral to providing early warning and a degree of protection to the force main body. Other offensive tasks anticipated in a screen can include actions of an ambush and/or raid in order to accomplish the intent of the mission. Situation Update From previous Red Diamond newsletter articles, the rapid advance of the encirclement operation continues deep into the enemy’s rear zone toward the KRONATZ river line. Mechanized and motorized forces organized as division tactical groups (DTGs) are maneuvering to linkup and close the encirclement. One divisional reconnaissance company with a flank screen mission has intermittent contact with its task-organized platoons across a wide zone. The platoon in this tactical vignette, task-organized as an independent reconnaissance patrol (IRP), continues its mission tasks after unexpected contact with lead enemy dismounted elements resulted in an ambush that temporarily disrupted enemy maneuver. The ambush was successful even though two scouts were wounded in the engagement. The more significant loss was destruction of one BTR on Hill 21 from enemy indirect fire. No BTR crew members survived.

IRP

D

120mm

Figure 1. Independent reconnaissance platoon and current combat losses (example)

The platoon leader on site in the east part of the zone and the senior sergeant on the western axis are updating each other on their respective situations oriented on probable enemy locations (PELs) in zone. Casualty care in the rally point verifies that the two injured scouts are not life threatening wounds. One injury is a scalp graze and the shoulder wound did not shatter any bone. Note. Descriptions throughout the vignette use threat terms from the TC 7-100 series.1 The task- organized platoon is best understood by knowing the unit and weapon system capabilities as presented in

184 UNCLASSIFIED

Red Diamond

US Army TC 7-100.4 and its TRADOC G-2 Threat Force Structure e-folders of units. Another source for equipment and weapon capabilities is the TRADOC G-2 Worldwide Equipment Guide.

Screen A screen is a form of security operation that provides early warning to the protected force. (ADRP 1-02) Raid A raid is an attack against a stationary target for the purposes of its capture or destruction that culminates in the withdrawal of the raiding force to safe territory. Raids can also be used to secure information and to confuse or deceive the enemy. (TC 7-100.2) Ambush An ambush is a surprise attack from a concealed position used against moving or temporarily halted targets. (TC 7-100.2)

Security Operations Continue North of KOLTE The platoon leader positions at Hill 21 and reviews his ongoing security task. He is to obtain tactical intelligence as far south as KOLTE and provide early warning of enemy advances in zone.

Reconnaissance Counterreconnaissance

Fix Enemy Predict Enemy Security Forces Locations-Types Find Enemy Recon Find Enemy Targets Reconnaissance Establish Sensors Report BEJUNIK and Contact to Reconnaissance Targets Neutralize Target: Report Destroy, Deceive, Reconnaissance or Obscure

RAID

Plan Prepare Infiltrate

KOLTE Isolate Seize or Destroy Exfiltrate

Figure 2. Terrain appreciation in zone for raid to obtain tactical intelligence

185 UNCLASSIFIED

Red Diamond

The platoon leader reviews his current combat readiness and risk assessment, and considers future operations to not become decisively engaged by the enemy. His current situation is as follows:  The platoon leader (PL) assesses what he knows about the enemy based on the ambush success. Recognizing that a small number of enemy soldiers are probably maneuvering to the northeast of his current positions toward Hill 21, he is planning a raid to kill or capture enemy soldiers in order to identify what unit or units he is confronting in zone.  One scout squad and BTR remain at the southern slope of Hill 21 observing for enemy movements in the vicinity of KOLTE. The wheeled armored carriers previously reported as stationary at the northern outskirts of KOLTE have not moved north; however, the squad leader reports a wheeled vehicle with a turreted main gun appeared on the main road in KOLTE but withdrew out of site into the village buildings.  The senior sergeant (SS) starts his movement from BEJUNIK, links up and recovers one of the OP teams south of the river, and moves southwest along the main roadway toward PEL 23.  The combat engineer squad at the MIN River reports no enemy activity from the operational bridge site to the destroyed bridge as it patrols along the northern bank of the river at BEJUNIK. The observation post (OP) south of the river reports no movements to the south.  The scout squad at the destroyed bridge continues to man a defensive position in BEJUNIK and conducts dismounted patrolling in conjunction with the engineer squad. The OP forward of the simple battle position (SBP) and south of the river continues to orient south.  The mortar section remains in position on the outskirts of BEJUNIK ready to assist the platoon with on- call indirect fires and reports nil civilian movement among buildings or in the streets of BEJUNIK. If the enemy occupies Hill 21, this terrain provides good visibility north all the way to BEJUNIK. The platoon leader decides that a raid with limited objectives is worth the risk, and directs his squad and team leaders on site in a brief rock drill rehearsal. A raid is an attack against a stationary target for its capture or destruction that culminates in the withdrawal of the raiding element to safe territory (TC 7- 100.2). Raids can also secure information, individuals, equipment or systems, and/or deny a capability to an enemy. A raid can be executed to confuse or deceive an enemy. Several keys to successful accomplishment of a raid are surprise, massed combat power, and rapid conduct of mission tasks. Exfiltration is the final action of a raid. A raid does not necessarily have to be focused on a stationary target.2 The raid is a basic form of OPFOR tactical offensive combat. Raids at any OPFOR level of command and with any type elements and/or forces have the same basic subtasks. Decisions and Movements for the Raid The platoon leader uses a key piece of terrain situational awareness in planning the raid. Based on patrolling by his scouts now manning his flank security observation post, he knows that any enemy movement to the north must cross as open grassy slope before reentering the wooded area. The slope in this area descends to swamp and a river that restricts any wider flanking actions. The scout team in the rally point confirms that the treeline is heavy thicket with the one trail as the only quick entry into the woods. The BTR near the main road continues to orient and observe south toward KOLTE. The squad leader reports that a total of 15 to 20 dismounted enemy soldiers entered the treeline after the ambush. He sees no additional soldiers between KOLTE and his position at the Hill 21 woodline. The observation post at the west slope of Hill 21 reports no activity, and the OP to the east on the hill trail reports only a farmer and cart on the east side of the river.

186 UNCLASSIFIED

Red Diamond

Platoon elements act quickly and effectively to position for their respective raid functions while security elements maintain observation of the woodline to the south. The scout team designated as a fixing element also sets two antipersonnel mines in a daisy-chain for command detonation when the lead enemy elements enter the kill zone. The other scout team moves to the north into a concealed position as the raiding element. The platoon leader and his BTR are a support element that will provide coax machinegun fire down the trail into the kill zone once the mines detonate. On order of the platoon leader, the mortar section will fire a target in the south treeline to assist the fixing element in isolating the lead enemy elements from any reinforcement or other support. The mortar section sergeant will displace to an alternate firing position after firing several rounds, and notify the platoon leader when he is ready for another fire mission. The fixing element will engage with area direct fires to suppress enemy near the southern treeline as well as prevent any withdrawal of enemy elements back across the open grassy area.

RAID ACTIONS 8 1 1 Security element 5 reports ENY approach. 2 Support element reports 15 to 20 ENY soldiers entering woods. 3 3 PLT sets kill zone with 4 1 AP mines and fires. 4 Fixing element ready to isolate lead team. 5 Raiding element ready 7 6 to assault flank and seize ENY and materiel. 6 Mortar section targets trail ENY elements. 7 Support element reports on ENY near KOLTE. 2 8 PL ready to initiate raid as ENY enter woodline.

Figure 3. Tactical plan for the raid northwest of KOLTE (vignette) The Raid Security elements report that six soldiers dashed across the open grassy slope and into the woods at the trail. The fixing element identifies the enemy soldiers moving slowly parallel to the trail. The team sergeant triggers the daisy-chain and the mines cut a swath across the kill zone. The platoon leader levels his BTR coax machine gun fire into the kill zone. The return fire from the enemy indicates one or two enemy soldiers may be wounded or killed. Most of the return fire from the enemy in the kill zone points primarily up the trail in the direction of the BTR. When the mines detonate, the fixing element rakes the southern treeline with controlled semiautomatic and automatic rifle fire. One PKM adds to the direct fires. Enemy return fire hits high into the treeline. Branches and leaves clipped by the gunfire fall on the scout team but none of the scouts are injured.

187 UNCLASSIFIED

Red Diamond

The platoon leader orders the mortar fire mission and receives an immediate “Shot, Over” followed by a "Splash, Over” from the mortar sergeant. In quick succession, several mortar rounds land inside the treeline. Enemy gunfire is sporadic after these mortar detonations, but the fixing element maintains a controlled grazing pattern of automatic and semiautomatic gunfire into the woods. Back in the northern treeline, an enemy soldier throws a smoke grenade on the trail and starts to run back down the trail. Machinegun fire hits him in mid-stride and he topples over. The final mortar rounds are still landing when the platoon leader shifts and lifts his direct fires, and orders the raiding element to assault into the kill zone. The raiding element sweeps into the kill zone from the flank and shoot two soldiers who turn to return fire. One soldier is killed and the other soldier, unwounded, raises his hands and is taken prisoner. One of the other enemy soldiers is badly wounded and propped against a tree trunk. He dies as a scout is applying emergency aid to the chest wound. Three other enemy soldiers at the far end of the kill zone are dead from the antipersonnel mines. The soldier who attempted to run down the trail is also dead. The scout team exploits the site for maps and documents, cuts several collar insignia and shoulder patches from uniforms, and blindfolds the prisoner and zip-ties his hands together. The team leader contacts the platoon leader that he is departing the kill zone and moving on the trail toward the BTR with one prisoner. A smoke haze lingers under the tree canopy from the grenade the enemy soldier had thrown. As the raiding element rallies at the Platoon leader’s BTR, the scout squad observing KOLTE reports three wheeled vehicles emerged north of the village houses moving parallel to the road toward Hill 21. Two more vehicles, one is the turreted main gun vehicle, slowly approach along the main road bank.

RAID ACTIONS

1 Support element detonates AP mines as team enters 1 kill zone. 2 Fixing element provides 4 support by fire to isolate lead team. 2 3 Mortar section neutralizes trail team. 5 4 Raiding element assaults and seizes prisoner and 3 materiel. 5 Support element reports ENY advance from KOLTE.

Figure 4. Execution of raid northwest of KOLTE (vignette) The fixing element returns to the platoon rally point and has two scouts act as rear security maintaining awareness for any enemy movement up the trail. The OP on the north trail is now at the BTR too. The platoon leader directs the scout squad at the road to recover his OP to the west and linkup with his BTR on the northern military crest at the road and trail junction.

188 UNCLASSIFIED

Red Diamond

Probable Enemy Location 23 Concurrently, the senior sergeant on the western road reports that he is entering PEL 23 and continuing south on his reconnaissance. The senior sergeant rises higher in his BTR cupola as the morning mist suddenly starts to clear and visibility extends well south of the trail intersection and road at PEL 23. He senses something is not normal as he visually scans the road and woodline south of the trail intersection. Scouts start to dismount from the BTR. The squad leader near the eastern road departs his position viewing KOLTE and maneuvers his BTR around the crest of Hill 21. He collects his OP and they upload into the BTR. No sooner has the hatch closed on the BTR and enemy indirect fire starts to land along the road at the southern woodline, on the hillcrest, and on the northern slope.

RAID ACTIONS

1 Raiding element returns to 5 PL with EPW and materiel. 2 Fixing element reports no ENY activity in woodline. 3 3 Fixing element returns to 1 PL and mans OP for local security of PLT CP. 4 Support element reports 4 2 ENY advance with wheeled armored vehicles at KOLTE. 5 Support element recovers OP and moves to linkup Point with PL.

Figure 5. Raid actions and IRP reorganization (vignette) What Next? A tactical opportunity required a trained response to imminent enemy contact. The next article in this tactical vignette series will address tasks of delay, breaking contact, and/or linkup with an OPFOR. The platoon leader adapted quickly to the changing tactical conditions that emerged so far in his screen mission. The actions of IRP noncommissioned officers were instrumental to successful execution of a raid. Decentralized command and control (C2) of a threat/OPFOR demands leader initiative with prudent risk-taking and willingness to act, but also demands experienced judgement. Training Implications This article illustrates the value of individual skills proficiency and effective execution of small unit drills and tactical tasks based on quality training, teamwork, and leadership. Hill 21 was clearly the commanding terrain south of the MIN River and as far south as KOLTE. Continuous security and use of dismounted scouts allowed the IRP platoon leader to surprise and defeat the vanguard of an approaching dismounted enemy element in a raid using immediately available weapons systems of his task organization—semiautomatic and automatic rifle fires, antipersonnel mines, hand grenades, machinegun fire, and mortar indirect fires.

189 UNCLASSIFIED

Red Diamond

Surprise and deception are enablers to confuse the enemy and limit enemy response to a raid. The reconnaissance and counterreconnaissance tasks are a normal complement to each other unless constraints are placed on a mission to preclude counterreconnaissance actions. Using available cover and concealment with camouflage during an engagement provide a degree of protection, as well as supporting the coordinated withdrawal actions directly after the raid to a rally point.3 Preparations for this raid included mission brief and rehearsal, cover and concealment measures, interlocking sectors of fire among fighting positions of the fixing element, camouflage, improving fields of fire without overtly disturbing the natural foliage or terrain appearance, and integrating antipersonnel mines with natural obstacles. Assigned directions of fire, targets, and fire control measures for the raiding element and support elements enhanced massing combat power effects with a rapid and violent group of primary and enabling actions near and in the kill zone. The OPFOR is not necessarily restricted by law of war protocols or international conventions on armed conflict. The US Army defines an opposing force (OPFOR) as a plausible, flexible military and/or paramilitary force representing a composite of varying capabilities of actual worldwide forces (doctrine, tactics, organization, and equipment) used in lieu of a specific threat force for training and developing US forces.4 The OPFOR can represent a particular threat, hybrid threat, and/or adversary that can morph in capabilities and influence within a relevant population and operational environment. In threat/OPFOR training, executing a raid mission task and outcomes can include but not be limited to:  Destroy or damage key systems or facilities (such as command posts (CPs), communication facilities, supply depots, radar sites), providing or denying critical information, or securing hostages or prisoners.  Destroy, damage, or capture supplies or lines of communications (LOCs).  Support the information warfare (INFOWAR) plan.  Establish C2 method to link raiding force and sensors.  Distract attention from other OPFOR actions, keep the enemy off balance, and/or cause the enemy to deploy assets to a location that creates enemy vulnerability elsewhere.5 In expedient planning for a raid when a tactical opportunity emerges, reconnaissance and decisions typically consider aspects of:  Movement and/or maneuver routes from positions, an assembly area, or start point to the raid objective or kill zone.  Security locations and elements to the frontage, flanks, and rear of the raid objective or kill zone.  Support element locations and tasks.  Tactical actions of the raiding element prior to and in the objective or kill zone.  Exfiltration routes for raiding, security, and support elements.  Actions in the rally point. A raid is typically organized into three elements: a raiding element, security element(s), and support element(s).6  The raiding element executes the major task as the action element ensuring the success of the raid. This element accomplishes its task with rapid, violent combat action, and combines surprise and deception to overwhelm the enemy.  The security elements in a raid are enabling elements and are primarily focused on fixing enemy security and response forces or the enemy’s escape from the objective area. The security

190 UNCLASSIFIED

Red Diamond

element is typically equipped and organized to detect enemy forces and prevent them from contacting the rest of the targeted enemy element. The security element also protects the withdrawal of the raiding element  The support elements provide several types of support and are enabling elements. Support capabilities can include reconnaissance, armor, fire support, air defense, engineer, logistics, and INFOWAR. The command and control element typically positions with a support element unless a different location provides an improved ability to direct the raid. Conduct of a raid has several primary tasks and numerous subtasks. Planning and preparation precede mission execution of a raid. Key tasks during execution include infiltration and positioning of the mission elements, and isolation of the enemy target or objective. The primary action seizes or destroys the target in the objective. The concluding action of exfiltration moves or maneuvers the mission elements to the next tasks and/or continuation of the mission. Tasks and subtasks to consider in conducting a raid are as follows:

PLAN

 Identify enemy element or force capabilities and limitations to be raided.  Conduct analysis to determine the type of raid to be conducted.  Identify raid objective and/or objectives.  Analyze action and enabling functions that must be performed to achieve mission success, and consider tasks to deceive, disrupt, suppress, fix, contain, breach, defeat, and/or destroy.  Determine the functional tactics to be applied by action and enabling elements.  Identify situational understanding requirements for collection and analysis.  Task-organize elements or forces for the raid task by function in accordance with TC 7-100.2 and TC 7-100.3.  Determine how and when functional elements act or enable the raid, and/or transition to other tasks-subtasks.

PREPARE

 Conduct continuous reconnaissance and surveillance to provide situational understanding of enemy and operational environment required for success.  Conduct continuous counterreconnaissance to prevent the enemy from obtaining situational understanding of OPFOR intentions.  Conduct mission and task rehearsals.  Execute INFOWAR.

INFILTRATE

 Conduct undetected and sequenced movement by security elements through and/or into an area occupied by enemy elements to occupy a position(s) in order to fix enemy security or response elements.

191 UNCLASSIFIED

Red Diamond

 Conduct undetected and sequenced movement by support elements through and/or into an area occupied by enemy elements to occupy a position(s) in order to isolate the raid objective.  Conduct undetected and sequenced movement by support elements through and/or into an area occupied by enemy elements to occupy an indirect fires position(s) in order to suppress, disrupt, or contain enemy at raid objective.  Conduct undetected movement by a raiding element(s) through and/or into an area occupied by enemy elements to occupy a position(s) in order to seize or destroy enemy and/or enemy materiel in the raid objective.  Determine if current tactical conditions require an adjustment to the raid.

ISOLATE

 Employ reconnaissance and surveillance with security elements to sustain situational understanding and provide early warning of enemy activities that can influence the raid.  Employ continuous counterreconnaissance with security elements to prevent the enemy from obtaining situational understanding of OPFOR intentions.  Influence (deceive, degrade, disrupt, deny, and/or exploit) enemy tactical decisionmaking before and during execution of the raid through information warfare (INFOWAR) technical and psychological capabilities.  Isolate the enemy in the raid objective with support element(s) using indirect fires, nonlethal suppression means, and/or direct fires.  Fix enemy security element(s) and/or response elements to prevent or slow support to enemy at the raid objective.

SEIZE or DESTROY S  Attack with sudden and massed combat power of raiding [action] elements and support [enabling] elements to contain enemy at the raid objective and suppress effective defenses.  Assault to breach enemy obstacles with a breaching [enabling] element, if required, when seizure is required in the raid mission task. D  Assault to penetrate into raid site perimeter with an assault element(s), when taking possession of a designated area is required in the raid mission task.  Attack with sudden and massed effects of raiding, security, and support elements, to destroy enemy elements and/or combat systems, without seizure of the raid site, when physical control of the raid objective is not assigned in raid mission purpose and intent.  Support the raid with appropriate enabling task functions that may include but are not limited to: deception, disrupt, suppress, fix, breach, clear, and/or employment of reserve elements.  Assault with fires and maneuver as sudden and massed combat power of the raiding, security, and support elements to seize the raid objective.

192 UNCLASSIFIED

Red Diamond

 Secure selected information, equipment or materiel, and enemy prisoners.  Consolidate the objective in its temporary seizure and defend while the site is exploited by OPFOR elements.  Exploit the raid objective site when designated in the mission task and intent.  Reorganize OPFOR elements to minimize the impacts of combat losses and functional capabilities.

EXFILTRATE

 Distribute the reorganized OPFOR elements quickly into small elements for exfiltration along designated exfiltration lanes.  Conduct timely undetected movement from areas under enemy control by stealth, deception, surprise, or clandestine means.  Execute tasks after raid success with stay-behind elements, when required, that can include but is not limited to: surveillance, disrupt, delay, suppress, neutralize, defend, defeat, and/or destroy tasks.  Continue the mission. Note. Knowing the threat/OPFOR is essential to planning and combating the capabilities and limitations of an enemy or adversary in a training mission. When a specified threat exists in a deployment order, the actual threat force is represented or replicated in training and pre-deployment evaluations. When training is not focused on a particular real-world threat, Army activities use an opposing force as stated in Army Regulation 350-2. This regulation is a 2015 update on the operational environment (OE) and OPFOR program. As a hybrid threat, the OPFOR can represent or replicate diverse and dynamic combination of regular forces, irregular forces, terrorist forces, and/or criminal elements unified to achieve mutually benefitting effects.7 OPFOR tactical doctrine, tactics, and techniques are in Army Training Circular 7-100.2 and Army Training Circular 7-100.3.8 Note. The TRADOC G-2 Analysis and Control Element, Threats Integration Directorate (ACE-TI) at Fort Leavenworth (KS) is chartered to serve as US Army lead for designing, documenting, and integrating threat [or opposing force (OPFOR)] and operational environment (OE) conditions in support of all Army training, education, and leader development programs. In 2015-2016, the Threats Integration Directorate (ACE-TI) is reviewing and revising the threat/OPFOR tasks found in TC 7-101. The updated list of tasks and subtasks, with conditions and standards for US Army training readiness, will address traditional offensive and defensive tasks, as well as tasks involving instability in an era of persistent conflict now and for the foreseeable future.

Notes i Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. para. 8-83—8-86. 2 Headquarters, Department of the Army. Army Doctrinal Reference Publication 1-02, Terms and Military Symbols. 2 February 2015. p. 1-70. 3 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. para. 3-117. 4 Headquarters, Department of the Army. Army Regulation 350-2. Operational Environment and Opposing Force Program. 19 May 2015 with effective date 19 June 2015. para. 1-5b.

193 UNCLASSIFIED

Red Diamond

5 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. para. 3-175. 6 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. para. 3-177―3-185. 7 Headquarters, Department of the Army. Army Doctrinal Reference Publication 1-02, Military Terms and Symbols. 2 February 2015. p. 1-42. Also, see ADRP 3-0. 8 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. See also, Headquarters, Department of the Army. Training Circular 7- 100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 17 January 2014.

