Ch. 5 Evaluate the Threat

• Step 3 of the Intelligence Preparation of the Battlefield (IPOE) process involves evaluating the threat

What is threat evaluation?

• It identifies threat force capabilities, doctrinal principles, and tactics
• It addresses potential threats that create dilemmas for U.S. maneuver forces
• These threats may use a combination of regular, irregular, terrorist forces, and criminal elements, employing both traditional and nontraditional tactics

Threat Adaptation and Modernization

• Over the past three decades, potential adversaries have studied and adapted to U.S. military deployment and operational methods
• Some have modernized and developed capabilities to counter U.S. advantages in air, land, maritime, space, and cyberspace
• Nations such as Russia, China, North Korea, and Iran exemplify this evolving threat, making understanding threat capabilities crucial for Course of Action (COA) development

Threat Operations in Indeterminate Zones

• Threats increasingly operate in an indeterminate zone between peace and war
• They avoid direct confrontation with U.S. strengths
• They exploit U.S. laws, policies regarding information and cyberspace capabilities
• They capitalize on reluctance to engage in major combat
• They achieve incremental gains by using nonattribution, innuendo, propaganda, disinformation, and misinformation to influence global opinion

Definition of a Threat

• A threat includes actors, entities, or forces with the capability and intent to harm U.S. forces, national interests, or the homeland
• It encompasses paramilitary or military forces, nation-states, alliances, individuals, organized groups, or conditions that can damage life, resources, or institutions

Peer Threats and Readiness Requirements

• The Army is required to operate across the range of military operations
• Large-scale ground combat against a peer threat is the most significant readiness requirement
• Peer threats are adversaries with capabilities to oppose U.S. forces across multiple domains worldwide or in specific regions with relative advantage
• They possess roughly equal combat power in geographical proximity to conflict areas
• They may have cultural affinity, providing advantages in time, space, and sanctuary:
• Presents tactical, operational, and strategic challenges greater than those faced since the end of the Cold War

Strategies of Peer Threats

• Peer threats employ strategies capitalizing on capabilities to achieve objectives, preferring to avoid direct engagement with U.S. forces in combat
• They employ information warfare combined with conventional and irregular military capabilities
• They aim to weaken U.S. resolve and exploit sensitivity to world opinion, plus American domestic opinion and casualties
• They believe they have a comparative advantage through willingness to endure hardship, casualties, and negative public opinion

Resource Deployment of Peer Threats

• Peer threats deploy resources across multiple domains to attack U.S. vulnerabilities
• They use capabilities to create lethal and nonlethal effects
• They use national elements of power to undermine U.S. power
• The methods include information warfare, preclusion, isolation, sanctuary, and systems warfare
• During combat, they inflict significant damage across multiple domains and delay forces to achieve goals before culmination

Threat Classifications

• The Army categorizes threats into regular, irregular, and hybrid threats

Regular Threats

• Regular threats from peer competitors in all domains are considered multi-domain threats
• Multi-domain threats may only have power in the military or economic elements
• They use undemocratic institutional constraints, realpolitik, and cyberspace capabilities to overmatch U.S. forces in diplomacy and information

Peer Threat Objectives

• Peer Threats want to reduce the ability of the United States to achieve dominance in the air, land, maritime, space
• They apply technology across domains to disrupt U.S. advantages in communications, precision munitions, movement, maneuver and surveillance
• Army forces cannot always depend on an advantage in technology, communications, and information collection

Proxy Forces and Historical Conflicts

• To capitalize on perceived U.S. and ally vulnerabilities, peer threats may use nation-states to establish proxy forces to act on their behalf
• Historic conflicts that illustrate proxy capabilities include the Ukraine crisis (2014), the Syrian Civil War (2011), the Korean War (1950-1953), and the Nicaraguan Civil War (1979-1990)

Irregular Threats

• Irregular threats employ unconventional methods to counter U.S. advantages
• A weaker threat uses unconventional methods to exhaust the U.S. collective will
• Unconventional methods include terrorism, insurgency, and guerrilla warfare
• Economic, political, informational, and cultural initiatives accompany irregular attacks
• Hamas and al-Qaida are examples of irregular threats

Characteristics of Irregular Threats

• Diverse capabilities that change rapidly, outpacing military acquisitions
• Analysis of threat capabilities must therefore be continuous
• They exploit commercially available technology and cyberspace
• They can use cyberspace to influence global and specific audiences

Irregular Threat Classifications

• Drug cartels; nationalist, antireligion, and political orgs
• Foreign terrorist orgs, transnational criminal orgs, and insurgencies
• Militant activists
• These have different varying capabilities and objectives, rooted in financial gain, power, political change, or governmental policy changes