______

194 UNCLASSIFIED

Red Diamond

by CPT Nickolas Zappone, MP, Threat Tactics Analyst, TRADOC G-2 ACE Threats Integration Since December 2006, Mexico has been mired in a barbarous war with a quasi-omnipotent foe: Mexican drug trafficking organizations (DTOs). Characterized by extreme violence, intimidation, and unbounded profit and facilitated through widespread corruption, the Mexican War on Drugs has had a deleterious effect on the state’s image, security environment, and quality of life for Mexican citizens. Homicide rates have increased dramatically—up nearly threefold from 8.1 per 100,000 in 2007 to 23.7 per 100,000 in 2010—ostensibly attributable to the rise in DTO activities.1 The preponderance of Mexico’s municipalities are at best influenced—if not fully infiltrated—by the diverse actors categorized under

Figure 1: 2014 STRATFOR Estimate of Cartel Areas of Influence

195 UNCLASSIFIED

Red Diamond

the organized crime umbrella.2 Likely conservative estimates indicate that DTOs virtually control 30% of Mexico’s territory.3 Unfortunately, there are no signs that the violence will abate anytime soon. The seemingly perpetual state of conflict engulfing Mexico serves as the impetus for this article, as it will strive to serve as a primer for analyzing DTO criminal activities, terrorist actions, functional tactics, and their potential impact on Unified Action partner training. The Concept of a “Criminal Insurgency” Joint Publication 3-24, Counterinsurgency, defines insurgency as “the organized use of subversion and violence to seize, nullify, or challenge political control of a region.”4 In the case of DTOs, nullification (or at least co-opting) of the state is the principle focus as they seek “to weaken the structures of governance and rule of law to secure maneuver room for their own operations and influence.”5 And although they do not seek the ends of a traditional insurgency—the overthrow of the existing state, self- rule, and/or a revolutionary transformation—DTOs have developed an ascertainable strategy.6 The criminal insurgency strategy of DTOs is a three-pronged attack: attrit or co-opt law enforcement officers through a campaign of terror; conduct information warfare (INFOWAR) to degrade public and state resolve, intimidate rivals, and martial support; and conduct high profile assassinations of state officials.7 The long-term goal of this strategy is to force the Mexican state to abandon its offensive against DTOs so they can maintain their criminal enclaves of impunity, increase power, and maximize profit.8 DTOs use a combination of several ways and means to achieve their aforementioned ends. In the context of “criminal insurgency”i* the actions can be described as criminal activities, terrorist actions, functional tactics, and information warfare (INFOWAR). Criminal Activities Criminal activities can be defined as the varied use of tactics and techniques in violation of state statutes to make a fiscal profit and/or achieve influence.9 While DTO criminal activity has an ancillary effect of maintaining the coerced support of noncombatants through intimidation, its primary functions are to maintain control of the plazas (drug shipment corridors that serve as cartel support zones) and generate profit. Two of the most common criminal activities that DTOs engage in are extortion and trafficking, both of which greatly contribute to the real and perceived insecurity and instability of the nation. Protection rackets requiring Mexican citizens to pay derecho de piso (protection money) to DTOs is an innocuous means of revenue generation relative to other DTO criminal activities. DTOs require local business proprietors to make recurring payments in exchange for the DTOs’ protection from street gangs, rivals, and/or corrupt Mexican authority figures. This revenue stream is directly linked to the DTOs’ ability to maintain and acquire “turf.” The more “turf” a DTO controls, the more protection money it generates. The importance of acquiring and maintaining terrain cannot be understated. DTOs derive their power from the plazas in that they provide them the ability to generate revenue via criminal activities, primarily trafficking. The widely accepted theme is that drugs and people move north while money and guns move south. Although the profit generated by “shakedowns” in a protection racket is substantial, no criminal activity is as lucrative as the DTOs’ main effort—drug trafficking. All instances of criminal activity coalesce

i Author’s interpretation of Sullivan and Elkus’s term “criminal insurgency” is that the “criminal” modifier serves to clarify the goals and motivations of the cartels while the “insurgency” subject illustrates the more kinetic methods they use to achieve them. 196 UNCLASSIFIED

Red Diamond

around the production, distribution, and sale of illegal psychotropic drugs, mainly heroin, methamphetamine, and cocaine. The US Department of Justice estimates that Colombian and Mexican DTOs generate between $18 billion and $39 billion annually solely from drug sales in the United States.10 Proceeds from narco-trafficking is the lifeblood of these organizations, enabling reinvestment into licit and illicit markets alike, ranging from real estate investment to the purchase of precursor chemicals necessary to manufacture drugs.11

Figure 2: 2012 STRATFOR Estimate of Cartel Areas of Influence w/ Smuggling Routes Terrorist Actions According to Training Circular (TC) 7-100.3, Irregular Opposing Forces, “Terrorism can be defined as the use of violence or the threat of violence to instill fear and coerce governments or societies.”12 The key distinction between quintessential terrorist organizations (e.g. al-Qaeda and its affiliates) and DTOs is that the latter use terrorist actions as means to obtain profit and not in the furtherance of a religious or political ideology. Additionally, DTOs use terrorism to psychologically affect rivals, the state, and the citizenry with the goal of convincing or compelling them to act in a desired manner.13 Predominate motivations for DTO terror campaigns are diverse: disrupt their enemy’s ability to act, obtain active and/or passive support from the relevant population, deter continued enemy operations in a particular geographic area, dissuade enemy governmental influence over the relevant population, and develop acceptance and legitimacy of their criminal agenda.14

197 UNCLASSIFIED

Red Diamond

One of the more common terrorist actions perpetrated by DTOs is kidnapping. This action is often combined with the criminal activities of murder and maiming to enhance the message’s potency. Targets range from rival DTO sicarios (Spanish slang for hitman) and halcones (Spanish for falcons, a moniker given to cartel lookouts) to municipal police. Kidnapping victims often face macabre execution methods like decapitation by chainsaw, dismemberment, and dynamiting. The latter is a recent technique used by the Jalisco Cartel-New Generation (CJNG) in Jalisco state in which the captured victims have sticks of dynamite taped to them (typically to their torso or neck) that are detonated while still alive.15 Although less frequent than commonplace terrorist actions like kidnapping, genocide-like mass executions can have a much more paralyzing effect on intended audiences. Countless narcofosas (mass graves) have been found throughout the country, the most memorable being a result of the 2011 San Fernando Massacre. Members from Los Zetas (defected Mexican Special Forces Soldiers previously employed by the Gulf Cartel as enforcers) intercepted several buses full of Central and South American migrants traveling north toward border towns.16 Suspecting that the migrants were recruits of the rival Gulf Cartel, Los Zetas murdered all 193 captives and buried them in several mass graves. The alleged sole survivor recounted to a Mexican media outlet that women were raped, men were forced to fight one another to the death in a gladiator-style blood sport, and that infants were thrown into vats of acid.17 Alternative assessments exist, however, and some analysts believe that the mass murder was a message to the Central American “coyotes” engaged in the lucrative human smuggling enterprise. The message: everyone must pay.18 Functional Tactics The United States Armed Forces defines tactics as “the employment and ordered arrangement of forces in relation to each other.”19 Similarly, the Hybrid Threat (HT) employs functional tactics. The HT chooses which functional tactic to use (e.g. ambush, raid, or reconnaissance attack) based upon the functions (e.g. disrupt, fix, or destroy) that need to be performed as part of an action to bring about its success.20 The following vignette illustrates the applicability of the term “criminal insurgency” to DTOs because criminals typically do not have the ability to execute functional tactics.21 In response to the killing of CJNG cell leader Heriberto Acevedo Cardenas (“El Gringo”) after a March 2015 shootout with police, the CJNG retaliated. At approximately 1450 hours, 6 April 2015, an unknown number of CJNG members armed with automatic weapons and grenade launchers ambushed a two-man convoy composed of members from the United Force of Jalisco (a specialized police unit in the western- central Mexican state of Jalisco) on a rural highway in the Sebastian del Oeste municipality of Jalisco state.22 Figure 3 illustrates the analyst’s interpretation of how CJNG could have executed the annihilation ambush. The attackers established the annihilation ambush on favorable terrain: firing positions were established adjacent to a portion of the two-lane highway that offered the attackers good cover and concealment and fields of fire from the surrounding high ground; the terrain also provided unobservable approach and withdrawal routes. To block the police convoy, the attackers emplaced a burning vehicle on a bridge on the eastern edge of the kill zone. This complemented the already canalizing terrain and further restricted police maneuver. There were also indicators that the attackers had been waiting at the ambush site for some time. Residual debris included clothes, beer cans, empty water bottles, food

198 UNCLASSIFIED

Red Diamond

containers, condoms, and tents.23 The end result was the deadliest attack on Mexican police since 2010: 15 dead and 5 injured.24

Figure 3: CJNG Annihilation Ambush INFOWAR Threat doctrine defines INFOWAR “as specifically planned and integrated actions taken to achieve an information advantage at critical points and times.”25 DTOs primarily employ the INFOWAR elements of deception and perception management to achieve the tactical tasks of disrupt, deceive, and influence. The proliferation of information and communication technologies has enabled DTOs to communicate their narrative of plata o plomo (Spanish for silver or lead) to the majority of relevant actors within the operational environment. Coupled with coercion of the media, low-tech reconnaissance tools (e.g. a halcone with a mobile device) and espionage via endemic state corruption, DTO INFOWAR is robust and effective. INFOWAR can be the impetus for combat action, particularly when the objective is to wage psychological warfare against relevant actors. Grisly recordings of beheadings, public displays of mutilated bodies, mass executions, and even name selection (e.g. Mata Zetas, Spanish for Zeta Killers) are all elements of the typical DTO INFOWAR playbook. These abhorrent acts of violence are specifically conducted to influence “the attitudes, emotions, motivations, aggressiveness, tenacity, and reasoning of enemy personnel.”26 The propagation of these acts is sometimes in conjunction with corpse-messaging and narco-banners to further shape the social and environmental conditions in their favor. Nonlethal examples of perception management activities are manifested in media and recruitment activities. Narcocorridos (Spanish for narco-ballad) is a popular music genre that glorifies the narco lifestyle and venerates DTO leaders. In a country beset by socioeconomic inequality, disenfranchised Mexican youths gravitate to DTOs for employment and a sense of belonging. In 2007, only eight minors

199 UNCLASSIFIED

Red Diamond

were charged with involvement in organized crime in Mexico; in 2010 that number skyrocketed to 214.27 By highlighting the government’s inability to tackle social and economic issues like endemic corruption, violent crime and poverty, DTOs are able to bolster their ranks with a steady stream of young recruits. Implications for Training DTOs are becoming increasingly militarized in the way in which they execute tactical operations, potentially a result of the integration of ex-military defectors into Figure 4: Popular narcocorrido band Los their ranks. Their military capabilities improve as they Tigres Del Norte performing a hit song continue to acquire military-grade weapons like high- powered automatic weapons and sniper rifles; light, medium, and heavy machine guns; grenades and grenade launchers; light anti-tank weapons; rocket-propelled grenades; armor-piercing munitions; 60- mm mortars with high explosive rounds; and improvised explosive devices.28 In light of this threat, joint force units regionally aligned with US Northern Command (NORTHCOM) and US Army Military Police (MP) units that could potentially be tapped to provide security force assistance to Mexican security forces should place a premium on battlefield survivability tasks during training. MP units must be acutely aware of the fact that many Mexican police forces are far less capable than their military counterparts with regards to manning, equipment, training, leadership, and morale. Determining how to address these gaps would be critical to the success of the overall security force assistance mission. On a macro level, Department of Defense (DoD) justice and security enablers like US Army Criminal Investigations Special Agents, Corrections Specialists, and Judge Advocate General officers may consider preparing to augment existing Merida Initiative programs and activities. The Merida Initiative is a security cooperation partnership between the US and Mexico to disrupt organized crime, sustain the rule of law, increase border security, and build strong and resilient communities.29 It is conceivable that DoD enablers may be integrated into the existing partnership structure to buttress the Mexican security and justice sectors. Integral to the success of the initiative, however, is maintaining a semi-permissive security environment, which continues to be an ongoing challenge.

Notes 1 Cory Molzahn, Octavio Rodriguez and David A. Shirk. “Drug Violence in Mexico.” Trans-Border Institute at the University of Sand Diego. February 2013. 2 John P. Sullivan. “From Drug Wars to Criminal Insurgency.” The VORTEX Foundation. March 2012. 3 John P. Sullivan. “From Drug Wars to Criminal Insurgency.” The VORTEX Foundation. March 2012. 4 Joint Publication 3-24. “Counterinsurgency.” 22 November 2013. 5 John P. Sullivan and Adum Elkus. “State of Siege: Mexico’s Criminal Insurgency.” The Small Wars Journal. 19 August 2008. 6 Steven Metz. “Rethinking Insurgency.” Strategic Studies Institute. June 2007. 7 John P. Sullivan and Adum Elkus. “State of Siege: Mexico’s Criminal Insurgency.” The Small Wars Journal. 19 August 2008. 8 John P. Sullivan and Adum Elkus. “Plazas for Profit: Mexico’s Criminal Insurgency.” The Small Wars Journal. 26 April 2009. 9 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. Para 4-48. 10 Patrick Radden Keefe. “Cocaine Incorporated.” The New York Times Magazine. 15 June 2015. 11 Jason Lange. “From spas to banks, Mexico economy rides on drugs.” Reuters. 22 January 2010. 12 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. 13 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. Para 6-2.

200 UNCLASSIFIED

Red Diamond

14 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. Para 6-7. 15 Lucio R. “CJNG: killing enemies by dynamite.” Borderland Beat. 15 June 2015. 16 Oscar Martinez. “How the Zetas Tamed Central America’s ‘Coyotes.’” InSight Crime. 1 May 2014. 17 Borderland Beat. “A Nightmare of the Massacre in San Fernando.” 18 April 2011. 18 Oscar Martinez. “How the Zetas Tamed Central America’s ‘Coyotes.’” InSight Crime. 1 May 2014. 19 Joint Staff. Chairman of the Joint Chiefs of Staff Manual 5120.01A. 29 December 2014. 20 Headquarters, Department of the Army. Training Circular 7-100, Hybrid Threat. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2012. Para 5-18. 21 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. 22 John P. Sullivan and Robert Bunker. “Mexican Cartel Tactical Note # 25: Ambush Kills 15; Injures 5 Police in Jalisco.” The Small Wars Journal. 16 July 2015. 23 Lucio R. “video: footage of the aftermath of CJNG ambush on state police.” Borderland Beat. 11 May 2015. 24 John P. Sullivan and Robert Bunker. “Mexican Cartel Tactical Note # 25: Ambush Kills 15; Injures 5 Police in Jalisco.” The Small Wars Journal. 16 July 2015. 25 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. Para A-1. 26 Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. Para A-33. 27 Geoffrey Ramsey. “Poverty a Recruitment Tool for Mexico’s Criminal Gangs.” InSight Crime. 20 July 2011. 28 David Kuhn and Robert Bunker. “Mexican Cartel Tactical Note # 17.” The Small Wars Journal. 17 February 2013; David Kuhn and Robert Bunker. “Mexican Cartel Tactical Note # 15.” The Small Wars Journal. 14 January 2013. 29 United States Diplomatic Mission to Mexico. http://mexico.usembassy.gov/eng/ataglance/merida-initiative.html/. 13 October 2015.

______

201 UNCLASSIFIED

Red Diamond

Russian Tactics in Syria by John Cantin, TRADOC G-2 ACE Threats Integration Directorate (BMA Ctr)

In September of 2015, the Russians publicly acknowledged what had been common knowledge for at least a year—that Russian troops and equipment were being moved to Syria to support the Assad regime. Most of the Russian effort had been confined to the Russian naval base at Tartus, but recent intelligence shows that the Russians are methodically establishing bases at Bassel al-Assad Airport, Homs, the port at Latakia, and Damascus International Airport. These installations are being built up to support transport aircraft, heavy weaponry, and troops. This deployment and buildup of facilities for military use is all part of the Russian practice of what is commonly referred to as “Hybrid War.” The Russian foray into Syria uses some of the same tactics that the Russians have employed in Georgia, Crimea, and . This article will describe the methods that the Russians used to gain a foothold in Syria and how they expect to exploit their initial military success. It is important to note that the Russians do not use the term Hybrid Warfare to describe these tactics. This is the term that the Western media, think tanks, and analysts have developed to define this method of warfare. The Russians have used terms such as indirect, asymmetrical, and non-linear when discussing what is commonly referred to as Hybrid Warfare. Hybrid Warfare is a part of the strategy/policy of what can be called Indirect Action that the Russians believe is essential to protect their interests. To the Russians, using covert methods, information warfare (INFOWAR), and special operations troops to make up for conventional disadvantages has been the norm for decades. Russia is using the same strategy they employed in Georgia and Eastern Ukraine with one key difference. Instead of supporting an insurgency against an established government, they are supporting an established government (the Assad Regime) against an ongoing insurgency (Islamic State [ISIL/ISIS], the Free Syrian Army [FSA], and the Al-Nusra Front). In a sense, the Russians are using a reverse strategy from their previous military moves. Russian has maintained a naval base at Tartus since 1971, under an agreement with the Syrian Ba’athist government. This base has allowed Russia to maintain a military presence in Syria and provided the Assad government with military equipment, advisors, and training. From 1960 to 1980 Syria received most of its military equipment from the former Soviet Union, and many Syrian army officers received training in the Soviet Union or were trained by Soviet advisors in Syria. The Russian naval base at Tartus provided the Russians with an entry point for supplies, equipment, and personnel into Syria. In the same way that the Russians smuggled equipment and personnel into South Ossetia and Abkhazia in 2008 and Crimea in 2014, the Russians were able to set the conditions for a robust logistical effort in Syria. Since July, the Russians have moved men and materiel into Tartus and Bassel Al-Assad Airport. The latest estimate of Russian equipment is:

202 UNCLASSIFIED

Red Diamond

 Six T-90 or T-72s Main Battle Tanks (MBTs), confirmed with imagery  12-15 howitzers (D-30s), confirmed with imagery  35 armored personnel carriers, confirmed with imagery  Single Source reports the use of BTR-82A in combat  Prefabricated housing for at least 500–2,000 additional troops  Mi-24 (Hind) helicopters  Mi-17 (Hip) helicopters  Numerous logistical trucks (Bassel al-Assad International Airport)  UNK BN from the 810th Naval Infantry Brigade (likely Tartus “selfies”)  Russia deployed mixed aviation regiment:  12: Su-24M2s  12: Su-25SM2s  10: Su-30SMs The Russians began to reinforce their security force at the Port of Tartus in May–June of this year. The build-up continued over the summer as advisors, security personnel, and engineers began to build support facilities and improve the infrastructure of Bassel Al-Assad Airport. Barracks were built, runways and hangars were improved or constructed, and a robust security system was installed. To augment and legitimize the deployment of equipment and troops, the Russians have initiated an INFOWAR campaign that presents this effort as a “battle against international terrorism.” Since there are Russian jihadists fighting with ISIL and other terrorist groups, President Putin has stated numerous times that the Russians are simply fighting the terrorists in Syria before they return to Russia. With the memory of two wars in Chechnya and numerous terrorist attacks (the and the Moscow theater standoff to name just two), this is not a hard sell to the Russian public. On 30 September 2015 President Putin asked the upper house of the Russian Parliament for permission to deploy the Russian military to Syria. This was unanimously granted under the guise that Russian troops would be fighting “terrorist groups” and only using air power. The compliant Russian media attempted to legitimize this request by reporting that Syrian President Bashar al-Assad had requested Russia’s help. The INFOWAR theme has been used before, most recently in the . The idea that the Russians are simply fighting terrorists will be the mantra for the Russians during this campaign. As Russia conducts airstrikes against Assad’s enemies, ground forces with Russian “advisors” will simultaneously move into territory that will provide Syria with a buffer area to give the Damascus regime time and space to continue offensive operations against ISIL, FSA, and Al-Nusra. Russia wasted no time after the parliamentary decree to use force. Later that day (30 September 2015), the Russian Air Force launched airstrikes in Homs province in Syria, a Figure 1. Russian fighter jet in Syria crucial area to both Assad and the Russians.

203 UNCLASSIFIED

Red Diamond

The Russians gave the US a one-hour notice of the bombing, therefore denying the US time to react both diplomatically and militarily. The element of surprise and speed that was used in Crimea and eastern Ukraine was used to catch the US and the world off guard. By 1 October the Russians had stepped up their deployment of aviation assets to their newly refurbished airfields by inserting over fifty planes and helicopters into Syria. This rapid deployment capability was made possible by the slow and steady buildup of troops and equipment at the Tartus depot. The key equipment, materiel, and personnel were already pre-positioned at the Tartus base, ready to receive and maintain the aircraft as they arrived. By using the INFOWAR tactic prior to offensive military action, the Russians have repeated a tried and true tactic—continually repeat the message that you want a diplomatic solution to an ongoing problem/crisis while stealthily moving troops and equipment into place. This is then followed by sudden and unexpected military action. By the time the rest of the world realizes what has happened (and lodges indignant complaints and protests) the Russians are in a military position of power and advantage. This was done in Crimea with great success and is being conducted by the Russians in Syria now, albeit at a slower, more methodical pace. As the Russians improved their defenses of Tartus and Bassel Al-Assad Airport, they also stepped up their covert operations by coordinating for arms shipments to Syrian government forces and coordinated with Iranian backed militias in Syria.

Figure 2. Bassel al-Assad International Airport. A satellite image revealed Russian combat aircraft, including 4 Sukhoi Su-30SM multirole (air-to-air and ground interdiction) fighters, 12 Sukhoi Su-25 attack planes, and 12 Sukhoi Su-24 attack planes.

The Russians have also made use of private security contractors, most of whom are former soldiers with special operations training. Using contractors allows the Russians to maintain deniability and flexibility as contractors are not officially aligned with the Russian government or military. This helps the Russians build up intelligence and logistics networks that can be exploited later during increased combat operations. This is all part of setting the conditions for follow-on operations to expand combat or maintain sustained and continuous operations. This increase in Russian presence and tempo sets the stage for possible large-scale conventional combat in the future. By constructing support systems and facilities, as well as intelligence and logistics networks, the Russians give themselves a myriad of options to shape the political/military conflict. These

204 UNCLASSIFIED

Red Diamond

moves allow Russia to insert itself as a vital player in any diplomatic effort to solve this crisis, a crisis that the Russians have deftly exploited for their own benefit. The Russians have also deployed special forces troops to Syria to assist with training of Syrian government troops and targeting for future airstrikes. Once these forces have set the conditions for ground operations, they will most likely assist the Syrian government forces to retake strategic targets to strengthen Assad’s government. This has already happened with limited offensives in Homs and Aleppo. This is significant because it illustrates the Russian formula for offensive action. The Russians have used stealth to infiltrate troops and equipment, INFOWAR to deny and then justify this build-up, Figure 3. Private security contractors in Syria intelligence and special forces units to gather intelligence and set the conditions for offensive action, and eventually, offensive kinetic action in the form of airstrikes followed by small units of Russian special forces and “advisors” used to capture

Figure 4. Graphic description of fight for Aleppo

205 UNCLASSIFIED

Red Diamond

key terrain. Russia will continue these tactics to maintain a military presence in Syria, much as it has done in Crimea and Ukraine. US forces can use the several examples of Russian intervention in Ukraine and Syria as a part of training events. One should assume that by the time US forces are deployed to a region that meets these conditions, an enemy force will already have advisors and special operations forces in place. Units should take this into account and attempt to replicate this. Also, a robust INFOWAR capability should be allotted for the Opposing Forces to ensure that US forces become accustomed to dealing with and countering INFOWAR tactics and techniques.

References David Blair and Tom Whitehead. "Russian jets in Syria mean no-fly zone is 'out of the question', warn experts." . 22 September 2015. David Cenciotti. "New Satellite Image unveils an impressive line-up of 12 Russian Su-25 Frogfoot attack jets in Syria!" The Aviaitionist. 30 September 2015. David Cenciotti. Six Russian Su-34 Fullback bomber have just arrived in Syria. And this is the route they have likely flown to get there. The Aviaitionist. 29 September 2015. Kris Lechowicz. Russians Troops in Syria Brief. 2 October 2015. Tyler Rogoway. "First Video Report From Russia's Air Base In Syria Shows Su-34s In Action". Foxtrot Alpha. 18 October 2015. Eric Schmitt and Michael R. Gordon. "Russian Moves in Syria Widen Role in Mideast" The New York Times. 14 Sep 2015. Eric Schmitt and Neil MacFarquhar. Russia Expands Fleet in Syria With Jets That Can Attack Targets on Ground New York Times. 22 September 2015. Stratfor. Russian Fighter Aircraft Arrive in Syria. http://www.janes.com/article/54709/russia-deploys-powerful-strike-group-to- syria 21 September 2015. Stratfor."Russian Fighter Aircraft Arrive in Syria". Stratfor. 30 September 2015. Dylan Vosman. "In Syria spotted Russian BM-30 heavy multiple rocket launcher". 30 September 2015. Shaun Walker. "Russian parliament grants right to deploy military in Syria". The Guardian. 30 September 2015.

______

206 UNCLASSIFIED

Red Diamond

Mission Command Training Program: Warfighter Exercise (WFX) 16-2 by Patrick Madden, TRADOC G2 ACE Threats Integration (BMA CTR) MCTP WFX 16-2 was a distributed, simulation-supported, corps-level, command-post exercise. WFX 16-2 was held in Fort Campbell, KY, Camp Atterbury, IN, and Fort Leavenworth, KS from 13–22 November 2015. WFX 16-2 was one of five corps- and division-level exercises to be conducted by MCTP, Operations Group X-Ray, during fiscal year 2016. The majority of WFXs are based on the Decisive Action Training Environment (DATE) and the Army Training Circular 7-100 series of publications. The purpose of these exercises is to create a competitive and multi-echelon component joint training environment in order to provide commanders the opportunity to execute mission command in unified land operations. If available, multi-national coalition units also participate. Each WFX is approximately 10 days in length and includes a comprehensive list of tasks in order for units to accomplish specific training objectives. Based on this timeline, the following discussion describes the scenario design, training units, unique features of WFX 16-2, and the World Class OPFOR (WCOPFOR) execution of this DATE-based exercise.

Figure 1. Disposition of OSC 2 units after invasion

207 UNCLASSIFIED

Red Diamond

Scenario Design The road to war scenario leading up to the start of the exercise involves a dispute between Ariana and Atropia. Ariana accuses Atropia of stealing its oil reserves and threatens military reprisals. This is followed by the United Nations imposing two rounds of sanctions on Ariana and the US evacuation of its embassy in Baku. Ariana responds by deploying its military units along the Ariana/Atropia border under the guise of conducting training exercises. An agreement is then made between the US and Atropia to deploy US forces to deter further Arianian aggression. US forces arrive at the port of Poti in Gorgas and begin movement to Tbilisi for joint reception, staging, onward movement, and integration (JRSOI). Without warning, Ariana responds by invading Atropia with an operational-strategic command (OSC) comprised of four division tactical groups (DTGs). Ariana is successful in seizing most of Atropia with the exception of the northwestern region, small area in the far northeast, and the Tramaz peninsula, which includes the capital of Baku. Ariana forces also captured a significant portion of the Trans-Caucasus Petroleum Pipeline. In response, the US issues Presidential Decision Directive 35 to expel Arianian forces from Atropia. As a result of US military force authorization, shaping operations commence and Combined Joint Task Force (CJTF) 12 is created to intervene on behalf of Atropia. Led by US forces, CJTF 12 completes JRSOI and begins movement into western Atropia in order to attack, defeat, and force the withdrawal of OSC 2 back into Ariana. Also located in Atropia are remnants of brigades from Field Group Atropia defending terrain in order to buy time for CJTF 12 forces to arrive. In the northeastern portion of Atropia, remnants of the Northern Command and Capital Defense Command also remain in order to defend against OSC attempts to capture Baku. When the exercise begins, ground forces from CJTF 12 complete a forward passage of lines with two Atropian Army brigades. These two brigades transition with a follow and support mission of CJTF 12. Initially, the main effort is led by the US 101st Airborne Division (Air Assault) in the north and supported by the 29th Infantry Division in the south. Training Units The evaluated training divisions for this exercise were the 101st Airborne and the 29th Infantry Division (ID) from the Army National Guard. Supporting the 101st were four brigade combat teams (BCTs). Also supporting the 101st were an Atropia Motorized Brigade and three additional US brigades consisting of artillery, maneuver enhancement, and rotary wing aviation. Training objectives for the 101st were the following:  Conduct multiple brigade task force-sized air assault operations to defeat a complex hybrid threat.  Employ division mission command posts, maintain continuity of operations and common operational picture, and validate mission command systems.  Organize, synchronize, and integrate intelligence, surveillance, and reconnaissance/collection management functions to facilitate the division targeting cycle.  Integrate the division artillery into the division mission command structure, exercising the targeting process throughout each planning horizon.  Validate 101st Sustainment Brigade’s land/air operations supporting the division for ground and air assault missions beyond 72 hours.  Conduct a deliberate wet-gap crossing of a brigade task force-sized element over complex terrain.  Conduct operational assessments to inform the commander’s decision cycle.

208 UNCLASSIFIED

Red Diamond

 Conduct stability operations in coordination with host-nation and joint partners to establish a safe and secure environment.  Integrate and synchronize the division targeting process for stability operations between host- nation and joint partners. Supporting the 29th were three BCTs. Also supporting the 29th were an Atropian armor brigade and three additional US brigades consisting of artillery, maneuver enhancement, and rotary wing aviation. Training objectives for the 29th were the following:  Exercise mission command using the operations process to employ forces in unified land operations. Execute decisive action (offense, defense, and stability tasks) by means of combined arms maneuver and wide area security to defeat a hybrid threat.  Enhance the battle staff’s tempo and quality of operational planning for branches, sequels, and concept plans.  Exercise the intelligence process by managing information collection, supporting the targeting process, and providing intelligence support and situational understanding to the commander and staff.  Enhance the quality and efficacy of intelligence processes and products through the use of tiered intelligence assets at the national, theater, and corps echelons.  Synchronize lethal and non-lethal fires, including joint fires from naval and US Air Force assets, using the targeting process in coordination with higher-, lower-, and adjacent-unit fires in a complex environment to include gap crossing and air assault.  Refine the division’s battle rhythm for decisive operations.  Plan and execute division sustainment operations in coordination with corps and theater plans.  Plan and execute effective stability tasks in coordination with host nation to establish a safe and secure environment.  Refine division information and knowledge management systems and processes.  Plan and execute electronic warfare and cyber defense operations. The training division’s higher command was XVIII Airborne Corps (ABC). XVIII ABC was portrayed as the Coalition Joint Forces Land Component Command (CJFLCC). The notional CJTF 12 was portrayed as the 6th US Naval Fleet. Also part of CJTF 12 were the Combined Forces Air Component Command (CFACC), Joint Force Special Operations Command, and a notional Joint Force Maritime Component Command. Response cells from these respective commands replicated the associated subordinate commands. Other evaluated units supporting XVIII ABC consisted of a military police brigade and two sustainment brigades. These evaluated brigades were also competitive, had training objectives, and were also part of the formal after-action review process. In addition to these units, XVIII ABC was also supported by six additional brigades and two battalions, which included an artillery brigade, a maneuver brigade, and a combat aviation brigade. These additional units all operated as competitive response cells but were not part of the evaluated training audience. The exercise for training units was planned as a five-phased CJFLCC operation. Execution of the exercise was limited to Phase III, which was divided into three sub-phases (see figure 2). Phase II, Seize the Initiative, had already occurred prior to the beginning of the exercise. Phase II focused on setting the conditions to allow coalition forces to conduct successful offensive operations during Phase III. Phase II included shaping operations from the CFACC and other long-range fires. At the start of Phase III, Access, the 101st attacked in zone in the north to defeat Arianian forces. The purpose was to link up and relieve forces in Baku or conduct supporting attacks to isolate Arianian forces and compel their surrender or

209 UNCLASSIFIED

Red Diamond

withdrawal. At the same time the 29th ID, supporting CJFLCC forces in the south, would attack in zone to defeat the enemy’s defenses, interdict the enemy lines of communication, and force a withdrawal or complete the isolation of Arianian forces in Atropia. Critical to the CJFLCC offensive throughout Phase III was the rapid seizure of key terrain to gain operational depth in order to create multiple dilemmas for Arianian forces. Phase IIIC, Defeat, ended once the Arianian forces withdrew from Atropia and the southern Atropian border was restored. The CJFLCC would then transition to Phase IV, Stability Operations, which was the final phase of the operation.

Figure 2. CJFLCC concept of phases Unique features of this exercise were two competitive training divisions, increased offensive tempo, and an opposing force (OPFOR) synchronization group. Normally during warfighter exercises there is only one division that is a competitive, evaluated division. The other division is scripted, controlled by MCTP, and not evaluated by an operations group. It is essentially a “wrap-around unit” that provides the necessary force structure for the corps CJFLCC or another designated joint task force. Associated with this unique feature was the aggressive, offensive nature of both divisions, especially the 29th ID. From the beginning of the exercise until it ended, both divisions were exceptionally aggressive during offensive operations and sustained heavy losses, as did the WCOPFOR. Fortunately for the WCOPFOR, there was a daily OPFOR synchronization group meeting that was held each morning and designed to discuss and coordinate with various operations groups or neutral/white cell organizations. The purpose of this daily event was to help minimize exercise confusion and ensure that training objectives were being met. It also helped other participants like media, irregular forces, Atropian leadership, and operations groups to voice their issues, discuss solutions, and get a larger, current picture of all sides of the ongoing conflict. This relatively new synchronization group has been growing in attendance and has significantly helped to reduce confusion as well as to synchronize the WCOPFOR future actions with all other applicable MCTP organizations.

210 UNCLASSIFIED

Red Diamond

Figure 3. OSC 2 maneuver forces Opposing Force WCOPFOR continues to plan and operate competitively as an OSC during WFXs, with approximately four subordinate divisions and three separate brigades. The Supreme High Command (SHC) is part of the MCTP exercise control group and is not a simulated unit, with the exception of its strategic reserves. The SHC writes and publishes its strategic campaign plan for WCOPFOR implementation. It also operates as a white hat organization that attends OPFOR synchronization and white cell meetings, receives guidance from MCTP leadership, and coordinates with the OSC. The OSC and SHC are intentionally separated during exercises since the WCOPFOR is competitive. During this exercise, OSC 2 opposed XVIII ABC and its two subordinate divisions. Constituent maneuver units from OSC 2 were four division tactical groups (DTGs) consisting of the 17th, 18th, 19th, and 20th. Also constituent was the 306th Reconnaissance Brigade (-), as well as the 304th Tank Brigade, which was initially designated as part of a strike force and later as the OSC reserve. The 3241st Special-Purpose Forces (SPF) Brigade and 995th Commando Brigade were constituent and dedicated units respectively for OSC 2 (see figure 3). Included in this force structure was the integrated support command (ISC) with three dedicated militia brigades and a motorized infantry brigade in order to provide protection in the OSC support zone. The OSC 2 also utilized an integrated fires command that consisted of long range artillery, air defense artillery, and fixed and rotary wing aircraft. The mission of OSC 2 was to retain key terrain including the Sangachal Oil Terminal and bridges across the Aras, Agshu, and Kura rivers, to include defeating coalition forces in order to set the conditions to seize Objective EBI (Baku). Operational success was defined as destroying coalition forces west of phase line Reno, retaining control over the Sangachal Oil Terminal, and seizing Baku. At the beginning of the exercise, the overall strength of OSC 2 units was approximately 60-70%, resulting from previous attrition from the invasion of Atropia and subsequent CFACC shaping operations. Coalition forces attacked with units at approximately 100% strength. OSC 2 maneuver units used both defensive and offensive tactics throughout most of the exercise. Offensive tactics included several planned and executed counterattacks in attempts to block or stall the coalition offensive. OPFOR Defense In order to retain its captured Atropia territory, the OPFOR divided its OSC 2 area of responsibility (AOR) into disruption, battle, and support zones and assigned key tasks. The key task for the 306th

211 UNCLASSIFIED

Red Diamond

Reconnaissance Brigade (-) in the OSC 2 disruption zone was to disrupt and delay coalition forces, as well as conduct counter-reconnaissance. To the east of the 306th disruption zone were the 19th and 20th DTGs. Both divisions were tasked to conduct an area defense as well as seize key bridges in their AOR in order to retain key terrain and deny coalition wet-gap crossing sites along the Agshu and Aras Rivers respectively. Located south of the 20th DTG battle zone was the OSC 2 support zone. Positioned in this zone in assembly areas were the 17th and 18th DTGs. The primary on order mission for the 17th DTG was to reinforce the 19th or 20th DTG area defenses with a secondary enabling mission of isolating Baku in the northeast. The 18th DTG mission was to function as an exploitation force and attack to seize Objective EBI (Baku). Also located in the support zone was the 304th Tank Brigade that functioned as the OSC 2 reserve. The ISC, with its four militia brigades and one motorized brigade, was tasked with providing freedom of movement of sustainment forces by conducting counter-reconnaissance and securing lines of communication, major supply routes, and bridging sites. The purpose of this task was to prevent US Special Forces from interdiction and targeting. In addition to the WCOPFOR regular forces described in previous paragraphs, there was an extensive effort throughout the exercise to use SPF, commandos, and irregular forces throughout the XVIII ABC area of operations. Irregular warfare continues to be a very effective affiliated asset to WCOPFOR. The most effective organizations were the South Atropia Peoples’ Army (SAPA) and the commando units. Their success enabled SPF to focus on other missions, such as operational reconnaissance, without having to be used exclusively for direct action missions. WCOPFOR uses its SPF to support SAPA and closely coordinates their operations. SAPA and commando direct action attacks are focused on soft targets, such as logistical units along major supply routes, maneuver enhancement brigades, airfields, and forward arming and refueling points, all of which have a significant impact on training units’ ability to conduct wide area security. These attacks were planned and successfully executed throughout Atropia during the exercise. This combined support helped enable the WCOPFOR to focus on the maneuver units attacking it. OPFOR Defensive Operations At the beginning of the exercise, the 29th ID and 101st Airborne attacked to the east. Unlike previous exercises, both divisions advanced at a much faster pace. This led to the creation of initial gaps between the two division boundaries but a concerted effort by both divisions closed the gaps, which were not as significant relative to previous exercises. It should be noted that it is much more difficult to keep adjoining boundaries tight when you have dissimilar types of divisions. During the same time the 306th, 19th, and 20th all moved simultaneously into their defensive positions as the coalition forces attacked eastward. Typically the WCOPFOR is already set in defensive positions at the start of the exercise. The WCOPFOR purposely intended to be maneuvering at this time in order to encourage the two US divisions to attack at the beginning of the exercise, rather than wait in defensive positions for days before ground maneuver attacks commenced. Within 24 hours the OSC disruption zone had collapsed, although it did provide enough time for the 19th and 20th DTGs to move into defensive positions. Nevertheless, the WCOPFOR did achieve some inadvertent success due to some internal planning confusion when its rotary wing attack aviation was sent out to test the reaction of the 101st units, which it thought would be looking for a plausible landing zone. The units turned out to be a significant target and the OSC 2 attack aviation was able to destroy a battalion’s worth of combat power. This deep attack upset the 101st plans by delaying its air assault. Instead, the 101st conducted a rotary wing movement of 1/101st to Objective Florida just southeast of the Mingachevir Reservoir.

212 UNCLASSIFIED

Red Diamond

As a result of the aggressive attack by the 29th and the 101st, both divisions suffered heavy losses. They did not set the successive conditions for the offense, which prevented their ability to exploit success. The 29th was forced to pause and go through the process of reconstitution, which slowed the offensive for approximately 24 hours. The 101st also slowed its offensive. A temporary ceasefire was declared, which OSC 2 took advantage of and began counter-mobility efforts to prevent coalition forces from conducting successful river crossings. The OSC 2 also used this time to move its 304th Tank Brigade reserve—undetected—from the ISC support zone to the rear of the 20th DTG main battle zone and slightly south of the Kura River. All militia brigades from the ISC were moved just south of the 20th DTG boundary to provide direct and indirect fires in order to prevent the 29th from flanking OSC 2. Heavy losses were also incurred by the 19th and 20th DTGs. The majority of losses occurring in OSC 2 were from USAF fixed wing and Army attack helicopters, not ground forces. As the exercise continued, the 101st began crossing the Agshu River in the north in order to continue its eastward attack to achieve link-up with coalition forces in Baku. This time the 101st was moving faster than the 29th since the former it had already successfully completed an air movement closer to the Agshu River in the north. The 29th ID also moved eastward but had more ground to cover. Nevertheless, both divisions succeeded in collapsing the DTG disruption zones of the 19th and 20th, respectively. This led to the eastern withdrawal of both DTGs across their respective rivers. During this time period the 304th Tank Brigade, centered between the two DTGs, was allowed to attack north across the Kura River into the southern flank of the 101st. The intent was to distract the XVIIIth ABC, slow down the 101st wet-gap crossing of the Agshu River, and prevent OSC 2 lines of communication from being severed. The 304th successfully crossed the Kura and did cause some units from the 101st to pull back from their crossing site in the south and attack in order to prevent the 304th from causing significant damage. The attack also slowed down some of the 101st progress in crossing the river, even though fixed aircraft destroyed the 304th soon after it crossed over. As a result of the 19th DTG attrition, the 17th DTG was ordered to move from the OSC 2 support zone to the northeast battle zone of the 19th to reinforce its collapsing defense. The 17th also had the mission of reinforcing the 19th DTG’s Ariana Naval Infantry (ARNIN) Regiment efforts to retain the Sangachal Oil Terminal, located southwest of Baku, and prevent coalition forces from severing its lines of communications. This change of mission resulted in the 17th being unable to be the enabling force for the 18th DTG planned attack and seizure of Baku. The 92nd Mechanized Infantry Division (SHC strategic reserve) was also moved up near the OSC support zone in the south, to be committed if necessary. During this same period extensive deception units, including surface-to-surface missile decoys, were moved forward and were beginning to be attacked by coalition long-range fires. OSC artillery units also fired smoke rounds in an effort to simulate chemical gas and cause confusion as well as defensive chemical reaction procedures from coalition forces. Both of these deception methods were largely successful. The 17th DTG was successful in moving from the Ariana border area to reinforce ARNIN and remnants of the 19th DTG. Of significance was that the 17th DTG was not attacked during its entire movement from the Ariana border to the 19th DTG battle zone. All coalition air assets were focused instead on destroying the 20th DTG, which was rendered combat ineffective. As a result, trail maneuver units of the 17th were shifted to reinforce the 20th DTG. At approximately the same time period, the 101st conducted a successful air movement of a battalion with C-130s to Baku. WCOPFOR was prevented from attacking this unit with indirect fires. However, the 101st did not coordinate the details with the Atropia Capital Defense Command, which presented several problems when it landed unannounced. In addition,

213 UNCLASSIFIED

Red Diamond

the XVIII ABC’s remaining reserve force traveled east through the evening and reached Baku. The 29th ID in the south resumed its efforts to cross the Aras River after recovering from long-range artillery losses. Towards the end of the exercise, both the 101st Airborne and the 29th ID had completed or had elements of their divisions across their respective wet-gap crossing sites. In the south the 29th ID was successful in crossing two river sites with two brigades but did not have the capacity to exploit this success, despite the fact that it was unopposed during the river crossing. In response, OSC 2 committed one brigade of the 18th DTG to reinforce the 20th DTG, which only had one brigade left. The remaining 18th DTG units traveled north to reinforce the 17th, which had suffered significant losses from coalition rotary and fixed wing aircraft. Atropia, and later the XVIII ABC units, counterattacked from the north to try to seize the Sangachal Terminal area and prevent the 18th from reinforcing the 17th. Confusion by the XVIII ABC over the objective opened up an uncontested area that allowed the 18th to take advantage of a gap in the eastern portion of the objective. This allowed OSC 2 to hold onto retained terrain in this area with the timely reinforcement of the 18th DTG. In the southwest, the 92nd Mechanized Infantry Division strategic reserve was also employed to protect the 20th DTG, which only had two battalions remaining, from becoming flanked by the 29th ID. The 92nd then began to piecemeal its brigades into Atropia to support this effort in order to preserve its forces if needed elsewhere. However, during the last day of the exercise the 18th and 92nd were ordered to conduct a tactical withdrawal from Atropia in order to preserve combat power and set the conditions for ceasefire negotiations. During the withdrawal, these units were ordered to destroy Atropian infrastructure, including the Sangachal Terminal and bridges, in order to delay coalition offensive ground maneuver operations.

Figure 4. Small unit leadership in field training In conclusion, the WCOPFOR was successful in challenging training units throughout this fast-paced exercise. Both sides fought hard throughout the exercise. Most, if not all, of the evaluated training units achieved all or the majority of their training objectives. It is important to note that close coordination between the WCOPFOR and MCTP leadership, exemplified by the daily OPFOR synchronization group, continues as these exercises grow in size and complexity in an ever-changing and challenging training environment.