Hybrid Threats

• Hybrid threats combine regular, irregular, terrorist forces, or criminal elements to achieve mutually benefitting effects
• They seek shared or separate purposes, objectives, or any combination

Hybrid Threat Example

• Country A uses Country B's military to achieve a political objective and maintain deniability of its involvement
• Country A supports Country B's military by using a smuggling network to transport weapons, supplies, and cash
• Country A compensates Country B for its actions by lowering tariffs on imports
• The smugglers have no concern for politics or national objectives; their only concern is financial

The hybrid threat and the IPOE

• The term captures the complexity of operational environment
• Highlights the variety of actors involved and the blurring of traditional elements of conflict
• Adds complexity to evaluating irregular threats where the regular threat may seek to stay below the state of armed conflict

IPOE Success and Failure

• Success: Threat COAs developed reflect what the threat is capable of and trained to do otherwise
• Failure:
  • Staff may lack the intelligence needed for planning
  • Threat may surprise friendly forces with unaccounted for capabilities
  • Staff may waste time and effort planning against nonexistent threat capabilities
  • Friendly force's ability to exploit threat vulnerabilities may be degraded

IPOE Process Substeps

• Identify threat characteristics
• Create or refine threat models
• Identify threat capabilities

Identifying Threat Characteristics

• Includes composition, disposition, strength, combat effectiveness, doctrine, support, electronic technical data, capabilities, historical data, current operations, and miscellaneous data

Understanding Threat

• Based on intelligence staff research and analysis of the threat characteristics
• Considers composition, disposition, strength, combat effectiveness, doctrine, support, electronic technical data, capabilities, historical data, current operations, and miscellaneous data
• The intelligence staff ensures this understanding is complete as possible and considers how:
• Threat characteristics form a framework for consistent evaluation of any force
• Threat characteristics evaluation framework is adapted to the threat mission and unit's needs
• Maintained files are sources of info
• Threat characteristics are analyzed as a whole

Warfare Principles and Problem Solving

• Threat forces have differences in approaching situations and problem solving than friendly forces

IPOE Process

• Intelligence staff identifies/defines each individual threat within the commander's Area of Interest (AOI)
• Analyzes the characteristics associated with each of these threats and then develops them

Composition

• The identification and organization of a threat, describing how it is organized and equipped
• Understanding is essential in determining the:
  • Threat's capabilities and limitations
  • Assists in developing threat COAs and friendly counteractions
  • Assists determining a threat's combat effectiveness and conducting combat assessment

Regular Threats

• Are normally self-identified and organized similar to friendly forces

Irregular Threats

• Follow similar rules but are mostly cellular-based
• The staff uses line and block chart products to depict the threat's composition

Command and Control

• The organization is commanded and controlled
• Military forces follow a linear chain of command
• Irregular forces use a decentralized chain of command unique to the area of conflict

Disposition

• Refers to how threat forces are arrayed on the battlefield, including recent, current and projected movements or locations of tactical forces
• Essential in developing threat models in IPOE and threat situation templates

Strength

• Describes a unit in terms of personnel, weapons, and equipment
• Information concerning strength provides commanders with an indication of threat capabilities
• Assists determining options open to threat commanders

Combat Effectiveness

• The readiness of a military unit to engage in combat based on behavioral,operational, and leadership considerations
• Unit's abilities and fighting quality

Doctrine and Tactics

• Includes tactical doctrine as employed by specific units. While tactical doctrine refers to the threat's accepted organization and employment principles, tactics refer to the threat force's conduct of operations
• The intelligence staff can determine how the threat will employ it's forces based on threat's tactical doctrine. They integrate tactics into threat templates

Electronic Technical Data

• Required to conduct EW, and is derived from cyberspace electromagnetic activities, signals intelligence (SIGINT), and measurement and signature intelligence
• Includes data emitter type and nomenclature, modulation, multiplex capability, pulse duration, pulse repetition frequency, bandwidth, associated weapon systems, other technical characteristics of electronic emissions.
• SIGINT personnel develop the overlay and require targeting as well the EW staff's assistance and input

Adoption of a COA and Support Systems

• A threat's adoption should depend on it's support system ability to support that action.
• Analysts can better evaluate threat's combat effectiveness, strength and capabilities with knowledge of these factors.
• Includes current operations operations where an enemy force is currently engaged

Capabilities and limitations of threats

• Broad COAs and supporting operations that the threat can take to achieve it's goals and objectives
• Attack, defend, reinforce and retrograde, etc.