______

214 UNCLASSIFIED

Red Diamond

by Angela M. Wilkins, TRADOC G-2 ACE Threats Integration (DAC) A charter of TRADOC G-2 ACE Threats Integration (ACE-TI) is to produce and maintain the Decisive Action Training Environment (DATE). DATE establishes a common operational environment (OE) with hybrid threat elements for training. Although it is not within ACE-TI’s purview to design scenarios, the organization’s analysts have provided ideas and guidance to scenario designers. The conditions within DATE allow for the creation of a multitude of scenarios to challenge all training tasks, and this article will describe several prospective ideas for scenarios. DATE’s Road to War Example Within Appendix D of DATE 2.2 is an example Road to War (RTW). The decision was made to include this as an aid to scenario designers and/or to provide an easy starting point for joint exercises; it was never intended to be the “one and only” nor the best-possible road to war. The opening paragraph of Appendix D clarifies the purpose:

The DATE Road to War (RTW) is intended to serve as a common starting point for all Army CTCs and TRADOC Schools and Centers to draw upon in formulating their scenarios and other supporting documentation for training events and exercises. This RTW is not the only possible narrative to assist in the generation of scenarios. Each CTC has the flexibility and freedom to adapt, change, or modify this RTW to fit the specific needs of each training event.

Figure 1. Excerpt from DATE 2.2, Appendix D: Road to War

It is ultimately up to each training center to determine whether to use this RTW or another one. The DATE countries and their conditions are written in such a way that exercise designers could choose any state or actor to attack any other state or actor in any part of the OE. To help with ideas for conflict, also included in DATE is an events section (Section 3). It provides 77 ideas for conflict along with related mission-essential task list (METL) items for training. These events are written generically, meaning that they can be applied to the DATE OE that works best for a particular training exercise. See Figure 2 for a sample DATE event. Recently, TRADOC G-2 ACE-TI produced a briefing with several “scenario starter” ideas. Included in the briefing were ideas already implemented at the combat training centers (CTCs), but several new ideas were also proposed. What follows is a description of these ideas, which can be modified as needed to be used at CTCs, at home station, or even in the classroom.

215 UNCLASSIFIED

Red Diamond

Of note is that each idea reflects recent/real-world events, which is in line with the DATE concept being a composite of real-world conditions. ACE-TI has processes that overlap with its other tasks to ensure that DATE remains relevant with each iteration, which enables all DATE-based training to prepare soldiers to fight robust and challenging threats in a variety of conditions.

Figure 2. Sample event from DATE 2.2, Section 3: Events

216 UNCLASSIFIED

Red Diamond

Atropia v Ariana (A) Conditions and events leading to conflict—  Ariana lays claim to Atropian oil reserves in the Caspian Sea.  Ariana conducts a 10-day military exercise along the Atropian border.  Both countries exchange mortar fire, during which one Arianian soldier is killed in action.  The US and EU impose sanctions against Ariana.  Ariana ceases all oil exports to Atropia.  Ties between Ariana and Atropia are severed.  Atropia requests NATO intervention.  NATO authorizes enforcement of resolution that maintains Atropian territorial integrity.  Atropia welcomes international show of support with a multinational combined exercise.  Atropian and Arianian forces occupy positions along the border. Real-world related situation: Russia claims natural resources on the Arctic continental shelf that technically lie in international waters; Russia bolsters its military in the Arctic (conducts military exercises, etc.), which provokes a NATO response to protect the Global Commons.

Figure 3. Atropia v Ariana (A)

217 UNCLASSIFIED

Red Diamond

Atropia v Ariana (B) Conditions and events leading to conflict—  Ethnic Atropians begin to flee western Atropia in fear of increased activity by the South Atropian Peoples’ Army (SAPA).  Ariana reportedly provides financial and military support to SAPA.  US condemns Ariana’s support to SAPA; issues travel warning to Atropia.  UN issues a resolution on humanitarian and security situation in Atropia.  The international community condemns actions of Ariana crossing into Atropia after Ariana builds up forces on Atropia’s border.  US President signs nonlethal Presidential Finding authorizing covert other governmental agency (OGA) support to Atropia, closely followed by the authorization of lethal OGA support to resistance forces and OGA unconventional warfare operations.  A ceasefire agreement is followed by reports of Arianian forces committing various atrocities in Atropia.  US Special Forces deploy to Gorgas in order to prevent further escalation of war. Real-world related situation: Iran/Iraq War in 1970—OR—Kurds and other ethnic groups in northern Syria stampede north toward the Turkish border (fleeing the ISIL/Kurdish fighting in Kobani) and stress Turkish capacity to accommodate the heavy flow of refugees.

Figure 4. Atropia v Ariana (B)

218 UNCLASSIFIED

Red Diamond

Limaria v Atropia Conditions and events leading to conflict—  A high-ranking Limarian official visits the Lower Janga region and gets killed by a Free Lower Janga Movement (FLJM) sniper.  Limaria immediately accuses Atropia of having trained and supported the sniper, which Atropia denies.  Rising tensions cause the UN to agree to approve insertion of forces in order to restore peace.  Variations (optional) o Donovia (a strong supporter of Limaria) sends troops into Limaria on the Atropian border, or o Fabricate a recent agreement with Atropia that benefits Donovia economically, so Donovia chooses to stay out of the conflict. Real-world related situation: Recently, high-ranking Justice and Development Party (AKP) officials have been visiting Turkey's southeastern provinces, where a huge military pacification effort is currently underway. Since the region is close to civil war anyway, the assassination of one of these figures, such as a member of parliament or cabinet member, could ignite a level of violence sufficient to warrant insertion of a peacekeeping force to maintain order.

Figure 5. Limaria v Atropia

219 UNCLASSIFIED

Red Diamond

Gorgas v Atropia Conditions and events leading to conflict—  Gorgas decides to build three major hydropower plants to help offset its electrical needs: one north of Akhmeta on the Alazani River; one north of Tskhinvali on the Liakhvi River; and one south of Kvishkheti on the Kura River.  Atropia fears that the reduced flow of water into the Mingachevir Reservoir will compromise its associated power plant.  A diplomatic dispute rapidly escalates, with Gorgas accusing Atropia of trying to hinder its efforts to be more independent. A small Salasyl cell, to make things more difficult for the Atropian government, crosses the border into Gorgas and bombs a small church. Gorgans, for whom being Christian is the same as being Gorgan, immediately interpret the attack as one against God and country.  SAPA uses the controversy as an opportunity to conduct further targeted attacks against religious buildings in Gorgas and publicly attribute them to Salasyl.  Attacks rise and cause civil unrest and civilian deaths.  Gorgas pleads for Western intervention to quell the unrest.  Optional: Limaria—a Christian country that hates Atropia, feels discriminated against, and is acutely aware of its lack of regional allies—could join Gorgas against Atropia. Donovia would choose to stay out of it in either case, as the country doesn't like either Gorgas or Atropia and would benefit regardless of who “wins.” Real-world related situation: Sudan building dams on the upper Nile River that prevent the flow of water to .

Atropia v Donovia (A) Conditions and events leading to conflict— Figure 6. Gorgas v Atropia  The Atropian electrical grid is taken down by unknown hackers, with Donovia being highly suspected as the culprit.  A humanitarian crisis results, along with chaos and revolt against the Atropian government for not being able to protect its citizens.  Atropia seeks assistance from the US, and a brigade is deployed for humanitarian purposes and to maintain stability and order in the region. Real-world related situation: Cyberattack across regions in Ukraine: Malware targeted at a major power supplier in Ukraine caused a power outage for 200,000 homes and businesses that lasted six hours.1 Atropia v Donovia (B) Conditions and events leading to conflict—  The oil market crashes, taking the Donovian economy with it.

220 UNCLASSIFIED

Red Diamond

 The Donovian government tries to lessen its burden by committing atrocities against the minority Atropians to reduce their population.  The US intervenes. Real-world related situation: Enclaves of ethnic Turks currently live in the lower Caucasus region. Historically they have been the victims of Soviet deportations, and they still suffer hostility at the hands of ethnic Russians. Russian economic suffering caused by a combination of the oil market crash and US/EU sanctions could trigger a resurgence/intensification of anti-Turkish ethnic hostility that could warrant humanitarian intervention by an outside military force. Arianian Civil War Conditions and events leading to conflict—  The people rise up in Ariana and begin a civil war led by insurgents.  US assists the rebels. Real-world related situation: Arab spring revolutions, specifically including Tunisia, Syria, and Libya, and current national aspirations of ethnic Kurds—the world’s largest ethnic minority (approx. 20–25 million) without a country—that spread across four countries: Iraq, Iran, Syria, and Turkey. Ariana and Donovia v Atropia Conditions and events leading to conflict—  Ariana and Donovia attack Atropia for oil resources. Real-world related situation: Chinese expansion of its “nine-dash-line” in the South China Sea in order to encroach on the region’s natural resources and gain an advantage in trade (shipping lanes, etc.). Donovia v Gorgas Conditions and events leading to conflict—  Donovia attacks Gorgas because of its desire to be more Western, which Donovia views as a threat. Real-world related situation: Russia v Ukraine 2014, i.e. Russian’s annexation of the Crimea and recent incursions in Ukraine.

Figure 7. Donovia v Gorgas

221 UNCLASSIFIED

Red Diamond

It should be clear from the above examples that any DATE country can be the threat, and any DATE country can require US assistance to face conflict in the OE. Flexibility is one of the principle functions of the DATE environment. These examples can assist exercise planners and scenario designers, but other ideas could be used as well. If more detail is needed on any of the conditions in DATE to aid in the development of a specific scenario, that can be added and is considered part of DATE’s flexibility, as long as no changes are made to the baseline conditions. The current version of DATE (2.2, April 2015) is available on the Army Training Network (ATN), along with all of ACE-TI’s products. Since the first version of DATE was released in 2010, ACE-TI has modified it several times based on user feedback and leadership guidance. All feedback is welcome and will be carefully considered for the next version. Currently, DATE 3.0 is expected to be complete by the middle of 2017.

Note 1 US Department of State, Overseas Security Advisory Council (OSAC). “Analysis & Implications of Cyberattacks on Ukraine’s Critical Infrastructure Systems.” 29 February 2016

______

222 UNCLASSIFIED

Red Diamond

by Laura Deatrick, TRADOC G-2 ACE Threats Integration (CGI Ctr) During the past seven years, al Shabaab has carried out no fewer than 21 separate attacks on hotels. While the majority of these have taken place in Mogadishu, Somalia, some have also occurred as far away as Mombasa, Kenya—575 miles from the Somali capital. This article examines these attacks as a whole, including intended targets, possible motives, and the different techniques used. Table 1. Attacks on hotels by al Shabaab (not exhaustive)

Targets and Motives Most of the incidents under consideration can be broken out into four general categories. In the first, the attacks occur at hotel restaurants and target civilians. The attacks of 16 January 2013, 12 October 2014, and 21 January 2016 fall into this category. In the latter case, an al Shabaab spokesman identified the hotel as a location “where government employees frequent,” and claimed it as a “major operation

223 UNCLASSIFIED

Red Diamond

against the enemy of Allah,” despite the fact that the venue was popular with primarily younger Somalis.1 The second category reflects attacks that specifically targeted military personnel, and includes the incidents of 18 March 2014 and 26 March 2014. Both of these occurred in the same town and at the same hotel, which was being used as lodging for Somali and foreign (African Union) military officers. Al Shabaab claimed responsibility for the attacks and bragged about killing senior military leaders in both cases.3 Table 2. Techniques used in al Shabaab hotel attacks (not exhaustive)

Category three encompasses the attacks of 15 June 2014 and 14 October 2014. The former was an attack on an entire town not unlike those perpetrated by Boko Haram.4 Al Shabaab claimed credit, its declared motive being retaliation for the presence of Kenyan troops in Somalia and the killing of Somali Muslims. The latter incident was an attack on both government and military personnel that may have targeted the town in general.

224 UNCLASSIFIED

Red Diamond

The fourth category of attacks is also the most common. The remaining 14 incidents—with the possible exception of the 11 March 2015 attack—all targeted Somali and foreign government officials, to include the Somali president, his ministers, members of parliament, and foreign diplomats. These attacks were almost without exception claimed by al Shabaab, with the group’s spokesmen referring to their intended victims as apostates, invaders, infidels, and enemies. Why Hotels? The question now arises as to why government and foreign personnel are to be found in these hotels so often. The answer, quite simply, is security. One BBC reporter described the hotels of Mogadishu as “like fortresses, with high surrounding walls, two sets of giant metal gates, private security and scanners. This is to try to protect government officials and other al-Shabab [sic] targets, who often live there for years.”8 After so many decades of fighting, the hotels do not take the safety of their guests for granted. Neither do the guests themselves, for that matter. A quick perusal of the TripAdvisor website reveals the following opinions regarding the Jazeera Hotel:9  “We felt secure in the hotel; lots of necessary security checks which puts your mind at rest”  “The Most secure, clean and luxurious palatial Hotel in Mogadishu .” [sic]  “Friendly staff, good food and good security.”  “…most important maybe, it has high-level security Figure 1. Jazeera hotel gate staff and equipments [sic].” Prior to an attack on 26 July 2015, this particular hotel hosted not only senior government officials— including the Somali president himself—but also served as the location of several diplomatic missions, such as those of China and Qatar. Al Shabaab considers these hotels to be legitimate government targets. A group spokesman stated, “We consider as legitimate targets five, six or seven hotels in the capital, I forget the exact number. They know who they are because they provide lodging for members of the apostate government, certain members of the diaspora, foreigners and other infidels.”10 At another time a spokesman declared, “We don't consider it [Maka al-Mukaram Hotel] to be a hotel—it's a government base.”11 The constant presence of and reliance by government personnel on local hotels only guarantees that these facilities will continue to be subject to attacks by the insurgent group.

Figure 2. Jazeera hotel before and after the 26 July 2015 attack, with close-up

225 UNCLASSIFIED

Red Diamond

Common Hotel Attack Techniques Method #1: SVBIED/VBIED This method is very basic. A suicide vehicle borne improvised explosive device (SVBIED) is driven into the gate or the wall of the hotel compound and detonated (Figure 3). An alternative means is to use a vehicle borne IED (VBIED), which is parked by the hotel wall/gate and detonated after the driver has cleared the area (Figure 4). Both techniques require few assets and carry minimal risk, while having a potentially large payoff in terms of casualties, property damage, and information warfare (INFOWAR). Al Shabaab recognizes this, with the Somaliland Press reporting that the group “said their usage of a suicide bombing was the Figure 3. SVBIED attack

most effective way to execute government officials.”12 This basic method was used in five of the incidents under consideration, including the aforementioned 26 July 2015 attack on the Jazeera Hotel, and a variant was used in a sixth event. Method #2: Small Arms Fire This method is also basic, but carries a higher cost in terms of personnel. A small element, usually numbering four to five insurgents, breaches the gate using small arms fire. The militants then continue firing while they storm the hotel. Once inside, they attempt to kill Figure 4. VBIED attack everyone they see.

226 UNCLASSIFIED

Red Diamond

Variations include using person borne IEDs (PBIEDs) or grenades in the breach attempt and/or the assaulting gunmen wearing PBIEDs. This method or a variant was used in six of the attacks examined. Method #3: SVBIED with Small Arms Fire This method involves the most planning and commitment of resources, but also offers the largest payoff in terms of casualties, property damage, and INFOWAR objectives. The attack begins with an SVBIED crashing into the wall or gate of the hotel compound. A small element of gunmen then breach the compound, shooting as they storm the hotel.

A secondary VBIED, aimed at Figure 5. Small arms fire attack first responders, may also be employed in this type of attack. Variations include initiating the assault with a VBIED instead of an SVBIED, the participating gunmen wearing PBIEDs, and/or using an SVBIED as the secondary VBIED. Eight of the attacks in this study used this method or one of its variants. Training Implications These attack methods are examples of an assault, as described in TC 7-100.2: Opposing Force Tactics. It should be noted that, in methods two and three, none of the insurgents intend to come out of the hotel alive—hence disallowing the possibility of Figure 6. SVBIED with small arms fire attack calling the methods raids. Two

227 UNCLASSIFIED

Red Diamond

groups contained in the Decisive Action Training Environment that would use the techniques discussed in this article are the Limarian Liberation Front (LLF) and the Free Lower Janga Movement (FLJM). These two organizations are on opposite sides of Atropia’s conflict with Limaria over the Lower Janga region: FLJM wishes to see Lower Janga return to Atropian control, while LLF is fighting to ensure Limaria’s continued supremacy over the territory.

References Nearly 200 references were used for this article, with an average of 8–9 per attack. For a complete list of references, please contact the author.

Notes 1 Caleb Weiss. "Shabaab targets popular Mogadishu beach resort." Long War Journal. 24 January 2016; Agence France-Presse. "At least 19 dead in Somalia al-Shabaab restaurant attack." Horseed Media. 22 January 2016. 2 Mursal. “First Al-Shabaab attack on Barawe since militants withdrew.” Harar24 News. 14 October 2014. 3 Agencies. “Al Shabab claim deadly attack on African Union hotel in Somalia.” Deutsche Welle. 18 March 2014; Reuters. “Al- Shabaab militants raid hotel in central Somalia: report.” CBC News (Canada). 26 June 2014. 4 For more information on attacks by Boko Haram against towns, see “Boko Haram: Arrack on Baga, Nigeria” and “Boko Haram and Shifting Techniques: Towns under Fire” in previous editions of the Red Diamond. 5 For more details on this attack, see the “Al Shabaab Update” Threat Report, dated 15 November 2012. 6 For more details on this attack, see the “If At First You Don’t Succeed: 1 January 2014 Bombing of the Jazeera Hotel” Threat Report, dated March 2014, or the Red Diamond article by the same name in the January 2014 edition. 7 Mursal. “First Al-Shabaab attack on Barawe since militants withdrew.” Harar24 News. 14 October 2014. 8 Mary Harper. "Why does al-Shabab target hotels?" BBC News. 7 November 2015. 9 Trip Advisor. “Jazeera Palace Hotel.” 2016. 10 Mary Harper. "Why does al-Shabab target hotels?" BBC News. 7 November 2015. 11 BBC News. "Somali forces end deadly al-Shabab Mogadishu hotel siege." 28 March 2015. 12 Somaliland Press. “Somalia: Who Carried Out The Suicide Attack in Beletwein? - Alshabab Tells the Story.” 21 June 2009.

______

228 UNCLASSIFIED

Red Diamond

by Mike Spight, TRADOC G-2 ACE Threats Integration (CGI Ctr) Decisive Action Training Environment (DATE) Rotation 16-04 was conducted at the Joint Multinational Readiness Center (JMRC), Hohenfels, Germany, on 29 March–24 April 2016, with box dates (force on force) running from 11–20 April. Like all previous Saber Junction DATE rotations, this was a Title 10 funded exercise, and the rotational training unit (RTU) in this case was the 173rd Airborne Brigade Combat Team (BCT), which is stationed in Vincenzo, Italy. Along with the 2nd STRYKER, Cavalry Regiment (Cav Regt) of Vilseck, Germany it is one of only two infantry brigades the US Army maintains in Europe at the present time. The BCT deployed with all of its organic units: 1st and 2nd Battalions (Bns)/503rd Parachute Infantry Regiment, 1st Squadron (Sqdn)/91st Cav Regt, 4th Bn/319th Artillery Regiment (Arty Regt), and its Battlefield Enhancement Battalion and support battalion. It did receive attached aviation support from 3rd Bn/227th Aviation Regt out of Ft. Hood, TX. The 173rd was augmented with multiple NATO and Partnership for Peace (PfP) nations to produce a formidable US led multinational brigade (+) as blue forces (BLUFOR). An element from Headquarters (HQ), 4th Infantry Division served as Higher Control during the rotation, and worked out of JMRC’s Building 100 Operations Center. As last year, this exercise was observed by a Combat Training Center (CTC) Accreditation Team comprised of personnel from the Training and Doctrine Command (TRADOC) G27 Operational Environment/Opposing Force Program Management, TRADOC G-2 Analysis & Control Element Threats Integration (ACE-TI), and the Combined Arms Center’s Combat Training Center Directorate. This accreditation focused on specific areas such as: equipping, manning, and training of the opposing force (OPFOR); replication of the operational environment (OE); replication of the PMESII-PT variables (political, military, economic, social, information, infrastructure, physical terrain, and time); how well the overall DATE environment and hybrid threat are replicated and OPFOR doctrine and tactics planned and executed; and how well the informational environment is replicated at the CTC and within the framework of the exercise. This article focuses on how the OPFOR battalion executed its tactical plan for challenging the RTU commander’s training objectives. Like previous NATO Response Force/DATE rotations, the OPFOR was built around JMRC’s organic unit, the 1st Battalion, 4th Infantry Regiment (Inf Regt). Due to a significant reduction in the battalion’s authorized personnel strength, it required significant augmentation by US Army Reserve (USAR), National Guard (NG), and NATO partner units in order to replicate an Arianian brigade tactical group (BTG). For this rotation, the OPFOR replicated the 303rd BTG that is organic to the 11th Division Tactical Group (DTG) of the Arianian Army. The 303rd BTG consisted of three organic battalion detachments (BDETS) replicated by Apache, Blackfoot, and Cherokee companies (Cos) and three attached BDETS— Task Force (TF) Bushmaster, TF Wolf, and TF Sierra. These were replicated, respectively, by B Co/1st Bn/181st Inf Regt (-), which is a California Army NG infantry company; a Latvian infantry company (-); and a Serbian infantry company (-). Additionally, a platoon of Lithuanian infantry was attached to Apache Co, and a Slovenian armor platoon to Blackfoot Co. As always, the OPFOR’s organic aviation detachment, Falcon, participated in this exercise. The OPFOR Bn was also augmented by a USAR

229 UNCLASSIFIED

Red Diamond

engineer company (387th Engineer Bn); USAR civil affairs, public affairs office, and psychological operations teams; and a medical platoon. Elements of the USAR engineer company were task organized into each of the OPFOR Bn’s elements to provide breaching and route clearance support as required. The Lithuanian light infantry platoon provided dismounts for Apache Co’s OPFOR surrogate vehicle (OSV) BMPs, and the Slovenian tank platoon was task organized within Blackfoot Co and was utilized as required by the tactical situation. The OPFOR Bn did have OSV T-72/80 main battle tanks that were task organized into Apache or Blackfoot companies to provide additional fire power and the ability to engage BLUFOR vehicles at long range. Cherokee Company personnel portrayed Arianian special purpose force (SPF) personnel and South Atropian People’s Army (SAPA) insurgent cells, and served as the BTG’s reconnaissance elements, which were equipped with OSV BRDMs that also provided an antiarmor capability. There was a significant amount of blue special operations forces (BLUSOF) activity during this rotation, with the BLUFOR receiving support from both US Special Forces (SF) companies and teams, and several NATO-nation SOF units. SOF missions were executed in both the constructive wrap-around and in the box during the force-on-force portion of the exercise. The greatest significance for the OPFOR was BLUSOF conducting special reconnaissance missions and also acting as advisors for the Atropian Loyalist Militia (ALM), who were portrayed by a platoon of Bosnian infantry. The RTU commander’s training objectives drove refinement of the overall exercise scenario and the tactical tasks selected by the OPFOR, which were specifically developed to provide the RTU with a rigorous validation of its training status. For this exercise, the RTU commander’s primary focus was on conduct of offensive and defensive operations, cyber/electronic warfare (EW) defense, counter unmanned aerial vehicle (UAV) operations, mission command, and employment of joint fires. The 303rd BTG operations order directed its subordinate units to conduct an area reconnaissance, reconnaissance attack, and integrated attack. After conducting those missions, the 303rd BTG would prepare for conduct of a maneuver defense. Those operations, particularly the maneuver defense, were designed to defeat BLUFOR in order to allow the 303rd BTG’s higher headquarters (the 11th DTG) to build combat power after the DTG was forced to withdraw by BLUFOR operations. Once the BTG had inserted reconnaissance elements and SPF throughout the depth and breadth of the maneuver box, SPF were able to conduct counterreconnaissance operations and identify locations of the RTU’s maneuver battalions, the geographic disposition of the cavalry squadron’s guard mission, and critical high value targets (HVTs) such as the BCT’s tactical operations center (TOC) and logistics nodes, which were primarily located in the vicinity of the Short Take Off/Landing (STOL) strip and Aghijabadi City, which is the provincial capital. Cherokee Company executed harassment attacks and called indirect fire missions (only mortars were available during this phase) against RTU elements, as well. At that point, the 303rd BTG was set to execute its reconnaissance attack against the RTU. Additionally, SAPA cells, located throughout the box, provided information to SPF and to the 303rd BTG regarding RTU unit locations, with particular focus on critical command and control (C2) and logistics nodes. SPF advised, supplied, and led SAPA cells in some instances. The 303rd BTG conducted its reconnaissance attack against the RTU once Cherokee Company (the enabling and supporting element) had penetrated the RTU’s cavalry squadron guard positions, and Cherokee Company then focused its reconnaissance assets, SPF, and SAPA on continuing to conduct reconnaissance activities and harassing attacks in the northern sector of the box and to establish and maintain contact with BLUFOR elements in the north. That facilitated Blackfoot Company’s (the action

230 UNCLASSIFIED

Red Diamond

element) execution of the reconnaissance attack in the southern sector, with the purpose of determining BLUFOR unit dispositions, composition, and strength by penetrating as deeply as possible into the RTU’s rear areas. The OPFOR reconnaissance attack was reported to have been very successful, and more RTU elements were located and identified. During this phase, indirect fires could be called for and were provided (constructively) by a D30 battalion providing constituent fires to the 303rd BTG and a 2S16 battalion and multiple rocket launcher company providing supporting fires.

Figure 1. Recon attack1 The integrated attack consisted of two avenues of approach, with the main avenue to the north to be executed by Apache Company (the action [assault] element), and the supporting attack in the south, which would be executed by Blackfoot Company (the enabling [deception] element). During the conduct of this attack, the author was able to accompany the Apache Company commander in his command OSV BMP. Apache Company, accompanied and supported by TF Wolf (Latvian infantry company) and TF Sierra (Serbian infantry company), which were both initially disruption/fixing elements, would advance along Axis Amstel, with the ultimate objective of seizing Objective Lion (STOL strip). TF Sierra’s specific mission was to fix BLUFOR elements located on/near Axis Amstel, as would Apache Company, with the plan for TF Wolf to actually pass by both TF Sierra and Apache Company as they fixed RTU combat power on Axis Amstel. TF Wolf would then assume the role of the assault element and attack the RTU’s Brigade Support Area and other HVTs located on or near the STOL strip. Additionally,

231 UNCLASSIFIED

Red Diamond

Aghijabadi City (the provincial capital) was also in close proximity. Apache Company would not cross the Line of Departure (LD) and commence its attack until approximately one hour after Blackfoot Company initiated movement for its supporting attack and had crossed Phase Line Ironwood. Blackfoot Company and TF Bushmaster (CA NG infantry company), were the deception/fixing element, and were to cross the LD and leave their tactical assembly early, with a mission to deceive the RTU into believing they were the main effort and to eventually fix RTU elements on objectives southwest and south of the STOL strip (OBJ Lion). Additionally, Cherokee Company would support this attack by continuing SPF and SAPA operations in Aghijabadi City and in the vicinity of other Apache and Blackfoot Company objectives.

Figure 2. Integrated attack The integrated attack went extremely well, and suspension of battlefield events was declared by the Commander, Operations Group as Apache Company TF Wolf approached within one kilometer of the STOL strip. Additionally, Blackfoot Company and TF Bushmaster achieved their objectives of fixing RTU elements south and west of the STOL strip. This success was facilitated by excellent use of cyber/EW operations conducted by the OPFOR Bn, to include use of Raven UAVs against BLUFOR. BLUFOR also employed both Raven and Shadow unmanned aerial systems (UASs) during this exercise, although UAS/UAV ops were curtailed between 1000–1800 hrs on certain days while the US Air Force flew sorties

232 UNCLASSIFIED

Red Diamond

in support of the RTU. During those periods, both the OPFOR and RTU were forced to utilize virtual UAS/UAV capability provided by JMRC. Following the normal suspension of battlefield events so that both BLUFOR and OPFOR could reset for the next phase of the rotation (BLUFOR attack, OPFOR defend), both the OPFOR and the RTU prepared for the next phase of this rotation. Of note is that after a brief experiment during a rotation last January, the OPFOR Bn (303rd BTG) moved its TOC from garrison into the field. For this rotation, it jumped the TOC to the town of Kebirli, located in the far western end of the maneuver box. By doing so, the BTG made good use of “cultural shielding,” as the town was populated by Atropian citizens who were pro- SAPA and supportive of all anti-government operations. Although the RTU knew the TOC was there, based on its EW efforts and the fact that it kept a Shadow UAS overhead, it could not engage the TOC with indirect fires or with air assets. Once the OPFOR established its TOC in the box, the garrison location functioned as an administrative/logistics operations center for the duration of the defense. This decision to jump the TOC was partially driven by comments during previous accreditation visits that it would make the box more competitive, as the RTU would now have OPFOR signals to locate and would be able to work its cyber/EW skills to a greater degree than when the OPFOR TOC was in garrison and out of play. Although this was a new technique employed by the OPFOR Bn, it all appeared to go very smoothly, with its TOC fitting quite well into one multi-story building in Kebirli. For its maneuver defense, the 303rd BTG established defense with an identified disruption element, combat security outposts (CSOPs), kill zones, contact and shielding elements, and a counterattack/reserve element. Additionally, SPF/SAPA elements, located in the RTU’s rear areas and along its two likely avenues of approach for its deliberate attack, would provide real-time reconnaissance input to the 303rd BTG, and would also provide calls for indirect fires and the capability of conducting limited attacks against RTU HVTs, if the opportunity presented itself. In this instance, the RTU’s most likely avenue of approach was determined to be in the north sector of the box, with the supporting attack coming from the southern sector. In each case, one of the RTU’s two maneuver battalions would attack, augmented by the NATO and PfP nations that were attached to the RTU for this exercise. This was, however, a light infantry unit, and movement would be relatively slow and tentative due to the lack of heavy or even medium armor in support. During this phase, the ability of the 303rd BTG to “read the RTU’s mail” with regard to its voice communications proved to be a significant advantage. An earlier capture of an RTU recon element and one of its communication re-transmission sites provided all the information necessary to allow the OPFOR to listen in on the RTU’s command and admin/log communications nets, and to continue to do so even after the RTU was aware of the problem and took steps to correct the situation. The OPFOR was also able to direct an indirect fire strike against the RTU’s Raven control station by hacking into the system controlling the Raven’s transmission of data, which had also been re-transmitted to BLUFOR assets by an AH-64 attack helicopter. OPFOR was able to capture the data transmission, backtrack it to the BLUFOR Raven control station’s exact locations, and subsequently destroy them with indirect fire. As to the OPFOR’s actual plan for its defense, Cherokee Company established combat security outposts (CSOPs) with reconnaissance assets, along with SPF and SAPA in depth. TF Bushmaster and TF Wolf executed the disruption/contact element mission, overlooking large kill zones established on each of the anticipated RTU axes of advance, with TF Wolf oriented on the northern axis. Directly to their rear was the shielding element, which was the mission for Apache and Blackfoot Companies. To the rear of the entire maneuver defense was TF Sierra, with the mission as the counterattack/reserve element. As can be seen from the maneuver defense graphic, withdrawal/passage of lines routes were identified, along

233 UNCLASSIFIED

Red Diamond

with alternate/subsequent simple battle positions for the disruption/contact element to move into once specified loss criteria had been met.

Figure 3. Maneuver defense Although the author was not in the field with the OPFOR/303rd BTG for the defense, it was reported to be a very successful operation that fully challenged the RTU commander’s training objectives. It was later reported that the RTU, in fact, utilized the southern corridor for its main axis of attack, with the northern corridor as its supporting axis. It also launched two separate air assault missions to the rear of the OPFOR’s main defensive belt and reserve, one just to the northwest of Kebirli and one just to the east of the town. The supporting attack element in the north were able to locate and pass through a seam in the OPFOR defense, and established support by fire positions east of town. The main attack element, from the southern corridor, executed a bold movement to contact and then attacked. The RTU was eventually able to clear Kebirli. Not surprisingly, the OPFOR’s familiarity with the ground, its understanding of hybrid threat tactics, its dedication to the mission, and its aggressive nature are all significant advantages that can mitigate the RTU’s advantages in numbers and quality of equipment and technology. Significant factors in the OPFOR’s success, as described earlier, were its ability to leverage EW and its limited cyber capabilities, with particular focus on capitalizing on the RTU’s mistakes with regard to safeguarding communications frequencies, key lists, and failure to properly encrypt its own technology.

234 UNCLASSIFIED

Red Diamond

The OPFOR also exercised an excellent information warfare operation against the RTU that utilized propaganda videos of captured RTU soldiers, in which the story was manipulated to embarrass the RTU and counter all of its efforts to win over Atropian civilian and local governmental support to its cause. This rotation can be described as a significant success for continued implementation of the principles contained in DATE 2.2 and the Training Circular 7-100 series of publications with liberal applications of real-world lessons from the existing operational environment, which continues to evolve.

Note 1 All graphics used in this article were provided by JMRC Operations Group and/or OPFOR, with any modifications done solely to improve legibility.

______

235 UNCLASSIFIED

Red Diamond

by MAJ Michael Trujillo, (US Army) Defense Intelligence Agency’s Missile Space Intelligence Center and Kristin Lechowicz, TRADOC G-2 ACE Threats Integration (DAC) This article examines the opposing force (OPFOR) antilanding operations (ALO) tactical task from Training Circular (TC) 7-100.2, Opposing Forces Tactics, and the OPFOR tactical task list from appendix B of TC 7-101, Exercise Design. It compares the OPFOR ALO doctrine to a video derived from the ongoing Syrian conflict. This video consists of a standoff ambush using an antitank guided missile (ATGM) on a temporarily-halted helicopter. This article will also explore ATGM systems as dual-use weapons against aircraft for training scenarios. The intent is to provide the training community and scenario developers with concepts for replication from real-world threats to aircraft or airbases and to cross-reference ALO threat doctrine. It is also to allow training units to draw lessons learned from the Syrian video and plan accordingly in order to counter such threat techniques. This article is the second collaborative effort between the TRADOC G-2 ACE Threats Integration Directorate and the Defense Intelligence Agency’s Missile Space Intelligence Center (MSIC). MSIC provided the video with a basic analysis of the ATGM attack from Syria.1 ACE-TI then used this primer as a case study to introduce OPFOR ALO doctrine as a comparison to current real world threats in Syria for the training community. Video Background2  Date: 8 September 2014  Location: Idlib Province, Syria  Rebel Group: Sham Legion, based on icon in video  Type of Event: ALO offensive tactical action  Weapon System: Kornet ATGM  Weapon Systems Location: Level with target adjacent (estimated) 5,000–5,077 meters in an open field beyond airbase perimeter  Target: Recently-landed MI-8 helicopter (Syrian Arab Army)  Acquisition to Target Hit: 3 minutes 20–22 seconds  Overview of Events: The video shows the helicopter descending, taxiing, and coming to a temporary halt. Support elements move toward the helicopter. The Kornet missiles strike the target as the helicopter starts to spin. The helicopter then combusts.  Result: MI-8 helicopter destroyed

236 UNCLASSIFIED

Red Diamond

The video provides an example of the Kornet ATGM system used in a non-standard method against aircraft. ATGMs against air threats are not a new technique, but an example of the threat logically utilizing available weapon systems in a different function. The Syrian Civil War’s operational environment is inundated with ATGM systems based on the attack videos reported by MSIC.3 The Kornet system provides both the range and accuracy for the rebel’s action element in the video to engage the target on the airfield from a relatively safe standoff distance. Training developers could include the Kornet ATGM in training events by using the Kornet’s capabilities as given in the Worldwide Equipment Guide (WEG).

Figure 1. ALO (ATGM) diagram and graphic4 Another piece of information extracted from the video shows that the Kornet just short of its maximum range.5 Choosing such a distance illustrates that the ATGM’s crew was quite proficient and confident in the system’s capabilities. The action element (rebels) within the video likely conducted reconnaissance and tracked other incoming flights to learn aircraft landing patterns, which allowed the ATGM crew to set up the Kornet in a most advantageous site. For scenario replication, the threat could also use a number of smaller hunter-killer teams in different positions around an airbase perimeter. For additional information on hunter-killer teams see TC 7-100.4, Appendix E-1, and its associated Threat Force Structure. Chapter 16 of TC 7-100.2, Opposing Forces Tactics, discusses the tactics of hunter-killer teams that can be implemented by the training community. The combat training centers’ (CTCs’) OPFOR, like the Syrian rebels in the video, employ a similar technique of targeting a rotational training unit’s (RTU’s) aircraft—either landing or taking off—by sending smaller irregular elements, often 2–3 individuals, to monitor the airfield from the perimeter. These threat teams wait for targets of opportunity to strike if left unchallenged by the RTU. The ATGM team in the video appeared confident that base patrols would not compromise its position. This confidence might occur due to early-warning security elements or the lack of patrols from the base,

237 UNCLASSIFIED

Red Diamond

a common RTU mistake at the CTCs. Another possibility is that the airbase in the video is isolated in rebel-controlled territory, similar to the two-year siege of the Abu al-Duhur airbase in Syria. During the rebels’ operations against the Abu al-Duhur airbase, the base defenders became dependent on helicopters as their only means of resupply. From the threat’s point of view, ALO makes perfect sense, with threat doctrine using the denial of resupply to the defenders in order to gain control of key terrain. OPFOR Implications and Training Support TC 7-101, Exercise Design, Appendix B, contains the OPFOR Tactical Task List. This is comparable to the US Army’s Universal Task List (AUTL); however, there are currently only 24 OPFOR specific tactical tasks. Of note, the list is currently being revised and rewritten in the updated version of TC 7-100.2, Opposing Forces Tactics. These 24 tasks are unique to the OPFOR in order to reduce mirror-imaging of US Army tactics and to provide challenging conditions for the full spectrum of the training community. The following is tactical task 19, ALO, taken directly from TC 7-101, Exercise Design. Tactical Task 19.0 Antilanding Actions6 Antilanding actions are those methods used to prevent landings by airborne or heliborne troops or to destroy enemy landing forces on the ground as soon after landing as possible. Antilanding actions can and will be executed by any force with the capability to affect the aircraft or the landing forces. However, this is a combined-arms action that primarily falls to the antilanding reserve (ALR) for execution. The subtasks for antilanding actions are the following:7

PLANNING

 Locate and predict drop and landing zones (DZs and LZs).  Determine need for window of opportunity.  Backwards plan from destruction of landing forces back to the current time. o Destruction of landing forces. o Detection of landing forces. o Maneuver to firing position and/or placement of obstacles. o Use of concealment, cover, camouflage, and deception, and window(s) of opportunity. o Disruption force(s) execute disruption of enemy. o Rehearsals. o Preparation. o Planning.  Identify complex terrain in the vicinity of identified targets and potential cache sites.  Identify affiliated forces (such as insurgent groups, groups with ethnic ties to the OPFOR, groups that sympathize with the OPFOR for political reasons, individual sympathizers, terrorist groups and criminal organizations) that can perform or support antilanding functions.  Determine potential means and routes of infiltration and potential sources of supply.  Determine the decisive point for destruction of landing forces. o On the ground, before air transport (using indirect fire, WMD, direct action, or precision munitions). o En route to or in the vicinity of LZs or DZs (using air defense weapons, directed-energy weapons, direct fire, obstacles, or anti-helicopter mines).

238 UNCLASSIFIED

Red Diamond

o In a LZ or DZ (using indirect fire, WMD, direct fire, direct action, precision munitions, or infantry with antitank weapons).

PREPARATIONPLANNING

 Create one or more ALRs.  Create task organization and command and control (C2) of action element(s), support element(s), security element(s), and deception force.  Assign attack zone(s) and kill zone(s).

REHEARSALPLANNING

 The ALR rehearses actions in the vicinity of the LZs or DZs as well as movement between assembly areas, hide positions, and attack positions, and between LZs or DZs.

EXECUTIONPLANNING

 Transmit early warning from the main command post to the ALR.  ALR moves to positions in the attack zone from which it can engage transport aircraft and destroy landing forces on the ground. o Disruption force(s) execute disruption of the enemy; focus on preventing detection of action element(s). o Security element(s) maneuver and fire to ensure the decisive point is isolated to ensure additional enemy forces do not join the battle unexpectedly. (Security elements may become fixing elements.) o Support element(s) conduct action to set conditions for action elements’ success. o Action element(s) destroy targeted enemy. OPFOR Replications and Training Support Even though the Syrian attack video does not show a number of the exact steps in the OPFOR’s ALO tactical task, it does not mean that they did not take place in some sort of fashion. The rebels in the video located and predicted the LZ. There was likely some sort of planning cycle for the infiltration of the team, weapon choice, and the target choice in the kill zone. There were likely other elements off-camera providing security, early warning, and C2 in support of the operation. These real-world events provide great examples for scenario developers to replicate and simulate for the training community. The Syrian Kornet attack video on the airbase provides an example of a daunting challenge for training or deploying units. A commander needs to consider a five-kilometer threat from an ATGM on all his vehicles, including aircraft, and how to successfully mitigate the risk to the unit/base. The ATGM in a dual-use role also provides a new dimension for a training unit’s S-2 section to consider. The standard thought process of weapons systems falling into defined categories can potentially be dangerous. Just because a system is designated as an ATGM does not mean that intelligence should eliminate the weapon as a threat against other targets—especially effective systems like the Kornet.

239 UNCLASSIFIED

Red Diamond

Table 1. OPFOR tactical task: Antilanding actions

The training community, such as the CTCs or home station scenario developers, can reference ACE-TI’s TC 7-100.2 and TC 7-100.3 in order to prepare units for ALO or other threats in order to enhance training. The previous article in this month’s publication of the Red Diamond discusses the future rewrite of ALO doctrine as a tactical action that will be included in the updated TC 7-100.2. CTC scenario developers and home station trainers can find additional information on air defense or the duel use of ATGM/air defense artillery units, organization, or weapons systems in TC 7-100.4, its associated Threat Force Structure, and the Worldwide Equipment Guide (WEG). The Red Diamond also includes articles on real-world threats, such as ALO tactical actions, in order to inform and stimulate the training community and scenario development.

References Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. January 2014. Headquarters, Department of the Army. Training Circular 7-100.4, Hybrid Threat Force Structure Organization Guide. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. June 2015. Headquarters, Department of the Army. Training Circular 7-102, Operational Environment and Army Learning. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2014.

Notes 1 Missile and Space Intelligence Center. “Kornet ATGM Destroys SAF Helicopter.” Liveleak. Posted 12 September 2014. (Video is no longer accessible; an alternative site is Military.Com.) 2 Missile and Space Intelligence Center. “ATGM Firings in the Syrian Conflict as of 3 June 2016.” 3 June 2016. 3 Missile and Space Intelligence Center. “ATGM Firings in the Syrian Conflict as of 3 June 2016.” 3 June 2016. 4 Adapted from MSIC video from Live leak. Graphic Created by TRADOC G-2 ACE Threats on 22 May 2016. 5 US Army, TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. Worldwide Equipment Guide – Volume 1: Ground Systems. December 2015. Pg 87. 6 Headquarters, Department of the Army. Training Circular 7-101, Exercise Design. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2010. Pg B-17. 7 Headquarters, Department of the Army. Training Circular 7-101, Exercise Design. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2010. Pg B-17.