Historical Data in Threat Evaluation

• Compiling the history of any threat organization involves conducting the research necessary to gather all relevant information
• Producing briefs related to: intelligence training, officer professional development, and noncommissioned officer professional development
• The history component of the threat file includes the sources of information used to compile intelligence briefs

Biographic and Personality Data:

• Data contains information on characteristics and attributes of a threat's members
• Personality profiles: strategic personality assessments of leaders of tactics

Intelligence Analysis

• It uses:
• Leadership traits (political, ideological, religious, military, and other leaders)
• Staff Members
• Spokespeople
• Family Members
• Experience and skill training in professional disciplines, trades, and specialties
• Media manipulation personnel
• Trainers
• Code names and nicknames :
• Analysts use personality files to link analysis, determine relationships and assess loyalties, political data, and interests

Biometric and Forensic Data:

• Establishing the identity, affiliations and authorizations of an individual, denying threat anonymity, and protecting facilities and forces

Identity Intelligence:

• Valuable intelligence can and has been analyzed from decisions to differentiate one person from another in order to support decision making. Identity activities include the production of identity intelligence

Internal Organizational Processes

• An organization's flexibility or rigidity is a key determinant of its strengths and vulnerabilities. To estimate an organization answers a variety of ?'s
• Members viewed as contributors or as potential competitors?
• How do organizations replace leader and cadre casualties?
• How are policies adjusted and adjudicated through violence and dialogue?

Creating Threat Models

• Threat Models
• Accurately portray how threat forces normally execute an operation, and how they have reacted to similar situations from information in various databases.
• Higher agencies and organizations create some threat models or if a threat emerges, analysts must develop threat models and refine information for the best most accurate depiction of a threat and operations

Analyzing and Converting Data to Graphics

• Involves:
• Converting Doctrine or patterns of operations to create graphics (threat template.)
• Describing threat's tactics, and options in a graphical nature Identifying high-value targets among threat models

Threat Templates

• Threat templates are tailored to the needs of the staff creating them.
• For example, a G-2 section's threat template differs in scope from a brigade S-2 section's template

Analysis

• Analysts access and analyze information and evaluate past ops how a threat normally organizes combat and how it deploys and employs its forces, and looks for patterns on how the threats organize forces

Describing Peculiarities and Options

• Analyze the threat's preferred tactics, options, and peculiarities with a description of the threat's preferred tactics
• Can include descriptions of threat capabilities, branches, or sequels
• Analysts also examine timelines and phases of the operations because target values may change from phase to phase

High Value Targets and analysts

• Identifying high-value targets analysts assists in supporting operations/actions
• Analysts determine goals threat is trying to achieve and research and make note of any threat peculiarities related to the operation.

Identifying High-Value Techniques:

• To identify a HVT includes Intelligence Studies based on activity etc Reports, Patrol Debriefs, the template and its associated threats, and to review the previous Ops.
• HVTs usually all fall within non-maneuver elements like Intelligence and fires consider assets that are key to executing the primary operation or sequels
• Determine how the threat might react to losing each HVT, considering threat’s substitutions and consider war gaming and think through which assess threat assets use most

Identification of High Value

• To identify valuable assets Analysts group the type of assets that are of high value and what kind the assets come: C2, movement, fire power intelligence etc

Time Event Chart

• To see how a group the threat Analysts create charts to see how the threat does things across time. They add what actions are needed for each situation

Target Value Analysis:

• HVTs should be prioritized of their relative value – This target value analysis support for efforts, provides a focus for the commander's target acquisition effort, identifying priorities for the engagement, and identifying effects criteria
• The IPOE supports
• the template,
• the HVT,
• threat capability statement
• the staff in providing the right effort

Conventional Capabilities"

• Military assets employed by states in identifiable formations, governed by laws, military traditions and follow customs

Irregular Capabilities"

• Employing Unconventional Method including the employment of asymmetric ways to take out America Irregular capabilities. Irregular Capabilities take it further by making it impossible for the US political to fight on.

Disruptive Capabilities"

• Involve the technology to reduce advantages they are designed to give threat advantage
• Wepons of Mass Destruction capabilities – Likelihood of the threat's use of WMD increases

Other Identified Threat and Analysis

• Identify threat capabilities by using these statements, and support to COA and types of various operations Most situations don’t present ideal conditions so treat actual capabilities don’t mirror threats

Questions address evaluating foreign military equipment, countermobility systems, obstacle emplacement, weapon systems, and threat assessment emphasizing logistical support, operational range, and effective fire support in combined arms operations.