240 UNCLASSIFIED

Red Diamond

by Jim Bird, TRADOC G-2 ACE Threats Integration (IDSI CTR) In the wee hours of Sunday morning, 8 May 2016, eight police officers drove through the deserted streets of Helwan, a southern suburb of , conducting what should have been a routine round of security checks. Suddenly a pickup truck darted in front of the police van, forcing it to stop. The truck’s four masked occupants jumped out and sprayed the police van with automatic weapons fire, killing all eight Egyptian policemen. The perpetrators of this terrorist attack then methodically searched the corpses of their victims, seized the policemen’s weapons, and faded into the darkness with no interference or molestation from stunned authorities.1 In the immediate aftermath of the incident an organization affiliated with the Islamic State of Iraq and the Levant (ISIL) claimed responsibility, declaring that “soldiers of the caliphate” carried out the attack in retribution for the Egyptian government’s incarceration of “pure women”—a pretext commonly used by Islamic militants to justify acts of violence.2 Although the ISIL claim could not be independently verified, the group’s statement had identified one of the slain officers and images on social media “showed the bloodied bodies of the officers, dressed in shirts and jeans, slumped in and around a white vehicle that was raked with bullet holes.”3 Getting the World’s Attention

The group that perpetrated the Helwan Figure 1. Police van ambushed by ISIL-SP ambush calls itself Wilayat Sinai (Sinai Province; ISIL-SP), a name that alludes to an insurgency that the Egyptian military has been fighting for several years, which has greatly increased in severity since President Mohammed Morsi was forced from power in July 2013. Formerly known as Ansar Beit al Maqdis (Supporters of Jerusalem), the group that became ISIL-SP first appeared in the Gaza Strip following the overthrow of Egyptian President Hosni Mubarak in September 2011. It took its present name in November 2014—coinciding with its pledge of allegiance to ISIL—and became the focus of world attention after downing a Russian airliner over the Sinai in October 2015.4 Much of the notoriety on that occasion stemmed from the scale of the atrocity. The downed aircraft was a civilian jet carrying 224 passengers and crew; all on board lost their lives. Within hours of the crash, ISIL-SP published a statement claiming that “soldiers of the caliphate were able to bring down a Russian airplane.”5 Meanwhile, US, UK, French, and Russian counterterrorism and intelligence officials were busy drawing similar conclusions. Investigators early on ruled out technical failure, , and impact by some external object as likely causes. The emerging consensus was that an explosive device had been

241 UNCLASSIFIED

Red Diamond

planted on the plane; and in early November 2015 British Prime Minister said that the planted bomb scenario was “more likely than not.”6 In an interview with Newsweek, geopolitical consultant Michael Horowitz offered other considerations that lent credibility to ISIL-SP’s claim of responsibility. For one thing, the timing of the terrorist attack was probably no accident: it came almost exactly one year after the group swore allegiance to ISIL, and also came on the heels of Russian airstrikes that began hitting ISIL targets in Syria in September 2014. ISIL responded to the Russian intervention in Syria by calling for a holy war against both Russia and the US. Moreover, Horowitz argued that ISIL’s reputation is based on making credible claims for attacks, and that the group would not risk damaging its image by making a false claim.7 According to H. A. Hellyer, an associate of the Royal United Services Institute—a UK think tank—the media coverage generated by the attack gave ISIL-SP an unprecedented “level of prominence . . . in the international extremist universe. They’ve controlled the narrative [of the crash]—that’s a victory in and of itself.”8 The INFOWAR Dimension The information warfare (INFOWAR) dimension is what both the 8 May 2016 Cairo ambush and the October 2015 downing of Russian share in common. In both instances, ISIL-SP controlled the media narrative. The two attacks also demonstrate how the group is undergoing an evolutionary process that is bringing it into alignment with overarching ISIL objectives. As explained in the February 2016 ACE-TI Threat Tactics Report, Islamic State of Iraq and the Levant, “most Wilayat Sinai attacks target security forces in the northern part of the area [] in an attempt to create a zone where the group can operate freely without interference from national security forces.”9 Although the statement accurately described the situation that existed throughout most of 2015, circumstances have changed since then. ISIL-SP’s zone is still expanding. An Adaptive Enemy with Long-Term Goals and Objectives A growing body of evidence suggests that ISIL-SP is making a concentrated effort to extend its geographical reach deeper into the Egyptian heartland. The expanding sphere of influence includes the greater Cairo area, especially the South Cairo suburb of Helwan, where the 8 May 2016 ambush occurred. The previous November, ISIL had claimed responsibility when four police officers were gunned down at a security checkpoint, also in Cairo.10 The subsequent terrorist attack of May 2016 suggests that killing so many policemen so close to Cairo indicates an escalation in violence. Zack Gold, a contributor to West Point’s CTC Sentinel publication, underscores another indicator of organizational evolution in his discussion of ISIL-SP’s decision to bring down Metrojet Flight 9268. Gold contends that the bombing was the capstone of “the group’s self-declared economic war against the state Figure 2. View of Cairo and selected suburbs and was [consistent with] a year-long trend

242 UNCLASSIFIED

Red Diamond

of rhetorically attacking the local interests of nations working against the Islamic State.”11 Gold goes on to explain that on 18 November 2015, after stonewalling for nearly three weeks on the need to provide hard evidence to substantiate its involvement in the Russian jetliner bombing, ISIL-SP published a photo of the IED it used in ISIL’s English-language magazine, Dabiq. British analyst Michael Horowitz declared that “the propaganda campaign surrounding the Russian jet crash is proof of the close links between the Sinai Province and ISIS.”12 In the aftermath of the Russian Metrojet crash, some experts thought that perhaps ISIL-SP had alienated its popular base of support by wreaking havoc with a tourist industry on which many Egyptians depended for their livelihood.13 Recent developments, including the police van ambush, provided evidence of a more likely scenario: that the group is capitalizing on popular discontent with recent measures taken by the Egyptian authorities to quell anti-government protests and political opposition. Although ISIL-SP militants do not actually control territory in Egypt, according to the BBC they are “thought to be aiming to take control of the Sinai Peninsula in order to turn it into an Islamist province run by IS [ISIL].”14 During the period immediately preceding the 8 May 2016 Cairo ambush, Mokhtar Awad, a contributing author to West Point’s CTC Sentinel, had already drawn similar conclusions: Nearly 18 months after the Islamic State [ISIL] injected itself into the Egyptian jihadi landscape . . . the contours of an Islamic State expansion strategy in the Egyptian mainland are becoming clearer. The Islamic State has escalated activity in the Western Desert, Upper Egypt, and found new cells in the Greater Cairo area. The group is exploiting its Egypt presence to project terror by targeting Western interests as part of its broader external operations campaign. It is also steadily laying the groundwork for a mainland insurgency to link the Libyan and Sinai theaters and to consolidate control over a fragmented Nile Valley militant landscape made up of al-Qa’ida-aligned militants and violent actors associated with some factions inside the Muslim Brotherhood and their Islamist supporters.15 Such broad-based goals as those described above suggest that adjustments made by the Sinai Province franchise of ISIL transcend short-term adaptations geared to day-to-day survival on the battlefield. Instead, they reflect a long-term evolutionary trend consistent with an intent to overthrow the ruling Egyptian government. First estimated to number about 300, ISIL-SP is now believed to have between 1,000 and 1,500 members.16 Wellsprings of Discontent: Turmoil, Poverty, and Marginalization Egypt has been a staunch ally of the United States since the late 1970s when US President Jimmy Carter brokered the Camp David Accords, which led to the 1979 Egypt-Israeli peace treaty. Hosni El Sayed Mubarak, a former Egyptian general, served as Egypt’s vice president during President Anwar Sadat’s tenure in office, then assumed the mantle of president following Sadat’s assassination in October 1981. Mubarak brought considerable stability to the US-Egyptian relationship, remaining in power for nearly 30 years before finally being forced to step down after 18 days of demonstrations during the Egyptian revolution of January 2011. Following Mubarak’s fall, Mohammed Morsi, Egypt’s first democratically- elected president, assumed office in June 2012. As chairman of the Freedom and Justice Party, Morsi drew much of his support from members of the Muslim Brotherhood, an organization originally founded in 1928, only a few years after Egypt gained its independence from Great Britain. Since that time the Brotherhood has come to represent a center of gravity for political Islam, not only in Egypt but elsewhere throughout the Middle East. According to the New York Times, it “has prided itself for decades on a nonviolent and election-oriented approach to political change. Some of its [followers]

243 UNCLASSIFIED

Red Diamond

founded moderate Islamist parties in Turkey and Tunisia, while others, like Ayman al-Zawahri, the ideologue of Al Qaeda, have broken with the brotherhood to form anti-Western militant groups.”17 During the 2012 Egyptian presidential election campaign that followed Hosni Mubarak’s fall from power, Morsi presented himself as a hedge against any return by the old guard, and promised to head a government that would represent the interests of all Egyptians.18 In accordance with the provisions of the 1979 Egyptian-Israeli treaty, over time the Sinai Peninsula was to become a buffer zone that would help establish peace and mutual trust between the two signatories. Instead, the area degenerated into a hotbed of international crime and Islamist militancy. Consequently, since the days of Mubarak’s presidency, the Egyptian government has been fighting a number of extremist factions in the Sinai. The peninsula is a strategic land bridge that links Africa with Asia. It forms a triangular geographical land mass bounded by Gaza, Israel, and the Gulf of Aqaba on the east; the Mediterranean Sea to the north; and the Suez Canal to the west. The north and south Sinai comprise about 7% of Egypt’s territory, and are sparsely inhabited, accounting for only about 0.7% of the country’s population. Its natives are mostly nomadic Bedouins, an ethnic group sometimes scorned by other Egyptians because of alleged collaboration with Israeli authorities Figure 3. Voice of America map as modified by ACE-TI during their 15-year- long military occupation of the Sinai Peninsula following the 1967 Arab-Israeli war. Since the end of that occupation, the central government in Cairo has tended to doubt the loyalty of the Bedouins, looking down on them as a potential political fifth column.19 Consequently, over time some parts of Egypt’s Sinai Peninsula became a neglected no man’s land, whose population the state power structure regarded as second-class citizenry, with native Bedouins excluded from tourism and energy development projects.20 Steven Cook, a Senior Fellow with the Council on Foreign Relations, recalled that “the United States and Israel were telling Mubarak for years that neglect of the Sinai was going to come back to haunt” the Egyptians.21 The haunting occurred in the form of an underground economy where Bedouins “found opportunities for economic survival in cannabis and narcotics production, gun running, and smuggling goods as well as people.”22 Human trafficking increased significantly during the mid-2000s, when refugees from sub-Saharan Africa flooded the Sinai in a desperate attempt to reach Israel, or perhaps even Europe. All too often while crossing the peninsula they encountered abduction, rape, torture, and extortion for ransom. During Mubarak’s near 30-year rule, many Bedouins dependent on the underground economy grew increasingly frustrated with the central government in Cairo. They perceived its secular-oriented state security apparatus as corrupt and detrimental to their own well-being, an entity that preferred

244 UNCLASSIFIED

Red Diamond

conspiring with Israel over improving the quality of life of local residents in the Sinai. Although tribal leaders generally rejected violence, a rift developed between them and radicalized Bedouin youths, who believed armed resistance against the state was a better option than accepting the tenets of the Israeli- Egyptian peace treaty. It is hardly surprising that this radicalized faction included Salafi jihadis who felt justified in waging holy war against infidels and insufficiently-pious Muslims. This was the state of affairs that prevailed in the Sinai on the eve of the Egyptian revolution of January 2011.23 In early 2011, after prolonged demonstrations in Cairo’s famous Tahrir Square and elsewhere across Egypt had forced President Mubarak to relinquish power, government security forces drastically reduced their presence in the Sinai in order to project as much power as possible along the trace of the Nile River Valley. Then in March 2011 NATO began its bombing campaign in neighboring Libya. As NATO air operations west of the Egyptian border forced the Libyan military to leave sizeable caches of arms virtually unguarded, many Bedouins seized the opportunity to smuggle large quantities of weapons and ammunition into the Sinai region, as a hedge against the day when Egyptian security forces might return to restore order. At this point a state of near anarchy prevailed in large parts of the Sinai. Israeli intelligence identified as many as 15 militant Islamist factions, including Ansar Beit al Maqdis, operating there. Most were in a position to defy the central government’s authority with impunity.24 A Withered Arab Spring As noted earlier, following the first free elections in Egypt’s recent history, Mohammed Morsi, representing the interests and views of the Muslim Brotherhood, became president in June 2012. Many of the Brotherhood’s long-suffering followers felt vindicated that their years of patient organizing, sometimes in the face of state-sponsored repression, had paid off by demonstrating that an Islamic government could indeed be brought to power through a peaceful electoral process. Conversely, the Brotherhood victory also amounted to a rebuke to militant groups who had insisted that an Islamic state could only be created through violent means. After his election, Morsi took a conciliatory approach to crafting a reconciliation between Egypt’s central government and its wayward Sinai region. He promised that the relationship between the two entities would witness a new start, and personally visited the Sinai to demonstrate support for its future development.25 Despite Morsi’s promise to govern in the interest of all Egyptians, his tenure in office disappointed many of his fellow countrymen. The BBC reported that he failed to deliver on many of his promises and that critics “accused him of allowing Islamists to monopolise the political scene [by] concentrating power in the hands of the Muslim Brotherhood.”26 In addition to those complaints, the economy remained problematic, and Morsi’s track record on civil rights and social justice issues fell far short of meeting public expectations. Opposition to his regime increased in November 2012, when the Islamist- dominated parliament vacillated in drafting a new constitution and Morsi published a decree granting himself far-reaching powers. The public furor subsided temporarily after 15 December 2012, when voters approved the draft constitution through a referendum.27 Although President Morsi deployed the Egyptian military to the Sinai to demonstrate the authority of the central government, he hesitated to use force to restore order in the restive region. A climate of insecurity and lawlessness prevailed there until May 2013, when militants kidnapped seven soldiers, an act that set the stage for massive protests across Egypt the following month and created conditions favorable for a military coup. The thirtieth of June 2013 marked the first anniversary of Mohammed Morsi’s swearing-in as president. On that day, millions of demonstrators took to the streets in protest, prompting military authorities to issue an ultimatum warning Morsi that it would intervene within 48 hours to impose its own way forward if public demands were not satisfied. The deadline passed and, as

245 UNCLASSIFIED

Red Diamond

reported by BBC, “on the evening of 3 July the army suspended the constitution and announced the formation of a technocratic interim government.”28 The Egyptian Army’s War on Terror President Morsi’s removal brought General Abdul Fattah al Sisi to the pinnacle of power in Egypt. As former head of the armed forces, he led a military establishment whose relationship with the Muslim Brotherhood dated to the early 1950s, when members of that organization formed a temporary alliance of convenience with the Nationalist Free Officers’ movement to rid the country of British rule. Later, however, the two factions became bitter adversaries in the struggle for political power in Egypt. Just hours after President Morsi’s ouster, military helicopters appeared over Cairo’s Tahrir Square, then dropped thousands of Egyptian flags over protesters assembled there, inspiring them to chant, “the people and the army are one hand!”29 Mr. Sisi boasted a reputation as a soft-spoken yet charismatic leader, with a knack for giving emotional speeches. CNN reported that on one occasion, at a concert in 2012, “his words . . . had artists on the stage with him in tears.”30 Many Egyptians were supportive of a military-led government they hoped would re-stabilize the country after the chaos that brought down Hosni Mubarak’s regime and persisted during President Morsi’s rule through the first half of 2013. A new crackdown on political Islam soon revealed that the Sisi government made no distinction between moderate and militant factions within the Muslim Brotherhood: all were regarded as threats to the state. When government security forces stormed two pro-Morsi protest camps in August 2013, killing hundreds in the process, a wave of violent backlash washed across Egypt. Pro-Morsi elements attacked government buildings and torched dozens of Coptic Christian churches, causing government authorities to declare a state of emergency and outlaw membership in the Muslim Brotherhood.31 Predictably, Egyptian militant groups interpreted the Islamists’ fall from grace as solid evidence that the goal of an Islamic state could only be realized through violence, and not through the ballot-box. In October 2013 one militant jihadist, calling himself al Shinqiti, wrote that anyone advocating nonviolence “is a criminal thug who wants the Ummah (Muslim community) to be eradicated and to be slaughtered . . . Every attempt to avoid fighting the Egyptian Army is like treating a disease with the wrong medicine.”32 ISIL-SP’s parent organization, Ansar Beit al Maqdis, had formed in Egypt following the ouster of Mubarak, and numbered among the armed groups that rejected the Sisi regime’s crackdown on Islamist opponents. The US State Department declared it a terrorist organization in October 2014 following attacks in the North Sinai that killed 33 security personnel. The group changed its name the following month to Figure 4. ISIL-SP logo Sinai Province and concurrently pledged allegiance to ISIL.33 Thus the set of conditions were created that led to the ISIL-SP attack on Sheikh Zuweid in the Sinai Peninsula, discussed in the previously mentioned Threat Tactics Report, “Islamic State of Iraq and the Levant.” The New York Times described the fight at Sheikh Zuweid as the most audacious attack launched by the group in the first half of 2015. “To finally overcome the militants,” said the Times, “the military called in warplanes and helicopters, conducting airstrikes that left the remains of the militants still sitting in their pulverized vehicles, witnesses said.”34 The affair at Sheikh Zuweid was the capstone of

246 UNCLASSIFIED

Red Diamond

more than 700 attacks launched against Egyptian security forces in the Sinai Peninsula during the first half of 2015.35 On 8 September 2015 the Egyptian army launched operation Martyr’s Right, said to be “the largest and most comprehensive operation aimed at rooting out and killing militants in the North Sinai.”36 It consisted of two phases, conducted in serial fashion: a kinetic phase that ran from 8–22 September, in which security forces attacked and destroyed personnel, vehicles and equipment; and a second phase beginning on 8 October that entailed stability operations designed to “pave the road for creating suitable conditions to start development projects in the Sinai.”37 The government’s information campaign presented Martyr’s Right to the Egyptian public as a resounding success, and timed the end of the operation to coincide with the 6 October anniversary of the country’s victory in the 1973 war against Israel. Despite positive government interpretations, a series of four terrorist attacks perpetrated during the last ten days of October, in addition to the shoot-down of Metrojet Flight 9268 on the last day of the month, speaks for itself as testimony to Wilayat Sinai’s resilience and capacity for adaptation.38 The 8 May 2016 ambush of the police van in the Cairo suburb of Helwan, as previously discussed, is a further indication that the threat posed by ISIL-SP is far from being eradicated and instead may be expanding.

Figure 5. Russian leaders meet after loss of Metrojet Flight 9268

Recent Developments and the Way Ahead A survey conducted by a London-based news website revealed that ISIL-SP had perpetrated over thirty attacks across the Sinai Peninsula during a two-week period in March 2016. The group also kept up the tempo of its ongoing media campaign, in September releasing a video, “Soldiers’ Harvest,” that portrayed several attacks carried out against security forces. Another video, released in March 2016, purportedly showed camps in a desert location where ISIL-SP members received combat training. Before President Morsi’s downfall the group scorned the nonviolent wing of the Muslim Brotherhood for embracing the “infidel democracy” and the electoral process; but in early 2016, just a few days prior to the fifth anniversary of the 25 January 2011 revolution, ISIL-SP softened its tone toward the Muslim Brotherhood’s “supporters of peacefulness,” calling on them to abandon their former stance in favor of taking up arms against the regime of President Abdul Fattah al Sisi.39

247 UNCLASSIFIED

Red Diamond

In April 2016, President Sisi’s government ran into additional rough sailing when Egypt transferred authority over two Red Sea islands to Saudi Arabia. In the midst of allegations that the islands’ giveaway was no more than a deal concocted by the Sisi and Saudi Arabian regimes to funnel additional aid to Egypt, security forces arrested approximately 1,200 people in the wake of public protests against the arrangement. Of the 1,200 arrested, about 600 were formally charged. These most recent incidents have further tainted Sisi’s popularity, and added more fuel to public anger already simmering over alleged police brutality involving deaths stemming from trivial matters such as taxi fares or the price charged for a cup of tea. Recent arrests of journalists have also tarnished police reputations and spawned violent public protests. On 8 May 2016—the same day of the Cairo police van ambush—issues of due process and other allegations against the police were scheduled for debate by the Egyptian parliament.40 If President Sisi’s government has a less-than-perfect track record on human rights, the fact remains that Egypt has been a dependable US ally in the war against ISIL, regardless of the country’s troubled internal politics. It has also lived up to its obligations under the Egypt-Israeli peace accord of 1979, making it the first Arab state to formally acknowledge the sovereignty of Israel. Declan Walsh of the New York Times correctly observed that “fears over the spread of the Islamic State, which is based in Syria and Iraq but also has a muscular presence in Libya, have helped ensure Western support for Mr. Sisi even as he faces renewed criticism for a harsh, police-led crackdown on political dissent in Egypt.”41 Before the month of May 2016 ended, Western support assumed the guise of providing the Egyptian government with 762 US-manufactured mine resistant ambush protected (MRAP) vehicles, scheduled for delivery in increments, free of charge. The first consignment is already in Egypt, with the remainder to be shipped in coming months. The MRAP shipments will occur in addition to the $1.3 billion in US military aid allocated to the Sisi regime this year. As to the future, it may be significant that, as a recent Washington Post article points out, the Obama administration “has asked Congress to remove all political and human rights conditions on military aid to Egypt in next year’s budget.”42 Because defeating ISIL is in the interest of both the United States and Egypt, developments in the Sinai Peninsula warrant the attention of combatant commands as a potential future operational environment. Currently- deployable US units would do well to keep informed of the ongoing and apparently burgeoning threat posed by ISIL-SP; it constitutes yet another front in the war against ISIL and the level of US support will, in all likelihood, continue.

Notes 1 BBC. “Egyptian Policemen Killed In Ambush South of Cairo.” 8 May 2015; Thomas Joscelyn. “Russians Say Improvised Explosive Device Brought Down Jet In Sinai.” Long War Journal. 17 November 2015. 2 Declan Walsh. “Ambush Kills 8 Police Officers in Egypt.” New York Times. 8 May 2016. 3 Declan Walsh. “Ambush Kills 8 Police Officers in Egypt.” New York Times. 8 May 2016. 4 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015. 5 Thomas Joscelyn. “Russians Say Improvised Explosive Device Brought Down Jet In Sinai.” Long War Journal. 17 November 2015. 6 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015. 7 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015. 8 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015. 9 US Army, TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. “Threat Tactics Report: Islamic State of Iraq and the Levant.” Version 1.6. February 2016. Pg 30. 10 Voice of America. “8 Egyptian Police Killed in Ambush Near Cairo.” 8 May 2016; Declan Walsh. “Ambush Kills 8 Police Officers in Egypt.” New York Times. 8 May 2016. 11 Zack Gold. “Wilayat Sinai Risks Backlash After Metrojet Bombing.” CTC Sentinel. 15 December 2015. 12 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015.

248 UNCLASSIFIED

Red Diamond

13 Zack Gold. “Wilayat Sinai Risks Backlash After Metrojet Bombing.” CTC Sentinel. 15 December 2015. 14 BBC News. “Sinai Province: Egypt’s Most Dangerous Group.” 12 May 2016. 15 Mokhtar Awad. “The Islamic State’s Pyramid Scheme: Egyptian Expansion And The Giza Governate Cell.” CTC Sentinel. 22 April 2016. 16 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015; BBC News. “Sinai Province: Egypt’s Most Dangerous Group.” 12 May 2016. 17 David D. Kirkpatrick and Mayy El Sheikh. “Push for Retribution in Egypt Frays Muslim Brotherhood.” New York Times. 5 August 2015. 18 BBC News. “Profile: Egypt’s Mohammed Morsi.” 21 April 2015. 19 Zachary Laub. “Egypt’s Sinai Peninsula And Security.” Council On Foreign Relations. 12 December 2013. 20 Bethan Staton. “Sharm el-Sheikh: How The Luxury Resorts On Egypt’s Perfect Beaches Turned Into Abandoned ‘Ghost Hotels’.” Quartz.com. 4 June 2016. 21 Zachary Laub. “Egypt’s Sinai Peninsula And Security.” Council On Foreign Relations. 12 December 2013. 22 Zachary Laub. “Egypt’s Sinai Peninsula And Security.” Council On Foreign Relations. 12 December 2013. 23 Zachary Laub. “Egypt’s Sinai Peninsula And Security.” Council On Foreign Relations. 12 December 2013. 24 Zachary Laub. “Egypt’s Sinai Peninsula And Security.” Council On Foreign Relations. 12 December 2013. 25 Zachary Laub. “Egypt’s Sinai Peninsula And Security.” Council On Foreign Relations. 12 December 2013. 26 BBC News. “Profile: Egypt’s Mohammed Morsi.” 21 April 2015. 27 BBC News. “Profile: Egypt’s Mohammed Morsi.” 21 April 2015. 28 BBC News. “Profile: Egypt’s Mohammed Morsi.” 21 April 2015 29 BBC News. “Egypt: Abdul Fattah Al-Sisi Profile.” 16 May 2014. 30 BBC News. “Egypt: Abdul Fattah Al-Sisi Profile.” 16 May 2014. 31 BBC News. “Egypt: Abdul Fattah Al-Sisi Profile.” 16 May 2014. 32 Vivian Salama. “What’s Behind The Wave Of Terror In The Sinai.” The Atlantic. 22 November 2013. 33 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015; Zachary Laub. “Egypt’s Sinai Peninsula And Security.” Council On Foreign Relations. 12 December 2013. 34 Kareem Fahim and David D. Kirkpatrick. “Jihadist Attacks on Egypt Grow Fiercer.” New York Times. 1 July 2015. 35 Conor Gaffey. “What Is The Sinai Province, The ISIS Affiliate In Egypt?” Newsweek. 5 November 2015. 36 Dr. Shaul Shay. “ Counter Terror Operation ‘Martyr’s Right’ in North Sinai.” International Institute for Counter- Terrorism. 1 November 2015. (Link is not accessible from a US government computer.) 37 Dr. Shaul Shay. “Egypts Counter Terror Operation ‘Martyr’s Right’ in North Sinai.” International Institute for Counter- Terrorism. 1 November 2015. (Link is not accessible from a US government computer.) 38 Dr. Shaul Shay. “Egypts Counter Terror Operation ‘Martyr’s Right’ in North Sinai.” International Institute for Counter- Terrorism. 1 November 2015. (Link is not accessible from a US government computer.) 39 BBC News. “Sinai Province: Egypt’s Most Dangerous Group.” 12 May 2016. 40 Declan Walsh. “Ambush Kills 8 Police Officers in Egypt.” New York Times. 8 May 2016. 41 Declan Walsh. “Ambush Kills 8 Police Officers in Egypt.” New York Times. 8 May 2016. 42 Jackson Diehl. “America Gives Egypt Free Armored Vehicles. Egypt Gives America A Slap In The Face.” Washington Post. 29 May 2016.

______

249 UNCLASSIFIED

Red Diamond

by MAJ Jay Hunt and Jerry England (DAC), TRADOC G-2 ACE Threats Integration Threat 2025+ is a TRADOC G-2 ACE Threats Integration initiative to produce a blueprint series that captures future threat tactics from a threat perspective for training. The blueprints are rooted in Training Circular (TC) 7-100.2, Opposing Force Tactics, and represent projected threat capabilities. The intent of the blueprints is to validate the current hybrid threat (HT) requirements for training and the current HT force structure at training centers Army-wide. This article will discuss one blueprint in detail, Irregular Force Attacks in Urban Terrain, and explain the conditions for its use in training. It will also highlight the threat tactics that are most relevant when given a set of combat conditions. Threat Blueprint Two: Irregular Force Attacks in Urban Terrain Blueprint two will illustrate how an opposing force (OPFOR) brigade tactical group (BTG) task-organized with significant irregular elements could conceptually attack an armored brigade combat team (ABCT) in an urban environment using combined lethal and non-lethal capabilities, such as deception and dispersed offensive actions, to create windows of opportunity that will lead to a decisive victory. This article will describe the threat force structure and the techniques the threat could use to accomplish this task. The HT fully recognizes the capabilities of the ABCT and understands that if the BTG openly appears in direct combat it will be defeated; for this reason the HT commander must adapt his tactics from regular to irregular to win on his terms. These circumstance force the HT to order the heavy forces’ withdrawal to complex battle positions outside the city. Although this is seen as conceding to the attacking force, the HT commander will leave a stay-behind force of guerrilla and insurgent enablers to conduct adaptive operations in an effort to expel the enemy at a later date.1 Once the ABCT occupies the city with sufficient combat power, the HT’s regular forces will establish their support zone in order to retain combat power and support the irregulars that remained behind in the city. The HT transitions to a decentralized command and control structure using a combination of military and civilian communications to coordinate disruptive attacks throughout the city. The BTG uses information warfare (INFOWAR) activities to mask its true capabilities and intentions. Using a combination of deception jamming and harassment fires, the regular force executes a feint against ABCT security positions on the edge of the city. This activity can preoccupy the ABCT as enemy reconnaissance elements try to determine the nature of the threat. The deception plan fixes the ABCT forces and enables the guerrilla battalion and the large local insurgent organization to create conditions for a dispersed attack in the ABCT’s support zone. The HT leverages the mobility and stealth of guerrillas and insurgents to isolate and destroy enemy elements on patrol within the urban zone. Guerrilla hunter- killer teams use improvised explosive devices (IEDs) and small arms to ambush ABCT patrols while leveraging local criminal gangs to disrupt enemy freedom of movement and conduct harassing attacks throughout the disruption zone surrounding the main objective.

250 UNCLASSIFIED

Red Diamond

The assault element, along with guerrilla and insurgent elements, attempts to culminate the operation through a dispersed attack against the ABCT support area in order to prevent resupply and ongoing lodgment of the ABCT within the city. The disruption force uses a relatively small regular force that executes counterreconnaissance activities like spoiling attacks against enemy intelligence, surveillance, and reconnaissance (ISR) assets to disable the enemy’s ability to gain situational awareness. Meanwhile, mixed irregular, regular, and criminal elements conduct targeted attacks within the city against city leaders, infrastructure, and civilians. Functional Tactics: Fixing An important element of the operation is the disruption force’s ability to fix large portions of the ABCT. If the ABCT perceives the main threat as the regular force to the west of the city and commits significant resources in battle positions oriented along the main avenues of approach, the HT can degrade the ABCT’s area defense and isolate soft targets in the city. The disruption force’s intent is to fix these forces through combined lethal and non-lethal actions that include but are not limited to deception, indirect fires, and ambushes. INFOWAR elements will conduct electronic deception to portray a larger regular force than is actually present. Other activities will control information and give indications that the motorized brigade is preparing an assault from the west. The HT’s motorized brigade will also conduct counterreconnaissance through localized raids and ambushes to minimize detection and keep the enemy focused on the perceived attack. Indirect fires are used to fix the enemy task force through suppression. A security element consisting of a company detachment with reconnaissance, antitank, and antiaircraft assets acts as armored hunter-killer teams designed to engage enemy armor and enemy reconnaissance capabilities. Unmanned aerial vehicles provide situational awareness and can provide early warning if and when the ABCT’s forward elements decide to withdraw. These conventional forces do not have to be decisive, but must attack with sufficient combat power to maintain the deception. If the ABCT attempts to reposition or withdraw under pressure, the irregular forces will shift on order to disrupt and block the enemy withdrawal by conducting ambushes along likely movement routes using antitank missiles and IEDs. The HT can modify operations by placing emphasis on countermobility once the enemy decides to withdraw from defensive positions. Functional Tactics: Disruption Activities Disruption operations not only affect the ABCT’s movement and maneuver against the HT, but can delay its ability to restore stability. The main objective is to cut off the population from the ABCT and its allies. Widespread attacks against enemy security patrols, local government facilities, and media outlets will create confusion amongst the population and keep the ABCT guessing about what it should defend. Irregular elements will also enlist local gangs by permitting criminal activity in areas where they feel they need to disrupt stability operations. This criminal activity challenges the enemy as it struggles to execute stability operations while maintaining the force to deal with the perceived conventional fight. The dispersed attack is a series of small tactical offensive actions. TC 7-100.2 states that, “when the Hybrid Threat is overmatched by a technologically superior enemy the dispersed attack allows him to conduct offensive actions while preserving combat power and remaining anonymous.”2 The HT relies heavily on irregular forces to facilitate hit and run attacks, maintain security, and support the INFOWAR campaign. It will leverage camouflage, concealment, cover, and deception capabilities within the urban environment to mask its true capabilities and support the narrative of being everywhere at once. A series of complex battle positions such as safe houses and caches throughout the urban zone provide protection and security and maintain operational flexibility.

251 UNCLASSIFIED

Red Diamond

Figure 1. Hybrid threat disruption operations BP-2 Disruption activities conducted by HT regular and irregular forces against the enemy are adaptive in nature and are designed to preserve combat power while creating windows of opportunity against a technologically-superior adversary. Operational flexibility can include transitioning to an integrated attack or maintaining a stalemate or “frozen conflict,” in which poor security prevents the ABCT from capitalizing on its tactical gains. The HT wins by not losing and can achieve this by gaining the population’s loyalty and bleeding the ABCT through multiple small engagements. Functional Tactics: Assault 1. Assault Objective At the appropriate time, when the ABCT has either been significantly attrited or relegated to its base camps, the HT will execute a decisive attack against a key element of the ABCT’s combat system. In this blueprint, guerrilla mortars and multiple vehicle-borne IEDs are the breaching element against the brigade support area’s (BSA’s) perimeter, while the exploitation element is a guerrilla company

252 UNCLASSIFIED

Red Diamond

detachment, supported by criminal elements, that will accomplish the destruction and seizure of selected assets. The primary targets on the objective will be the lift helicopters, fuel storage, and other sustainment assets. This exploitation element is tasked with destroying or stealing the assets, depending on the strength and timing of the ABCT’s response. Reconnaissance and INFOWAR capabilities throughout the HT area of operations will provide early warning of enemy quick response forces. 2. Leverage Criminal Motivations to Complete Objective The irregular forces leading the assault will leverage relationships with local criminal elements and allow them access to areas in order to loot the compromised BSA and participate in the action. This creates an opportunity for synergistic relations between combatants and noncombatants as criminal elements profit from military activity.

Figure 2. Hybrid threat assault force BP-2

253 UNCLASSIFIED

Red Diamond

Conclusion and Implications for Training The BTG sets conditions by destroying, degrading, or overtaxing elements or components critical to the ABCT’s combat systems in order to execute future offensive actions against the ABCT. The activities in the disruption zone to confuse and disrupt enemy reconnaissance can create favorable conditions for an attack in the battle zone. The BTG achieves this by executing a deception plan designed to present a larger, more capable regular force, while simultaneously increasing violence and instability inside the city. By maintaining contact through indirect fires and ambush attacks on ISR assets, the disruption element trains the ABCT’s attention on the deception effort while degrading its situational awareness. Perception management activities that normalize violence and criminality allow the HT to conduct the attack at the time and place of its choosing by using the chaotic situation as a way to conceal its movement and preparations. The HT can change the nature of the conflict by adopting asymmetric tactics instead of open combat. This approach allows the HT to continue the fight while maintaining the ability to conduct decisive operations at the right time. INFOWAR is critical to the HT’s strategy to control information within the population and to shape the ABCT’s perception of the operational environment. Successful INFOWAR operations will draw the ABCT into smaller dispersed formations, making it vulnerable to isolation and attack. By compelling the ABCT to overreact and transmitting the event to civilian media, the HT gains legitimacy among the population when it decides to retaliate. The HT achieves operational flexibility through the complicity of the population. An ABCT will never know as much about the area as the locals, and for this reason it should attempt to understand how formal and informal relations work between the local population and the BTG. If the majority of the population supports the HT’s end state, then isolation and containment by the ABCT may be the only option.

Notes

1 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. Para 1-20. 2 Headquarters, Department of the Army. Training Circular 7-100.2, Opposing Force Tactics. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 9 December 2011. Para 1-66.

______

254 UNCLASSIFIED

Red Diamond

by Marc Williams, TRADOC G-2 ACE Threats Integration (ThreatTec Ctr) The ongoing conflict between Ukraine and Russia has renewed interest in Russian techniques and procedures. The hybrid warfare in this conflict—as defined in US doctrine, but not Russian—includes the use of irregular militias on both sides with training from special purpose forces, and has resulted in over 9,000 killed. Last month’s article focused on pro-Ukraine militia units. This month’s article will focus on militia battalions supporting the pro-Russian separatist movement. Russia’s support—and some say instigation—of the Ukrainian separatist movement is well-documented despite a massive information warfare campaign to the contrary. Most of the 15,000 separatists who are fighting or fought in eastern Ukraine were Russian citizens that were either serving in or were veterans of the Russian military; these brought with them “armored personnel carriers, tanks, artillery, Strela-2 shoulder-fired missiles, [and] Grad rocket launchers, as well as the BUK surface-to-air missiles.”1 In August 2014, ten Russian paratroopers from the Reconnaissance Platoon, 1st Battalion-331st Regiment, 98th Airborne Division, were captured near Zerkal’nyj, , wearing sterile uniforms and operating BMDs that had all identifying markings painted over.2 Some sources reported troops from the Russian

Figure 1. Map of districts within Ukraine

255 UNCLASSIFIED

Red Diamond

8th Mountain Motorized Rifle Brigade, based in Chechnya, had been captured during the battle for , and that the 76th Airborne Division had been involved in the fighting. Further evidence of Russian activity was the exchange of Federal Security Bureau agent Olga Kulygina for 17 Ukrainian military prisoners in September 2014.3 Kulygina helped plan and organize Russia’s invasion of Ukraine and helped arm the militias. Former Soviet special forces personnel are training the separatist units. As late as December 2015, Russian cyber militias launched cyberattacks using wiper malware against the power grid in Ukraine.4 The separatist districts are and Donetsk, which border Russia and have renamed themselves as “People’s Republics.” Together they have announced themselves as —“New Russia”—and have formed the Novorossiya Armed Forces (NAF) made up of militia battalions. The Ukraine government refers to the area as “temporarily occupied territories.” The pro-Russian separatist militias remain officially separate from the Russian military. The ones within Luhansk are not well-organized into a single militia. The different battalions and units generally fight only within their territory, operate without coordination, and sometimes are at odds with one another. Field commanders ignore the political leaders and do as they wish. Donetsk has begun re-forming its units into a centralized command structure subordinate to its Ministry of Defense, which also operates a school for command. Units are assigned to either 1st Army Corps or the Republican Guard. The Donetsk order of battle includes six territorial defense battalions.

Event Date(s) Revolution February 2014 Battle of Slavyansk 12 April – 5 July 2014 Battle of 6 May – 14 June 2014 First Battle of Donetsk Airport 26–27 May 2014 Malaysia Airlines Flight 17 shot down 17 July 2014 Battle of Luhansk Airport 19 July 2014 Battle of Pervomaisk 28 July – 5 September 2014 7 August – 2 September 2014 First Ceasefire/ 5 September 2014 Second Battle Donetsk Airport 28 September 2014 – 21 January 2015 Battle of 16 January – 20 February 2015 Second Ceasefire/Minsk II 15 February 2015 Battle of Marinka 3 June 2015 Table 1. Key events in Ukraine Pro-Russian Separatist Battalions Within this list, the following units and commanders have been sanctioned by the European Council because they “have actively supported actions which undermine the territorial integrity, sovereignty and independence of Ukraine and to further destabilize Ukraine:” Cossack National Guard, Death Battalion, Kalmius Brigade, Oplot Battalion, , Somali Battalion, , and Zarya

256 UNCLASSIFIED

Red Diamond

Battalion.5 The units in this article are only representative of the pro-Russian separatist units, and not a comprehensive listing. 1st Motorized Rifle Brigade “Slavyansk” is also known as Task Force Komsomol. Based in the district of Donetsk, this brigade consists of 1st motorized infantry battalion “Viking,” 2nd motorized infantry battalion “Semyonov,” 3rd mechanized infantry battalion, a tank battalion, a self-propelled howitzer artillery battalion, a towed-artillery battalion, a counter-artillery battalion, and an antiaircraft battalion. Specialty units include an antitank battery, a reconnaissance company with a platoon of snipers, a sapper company, a communications company, a medical company, and a logistics company with organic security. The brigade is armed with T-72 and T-64 main battle tanks (MBTs), BMP-1/2 infantry fighting vehicles, BTR-80 armored personnel carriers, and MT-LB armored multi-purpose vehicles. Indirect fire is from 122mm D-30 towed Figure 2. 1st Slavyansk Brigade artillery, 122mm 2S1 Carnation self-propelled artillery, BM-21 Grad multiple unit patch rocket launchers, and 120mm mortars. The antitank battery is armed with 100 mm MT-12 Rapier towed antitank guns. Antiaircraft weapons systems include the 9K35 Strela-10 short range air defense system, the ZU-23-2 Sergei towed antiaircraft cannon, and the 9K38 Igla man portable air defense system. 1st Motorized Rifle Brigade was involved in the siege of Slavyansk, April–July 2014, and the battle for Debaltseve. 2nd Independent Tank Battalion “Diesel” in Donetsk is armed primarily with T- 72 MBTs, BMP-2 infantry fighting vehicles, and Strela-10 short-range air defense missile systems. Diesel is Figure 3. Diesel known to field 35–40 T- tactical marking 72B1/B3 MBTs and ten (courtesy Michael BMP-1/2 infantry Sheldon) fighting vehicles. It is organized into four tank companies, a motorized infantry company, a howitzer battery, and a reconnaissance platoon. This is a relatively newer unit that was not revealed until after the 6 ceasefires. The unit fought in the battle on Figure 4. Diesel MBT (courtesy Michael Sheldon) Marinka. It is organized much like a standard Russian tank battalion. Apti and Timur Battalion is also known as Death Battalion. This is Chechen pro-separatist group commanded by Apti Bolotkhanov that served in eastern Ukraine.7 Bolotkhanov served in pro-Russian battalions in Chechnya during 2002–2012 where he reached the rank of major.8 Unit strength is approximately 300 fighters from former militias in Chechnya under orders from Ramzan Kadyrov, the leader of Chechnya. Bolotkhanov states the members are all volunteers, “though others have suggested they were sent as part of Russia’s thinly disguised military backing for the rebels.”9 This unit took Figure 5. Apti part in the first battle of the Donetsk airport, then returned to Chechnya. Bolotkhanov

257 UNCLASSIFIED

Red Diamond

Battalion Vostok (Battalion East) is a pro-Russian separatist unit that is heavily armed and well-organized. Its purpose is to help the eastern territories secede from Ukraine and merge with Russia. The commander is Alexander Khodakovsky, “a defector from the Ukrainian state security” where he commanded the Alpha special group.10 Kiev has declared the unit terrorists. Vostok took over Donetsk separatist headquarters in May 2014, asserted control over other militants, and set up a training camp in the botanical gardens.11 The battalion includes Ossetians, Russians, Spaniards, Italians, and at least one American claiming to be from Texas.12 Unit strength is around Figure 6. Alexander 1,000 and it participated in the battles of Donetsk Khodakovsky airport, Ilovaisk, and Pervomaisk. Vostok is the name of a former ethnic Chechen unit that fought for Moscow against rebels in Figure 7. Battalion Chechnya and later against Georgia in South Ossetia in 2008. It was reported Vostok unit patch to have been disbanded, but reformed for covert tasks in Ukraine.13 The original commander was Suliam Yamadayev, who was named a Hero of Russia in 2005. In 2009 he was assassinated in Dubai, United Arab , by an Iranian and a Tajik.14 Kiev claims the Malaysian MH17 airliner shot down over Ukraine was downed by Vostok. Khodakovsky denies this, although Ukrainian intelligence insists it is his voice heard in recorded conversations concerning the plane’s black box.15 Some of the Chechen fighters in Vostok have combat experience from Afghanistan.16 The unit has been accused of serious human rights abuses against military prisoners.17 Figure 8. Vostok fighters including Khodakovsky has been sanctioned by the US Department 15 year-old boy of Treasury. Cossack National Guard is a Don Cossack volunteer unit in Luhansk claiming to have 4,000–5,000 fighters, commanded by Nikolai Kozitsyn. Some sources claim it has as many as 30,000 fighters that come and go. This unit stands apart from other Luhansk forces and operates independently. Kozitsyn claims the Luhansk People’s Republic does not exist and the region belongs to the . The Cossacks themselves are “commanded by Russians deputy in the Committee on Defense Viktor Vodolatsky.”18 The unit is armed with armor and

artillery and fought in the . Nikolai Kozitsyn has Figure 9. Nikolai Kozitsyn been sanctioned by the US Department of Treasury. First Cossack Regiment is also known as Wolves’ Hundred. The commander was a Russian citizen named Pavel Dremov, also known as Batya, meaning daddy or papa. Based in Stakhanov, this unit’s command structure traces directly to the Russian Commander-in-Chief despite its official designation as an irregular paramilitary force. Some of the members took part in the Georgian invasion in 2008, and most of the members took part in the takeover of Crimea in 2014. “Their aim, as professed by the fighters

258 UNCLASSIFIED

Red Diamond

themselves, is to destroy the state of Ukraine and absorb most, if not all, of it into Russia.”19 Dremov was reportedly assassinated when his car exploded 12 December 2015.20 Kalmius Brigade, also known as Task Force Mail, Miner’s Brigade, and First Artillery Brigade, is a separatist brigade commanded by Sergei Petrovskiy and operating in Donetsk. This unit is armed with D-30 (122mm towed howitzer), 2S1 (122mm self-propelled howitzer), MSTA-B 2A65 (152mm towed howitzer), BM-21 Grad (122mm multiple rocket launcher) and BM-27 9P140 Uragan (220mm multiple rocket launcher).21 The brigade fought in Debaltseve and Mariupol. Ukrainian news sources claim the unit is manned by Russian mercenaries and Cossacks.22 Kornilovtsy Battalion is a neo-Nazi unit that operated in eastern Ukraine. Also Figure 10. Kalmius known as Kornilovtsy Russian Attack Battalion, its members wear both Russian Brigade unit patch Spetsnaz and Nazi “death head” insignias.23 The unit gets its name from a volunteer unit that fought in the Russian civil war on the side of the Empire, which was named after Lavr Kornilov. Motorcycle Club (MC) is a Russian ultranationalist pro-Putin motorcycle club. Following the Euromaidan Revolution, the Donbass Chapter armed itself and fought as militia in the battle of Luhansk airport. The chapter commander is Vitaly Kishkinov, also known as “The Prosecutor,” and the deputy commander is Denis Kuznetsov. Night Wolves MC was involved in the seizure of Crimea by blocking roads and sabotage. Donbass Chapter membership is around 50 men, most of whom are veterans of the Russian army. It operates in Luhansk Figure 12. Night Wolves MC patch and, while not currently in combat, runs several armed checkpoints. The group appears to be standing by as a reserve.24 Night Wolves MC and its national leader, Aleksandr Zaldostanov—also known as “The Surgeon”—have been sanctioned by the US Department of Treasury. They were also sanctioned by Canada in February Figure 11. Vitaly 2015. Kishkinov

Oplot (Bulwark) Battalion’s commander is , who was elected Prime Minister of the breakaway Donetsk district in November 2014. When it was formed, the unit included Donbass citizens and former or current Russian soldiers “on leave.”25 On 1 October 2014 in a television interview, Zakharchenko “stated there were child fighters as young as 14 in his armed rebel unit, Oplot. He also claimed that 15-year-old children had served as spotters during fighting with government troops.”26 Originally a battalion, it expanded to a brigade in May 2015. Oplot participated in the battles of Ilovaisk and Pervomaisk. The unit has artillery units and at least one towed- howitzer battery is commanded by a woman, “Gaika.”27 Other sources show Figure 13. Alexander Oplot operating T-72BM main battle tanks.28 Oplot and its leader have been Zakharchenko sanctioned by the US Department of Treasury.

259 UNCLASSIFIED

Red Diamond

Prizrak Brigade is also known as the Ghost Brigade and the 14th Battalion of Territorial Defense. The unit was established in late 2014 after pro-Russian protesters occupied government buildings in Luhansk. It began as a platoon-sized unit, but in August 2014 became a battalion as the number of fighters grew to 1,000. The unit fought in the battle of Debaltseve. The original commander, Aleksey Mozgovoi, was killed in an improvised explosive device and gun attack on 23 May 2015 along with a number of his bodyguards, his press secretary, and three civilians.29 The current commander is Yuri Shevchenko, a former Soviet Army officer. Unit members are from Russia, US, Syria, France, Serbia, Spain, Italy, Slovakia, and the Balkans. The primary military activities include battlefield reconnaissance, sabotage, covert assault, and other intelligence activities. It is the only military unit operating 30 under both the “republics” in the NAF. This unit has been accused of serious Figure 14. Yuri 31 human rights abuses against both civilian and military prisoners. Current Shevchenko strength is estimated at 2,000 fighters. Russian Orthodox Army (ROA) is composed of radicalized fundamentalists calling for a crusade to restore Ukraine to Russia. The commander, Nikolay Verin, also known as “Kerch,” claims 4,000+ members that specialize in intelligence operations, building seizures, and defense missions. This unit 32 operates primarily in Donbass. According to Verin, weapons are in short supply, so “the first aim for the fighters is to capture weapons in battle.”33 Figure 15. Russian ROA is known to kidnap, torture, and kill anyone other than Russian Orthodox Orthodox Army flag believers, including Ukrainian Orthodox, Roman Catholics, Greek Orthodox, God’s Church of Ukraine, Jehovah’s Witnesses, Seventh-day Adventists, and Muslim Tatars. It is closely aligned with Russian National Unity, an ultranationalist organization.34 ROA has also kidnapped journalists and members of the Organization for Security and Cooperation in Europe. Somali Battalion is also known as 1st Independent Battalion-Tactical Group and Ilovajskij Guards Motorized Rifle (Assault) Battalion. Somali is commanded by , also known as “Givi.” Somali is considered an elite unit in Donetsk, having fought major battles in Slavyansk, Ilovaisk, Donetsk airport, Figure 16. Somali and Debaltseve. The unit is made up of Russians, Battalion unit patch Belarussians, Uzbeks, Azerbaijanis, and Tatars. Its goal is to “protect our Russian lands.”35 Tolstykh is from Ilovaisk. Prior to Euromaidan, he served two years as a conscript in the Ukraine Army as a tank commander. He is now a colonel in the breakaway district’s armed forces.36 The battalion is organized

into three motorized infantry companies, a tank company, and an artillery battery. Figure 17. Mikhail Tolstykh Sparta Battalion is commanded by Arseny Pavlov, also known as “Motorola,” a former Russian naval infantry soldier. The unit fought in the battle of Ilovaisk and the second battle of Donetsk Airport. Figure 18. Sparta Pavlov once bragged about killing 15 Ukrainian prisoners of war.37 He is also Battalion unit patch “alleged to have deliberately killed Ihor Branovytsky, a soldier with Ukraine’s

260 UNCLASSIFIED

Red Diamond

81st Brigade.”38 As of September 2015, Pavlov was spotted fighting in Syria.39 Sparta maintains an internet magazine with photos and information on its soldiers. NAF calls Sparta Battalion a special reconnaissance battalion organized into two intelligence companies and a special purpose company. Zarya (Dawn) Battalion is part of the Luhansk militia. It is currently commanded by Andrei Ptarushev and originally commanded by now-head of the breakaway district , who has been sanctioned by the US Department of Treasury. Zarya includes Russian volunteers and eastern Ukrainians. In Luhansk, Zarya is the oldest Figure 19. Arseny and strongest unit due to its artillery component. Pavlov Zarya has been documented as using PMN-4 antipersonnel mines and M- 40 Figure 20. Zarya 62M antivehicle mines that were banned under the 1997 mine ban treaty. Battalion unit patch As of January 2015, Zarya Battalion had joined the official command structure of the district.41 Training Implications Use of these types of units in a training scenario would quickly become very complex and challenging. Sorting out the exact status of prisoners of war (POWs) alone would be difficult. The known foreign fighters on both sides come from Russia, Chechnya, France, Spain, Serbia, Sweden, Poland, Italy, Georgia, , Baltic states, Finland, Norway, Canada, Croatia, Slovenia, Czech Republic, Turkey, Romania, Germany (Margarita Zeidler) and at least one American on each side.42 Is this POW a legal combatant, illegal combatant, armed noncombatant, or a mercenary? If your unit captures an American, how is he to be treated? German Margaret Zeidler states she is a journalist, but carries a rifle. What is her status and how is she to be treated if captured? A unit would need to be well versed in Training Circular 7-100.3, Irregular Opposing Forces and current laws before attempting this. Scenario development with militia battalions complicates the battlefield operating picture. These units are essentially guerrilla units, but they are viewed through the legal lens of government association or not. Ukraine still does not define this conflict as a war, but as an antiterrorist operation (ATO). As a result, many pro-Ukraine units have been absorbed into the Ministry of the Interior instead of the Ministry of Defense. Many sources report police officers rather than soldiers doing the fighting. The US counterinsurgency experiences in Afghanistan and Iraq will help in this understanding, but some soldiers are going to be surprised and unsure of how to proceed when they learn their counterpart is in law enforcement rather than the military. Some of the units have not been absorbed into the formal government agencies on either side and still operate independently with their own goals and agendas. If the goal is to challenge US Army units with novel approaches based on real-world examples, the militia units of the Ukraine ATO are a good way to do it. DATE 2.2 is the required strategic setting for all training scenarios and provides numerous groups that can be adapted to the militia volunteer battalions operating in Ukraine. In Gorgas, there are separatist insurgents (Zabzimek Separatists, Zabzimek Irregular Forces, and South Ostremek Separatists) and guerrilla units (People’s Liberal Republican Martyrs Group and the Falcon Brothers). In Limaria there are the Limarian Liberation Front and the Free Lower Janga Movement. In Atropia, there are Salasyl and the South Atropian Peoples’ Army, which operates multiple guerrilla brigades as part of its insurgent organization. The Bilasuvar Freedom Brigade operates in both Atropia and Donovia. Scattered

261 UNCLASSIFIED

Red Diamond

throughout DATE 2.2 are smaller potential separatist organizations that could be added into training scenarios. The number, type, and capabilities will be driven by the commander’s training objectives. Conclusion Actors participating in the Ukraine ATO fit the US definition of a hybrid threat found in Training Circular 7-100, Hybrid Threats. Regular forces, irregular forces, and criminals all working on their own agendas; sometimes together, and sometimes not. Tactics and techniques vary with each unit. Tier 1, 2, 3, and 4 weapons are used on both sides. Some of the units and commanders may be subject to sanctions by multiple countries and entities. Some of the units are financing their military activities with criminal activities while others are financed through oligarchs. And there are the larger strategic implications of direct conflict between Russia and European countries if major mistakes are made and the fighting escalates into a war. Despite the current ceasefire, at least one separatist soldier dies every day fighting in Donetsk.43 Civilians in eastern Ukraine were killed in record numbers in June 2016.44 The US is dedicated to supporting Ukraine in improving its warfighting capacity. That includes the addition of pro-Ukrainian militias into either the National Guard or the Ministry of the Interior while adhering to the restrictions of the Leahy Amendment. US military involvement is highly restricted and subject to interagency coordination with the Department of State and the Central Intelligence Agency. Some pro-Ukraine volunteer battalions will not be trained by the US. Even the Ukraine Land Forces do not support all the volunteer battalions, and do not include any of them in sniper training.45 The concern over Russian aggressiveness has triggered the latest North Atlantic Treaty Organization plans, including the formation of multinational battalions in the eastern part of the alliance: Canada to Latvia, Germany to Lithuania, the United Kingdom to Estonia, and the US to Poland.46 The US Army already knows Russian military doctrine and is watching how it is applied in eastern Ukraine. However, ACE-TI believes the techniques used would be shifted drastically if the US were to insert itself into a combat role. The organization strongly cautions against attempting to replicate the Ukraine-Russia fight exactly in training scenarios, the US Army is not the Ukrainians, and the Russians would not fight in the same way. They would adapt to challenge US strengths and exploit US weaknesses. For example, many of the separatist artillery units appeared to be arranged and employed using the old Soviet doctrine of regimental artillery groups (RAGs) and division artillery groups (DAGs). These were especially effective in the Debaltseve “cauldron” when the Ukrainian forces were surrounded. One separatist artillery commander boasted of destroying three Ukrainian batteries per day of 8, 10, and 12 guns each.47 This was possible because the Ukrainians had no counterfire capability, such as AN/TPQ-36 and AN/TPQ-37 Firefinder radars, or air supremacy.48 The separatists were using Russian PRP-3/PRP-4M sensor vehicles to locate Ukrainian artillery units, and then blasting them with massed tube artillery and rocket fire. American counterbattery assets provide real-time information and the ability to locate and destroy enemy artillery using indirect fire systems and close air support. Opposing forces placing artillery in a RAG and DAG formation, as used in eastern Ukraine, against US forces would cause the former catastrophic losses and would not be realistic training. The Ukraine scenario is unique based on the operational environment Moscow perceived, and would not be replicated identically in the future. Roger McDermott, Senior International Research Fellow at the Foreign Military Studies Office, states: The extent to which Moscow could facilitate, let alone control, the destabilization of south-eastern Ukraine depended on a number of factors unique to the operational environment. These included close historical ties between the countries, a large part of

262 UNCLASSIFIED

Red Diamond

the local population sympathetic to the separatist cause, corruption within the Ukrainian state system and the defense and security structures, intelligence penetration, the difficulty of ensuring control over the border, the limited combat capability of its armed forces, the political crisis that swept the existing regime from power and brought the fledgling government to office struggling to establish its own legitimacy across the entire country, among other factors. In short, the broad factors that served to facilitate the relatively rapid and peaceful seizure of territory – such as the location of Russia’s largest foreign military base, or the relative ease with which Russia could deploy additional forces without causing undue alarm – are not only unique to Ukraine, but would be extremely difficult to replicate beyond this single example.49

References

Associated Press Archive. “Commander of Vostok battalion near Donetsk says his troops are protecting Ukraine by fighting government.” YouTube. 4 August 2015. Carroll, Oliver. “Welcome to the Cossack People's Republic of Stakhanov.” Politico. 2 November 2014. Ferguson, Jonathan and N.R. Jenzen-Jones. “Raising Red Flags: An Examination of Arms & Munitions in the Ongoing Conflict in Ukraine.” Armament Research Services Research Report No. 3. November 2014. Fitzpatrick, Catherine A. “Russia This Week: Is ‘Novorossiya’ Really Dead?” The Interpreter. 22 May 2015. Gayle, Damien. “Chechen Muslim 'Death Battalion' joins Russia's war in Ukraine.” UK Daily Mail. 10 December 2014. Gordon, Michael R. and Andrew E. Kramer. “Scrutiny Over Photos Said to Tie Russia Units to Ukraine.” New York Times. 22 April 2014. Headquarters, Department of the Army. Training Circular 7-100.3, Irregular Opposing Forces. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. 17 January 2014. Headquarters, Department of the Army. Training Circular 7-101, Exercise Design Guide. TRADOC G-2 Analysis and Control Element (ACE) Threats Integration. November 2010. Hill, Fiona. “Hybrid war: The real reason fighting stopped in Ukraine – for now.” Reuters. 26 February 2015. Kazzura. “1st Slavyansk battalion mobilization ad.” YouTube. 21 November 2014. Kazzura. “1st Slavyansk Brigade "Vikings" Combat Footage.” YouTube. 1 July 2015. Kazzura. “Givi & Motorola Talk to Captive UAF Colonel.” YouTube. 20 January 2015. Kazzura. “NAF ‘Vikings’ battalion platoon tactical training.” YouTube. 15 April 2015. Kim, Lucian. “The Battle of Ilovaisk: Details of a Massacre Inside Rebel-Held Eastern Ukraine.” Newsweek. 4 November 2014. Milkavkaz. “The armed forces of the DNI and LC.” Milkavkaz.net. 24 July 2016. Oliphant, Roland. “Ukraine dispatch: Burnt out tanks and ashes of APCs on journey through no-man's land.” The Telegraph. 2 September 2014. Owen, Ruth. “Ukraine: The Unseen Attacks – Ukraine’s Armed Forces, International Version.” Defense Video & Imagery Distribution System. 14 July 2015. Salem, Harriet. “Order from Chaos: Moscow’s Men Raise a Rebel Army in Ukraine’s East.” Vice News. 4 June 2014. Seeker Stories. “The Night Wolves: Putin’s Personal Motorcycle Gang.” YouTube. 18 November 2015. Sheldon, Michael. “The DPR MoD – an assessment.” Danger Zone. 30 January 2016. Sheldon, Michael. “No, Mariupol is not in danger.” Danger Zone. 30 July 2015. Tsulaia, Jambul. “Real Talk with Russia’s Fake Super Soldier.” The Daily Beast. 29 March 2015. Tsulaia, Jambul. “As Ukraine Murders Multiply, Who’s the Lead Suspect?” The Daily Beast. 5 May 2015. Ukraine War. “Heavy Combat Action in Battle for UA Checkpoint.” YouTube. 27 October 2015. Ukraine War. “Battle of Ilovaisk - Ukrainian Forces in Heavy Intense Fightings.” YouTube. 27 October 2015. UN News Centre. “UN report finds impunity for killings ‘remains rampant’ in Ukraine conflict.” 14 July 2016. Unian. “Suspended OSCE Monitor Confirms He’s Russian GRU Officer.” 27 October 2015. (Link is not accessible from a US government computer.) Walker, Shaun, Oksana Grytsenko, and Leonid Ragozin. “Russian soldier: 'You're better clueless because the truth is horrible'.” The Guardian. 3 September 2014. War Clashes. “Battle of Debaltseve - Ukrainian Forces in Heavy Intense Clashes | War in Ukraine.” YouTube. 26 October 2015. Watchdog Media Institute. “Roses Have Thorns (Part 14) The Siege of Slavyansk III.” YouTube. 3 February 2015. (18–28 June 2014).

263 UNCLASSIFIED

Red Diamond

YouTube. “Ukraine War - Pro-Russian separatists militia storms the Donetsk Airport.” 3 October 2014. (Video no longer available.).

Notes

1 David J. Meadows, PhD. “Understanding Russia’s Proxy War in Eastern Ukraine.” Security Sector Reform Resource Centre. 12 August 2014. 2 News from Ukraine. “Interrogation of Russian soldier #3 captured in Ukraine on August 25.” YouTube. 27 August 2014. 3 Olga Tsukerman. “Who is Olga Kulygina?” Real Reporting.org/NewsLanc.com. 6 October 2014. 4 Matthew Dean and Catherine Herridge. “'Patriotic hackers’ attacking on behalf of Mother Russia.” Fox News. 16 January 2016. 5 European Union. Council Decision (CFSP) 2015/241 of 9 February 2015 amending Decision 2014/145/CFSP concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine. Publications Office of the European Union. 9 February 2015. 6 Michael Sheldon. “Diesel to fuel the fire.” Danger Zone. 27 July 2015. 7 Ukraine War. “Apti and Timur- Chechen volunteer battalion arrived in Donetsk People's Republic.” LiveLeak. 12 November 2014. (Link is not accessible from a US government computer.) 8 Shaun Walker. “We like partisan warfare. Chechens fighting in Ukraine – on both side.” The Guardian. 24 July 2015. 9 Shaun Walker. “Putin should unleash Chechen troops on Isis, says region's president.” The Guardian. 2 October 2015. 10 Pavel Polityuk and Richard Balmfort. “Pro-Ukraine Fighters Escape Encirclement, Others Still Trapped.” Reuters. 30 August 2014; Andrew Roth. “A Separatist Militia in Ukraine With Russian Fighters Holds a Key.” The New York Times. 4 June 2014. 11 Armin Rosen. “The Ukraine Crisis Is Entering a Dangerous New Phase.” Business Insider. 5 June 2014. 12 Vice News. “Meet the Texan Fighting for the DPR: Russian Roulette (Dispatch 107).” YouTube. 23 April 2015. 13 Patrick Jackson. “Is Russia Orchestrating East Ukraine Violence?” BBC News. 30 May 2014. 14 BBC News. “UAE Jails Two Over Dubai Killing Of Chechen Commander.” 12 April 2010. 15 Beale, Jonathan. “Ukraine Conflict: High Stakes in Donetsk.” BBC News, 5 August 2014. 16 YouTube. “Chechen Fighters in Ukraine-Nohchi Cho.” 27 August 2014. (Video no longer available.) 17 Amnesty International. “Breaking Bodies: Torture and Summary Killings in Eastern Ukraine.” 2015. Pg 18. 18 The Jamestown Foundation. “The Cossack Factor in Ukrainian War.” 13 August 2014. (Link is not accessible from a US government computer.) 19 Simon Shuster. “Meet the Cossack ‘Wolves’ Doing Russia’s Dirty Work in Ukraine.” Time Magazine. 12 May 2014. 20 Radio Free Europe/Radio Liberty. “Separatist Cossack Commander Reported Killed In Ukraine's Luhansk.” 12 December 2015. 21 Ukraine War. “Kalmius Brigade Working the Debaltsevo Pocket.” YouTube. 9 February 2015. 22 Ukraine Today. “Firing Continues in Mariupol: ‘Kalmius’ Battalion and Russian Volunteer Army Fire at Mariupol.” YouTube. 3 February 2015. 23 War in the Donbass. “Russian neo-Nazi “Kornilovtsy” battalion operating in Ukraine.” . 27 August 2014. 24 Journeyman Pictures. “The Kremlin’s Wolves: Putin’s motorbiking militia of Luhansk.” YouTube. 2 February 2016. 25 Bureau of Democracy, Human Rights, and Labor. “Ukraine 2014 Human Rights Report.” US Department of State. Pg 14. 26 Bureau of Democracy, Human Rights, and Labor. “Ukraine 2014 Human Rights Report.” US Department of State. Pg 19. 27 Kazzura. “Interview with Female NAF Officer Gaika.” YouTube. 13 October 2014. 28 Falcon Bjorn. “The Lost Legion: Tanks of the Oplot Battalion.” Inform Napalm. 6 March 2015. 29 Oliver Carroll. “Ukraine crisis: The last days of Aleksey Mozgovoi, rebel hero of the 'Ghost' battalion - killed in an ambush.” The Independent. 24 May 2015. 30 Slavyangrad.org. “Interview with Yuri Shevchenko, Prizrak Brigade Commander.” 10 November 2015. (Link is not accessible from a US government computer.) 31 Amnesty International. “Breaking Bodies: Torture and Summary Killings in Eastern Ukraine.” 2015. Pgs 6, 9, 12, 13, 30–31. 32 Paul Goble. “Russian Orthodox ‘Fundamentalists’ Radicalizing Secessionists in Ukraine.” The Interpreter. 3 July 2014. 33 Albina Kovalyova. “Meet the Russian Orthodox Army, Ukrainian Separatists’ Shock Troops.” NBC News. 17 May 2014. 34 Агеєв. “Russian Orthodox Army – a case of ‘Russian World’ implementation.” Axamot.org. 9 January 2015; Daniel Wiser. “Russia Targets Christians, Religious Minorities in Ukraine.” The Washington Free Beacon. 15 October 2015. 35 News-Front. “Donbass Under Fire. Film 10th: ‘Unbowed’.” YouTube. 17 September 2015. 36 Alexander Litoy. “The “Heroes of Novorossiya”: Where Are They Now?” Open Democracy. 2 March 2016. 37 Oleg Sukhov. "Russian fighter's confession of killing prisoners might become evidence of war crimes (AUDIO).” Post. 6 April 2015. 38 Amnesty International. “Breaking Bodies: Torture and Summary Killings in Eastern Ukraine.” 2015. Pgs 5–6, 15–16. 39 Jeremy Bender. “One of the Russians seen fighting in Syria is a well-known militia leader from the Ukraine conflict nicknamed 'Motorola'.” Business Insider. 28 September 2015.

264 UNCLASSIFIED

Red Diamond

40 Human Rights Watch. “Landmines in Ukraine: Technical Briefing Note.” April 2015. Pg 7. 41 PiX Today. “Zarya Battalion.” PiX Ukraine. Accessed 27 May 2016. (Account required.) 42 PiX Today. “Foreign Fighters in Ukraine.” PiX Ukraine. Accessed 31 May 2016. (Account required.) 43 PBS NewsHour. “Fault Lines.” YouTube. 5 July 2016. 44 UN News Centre. “UN warns of escalating tension in eastern Ukraine as casualties hit highest since last August.” 3 August 2016. 45 Ukraine Today. “Ukraine’s Snipers: The Deadliest Men in Country’s Hybrid War with Russia.” 13 July 2015. 46 Jim Garamone. “NATO Secretary General: Alliance to Send Multinational Battalions Eastward.” US Department of Defense. 8 July 2016. 47 Kazzura. “Debaltsevo cauldron sealed.” YouTube. 10 February 2015. 48 This was true during the battle for Debaltseve. However, in October 2015, the US announced it would deliver “non-lethal” aid in the form of AN/TPQ-36 counter-battery radars. Ukraine Today. “US Non-Lethal Aid for Ukraine: Ukrainian President welcomes delivery of 'counter-battery systems'.” YouTube. 6 October 2015. 49 Roger N. McDermott. “Does Russia Have a Gerasimov Doctrine?” US Army War College Quarterly. Spring 2016. Pg 104.

______

265 UNCLASSIFIED