Trying to Work Smarter: Fusion Tools for a Small SOF TF Staff
By: Major Awe , Army Special Forces
A new buzz phrase is circulating among SOF planners and operators these days: operation and intelligence fusion. The goal is for the operations and intelligence sections to work together more closely; become better integrated; and feed off each other's thinking, ideas, and processes to produce better outcomes. Military operations in Afghanistan and elsewhere have matured over the last decade into police-led operations to disrupt and degrade insurgent and criminal networks. As a result, the International Security Assistance Force (ISAF) staffs have needed to "work smarter" in order to develop a concept of operations (CONOPS) and get approval from higher authorities, as well as respond to numerous requests for information and reports. Naturally, this puts a lot of strain on the staff: how can a small SOF staff create an operation-intelligence fusion environment, along with an approach that facilitates the development and direction of intelligence-led policing operations?
Small SOF task forces (SOF TFs or simply TFs) typically don't have enough staff to handle all of the training and mentoring needs, as well as the targeting efforts and the execution, required by such police operations. Normally, these operations have been driven from the bottom up, and the demand from higher headquarters was for a high operational tempo. As the police forces took responsibility for local security from the military, warrants and evidence were introduced to execute arrest and search operations according to law. Fulfilling these kinds of legal requirements was also an important means to educate the police force and judicial system. As a result of this shift, the TFs needed to better manage the balance between training, mentoring, and operations. TF mentoring teams, together with partner units from the local police and representatives of the judicial system, tried to build a workable and sustainable judicial system led by intelligence. Warrants and evidence became prerequisites to prosecute a target or conduct an operation.
This article shares a best-practice model for operations and intelligence fusion and uses a case study to describe how a small-nation SOF TF might apply an operation-intelligence fusion plan that combines military planning and processes with a law enforcement mindset. It describes a simple model of the Commander's Critical Information Requirement and a "fusion tool" in the form of a pie chart that can be used by the planning staff to assess, plan, and direct resources for both intelligence operations and strike operations.1
Evidence-Based Operation in Afghanistan
The following vignette illustrates the relationship between a particular ISAF SOF task force and the Afghan provincial response company (PRC) it mentored and trained between 2009 and 2012. In support of the local prosecutor, the PRC contributed to a forensic database of IED components and types that eventually supplied the prosecutor with sufficient evidence to identify and convict several bomb makers.
The Relationship and Tasks
The SOF TF staff of seven officers, including specialists in operations, intelligence, logistics, and communications, had been working with a SWAT-like PRC for over four years. The PRC functioned as a crisis response unit in addition to conducting deliberate arrest and search operations. A mutual process for quick reaction operations (with a standard notification to move in 15 minutes) allowed the TF to launch immediately with the PRC. The ISAF regional commander, the regional command staff, and the battle space owner, along with the Afghan chain of command (including the prosecutor) were notified at the same time.
Although the PRC was almost fully operationally capable when it was directed to undertake the operation described below, the TF had assigned two advisors and mentors to each of the three PRC platoon leaders. Moreover, the TF ground force commander advised the PRC company commander, while the SOF TF commander advised and assisted the provincial chief of police in the use of the PRC. The local situation also called for some "mission creep": the provincial prosecutor needed support to carry out his duties, so the SOF TF helped him with training and education in the rule of law as well as with matters regarding the use of evidence.
Deliberate operational planning was initiated sometimes by the Afghan partner and sometimes by the SOF TF. Over time, both the PRC and the provincial police chief had begun to initiate investigations and launch arrest operations and even conduct unilateral operations with minimum oversight by the SOF TF. The deliberate planning process followed ISAF's normal standard operational procedures to get CONOPS approval. Three to four operations per week, including quick responses, were the norm.
By the summer of 2009, the Explosive Ordnance Disposal, Improvised Explosive Device, and Weapons Intelligence sections of the ISAF Provincial Reconstruction Team (PRT) in the province had started to collect data about IEDs for a database, at a time when insurgents had started to use IEDs more frequently. These sections and the explosives experts in the PRT had been working closely with other centralized anti-IED sections within ISAF to build cases for and increase knowledge about the IED threat. The building of this database became a key factor in their later success.
In the early fall of 2009, the PRT conducted a company-sized operation in a village in one of the province's problem areas. The team secured IED components and other evidence and sent it all in to be analyzed against the database. Unfortunately, there was no match, but the database, which was about two years old at the time, was updated with the new data. This process had by now become standard protocol, and occasionally a match was found that connected an individual to a device, but only rarely could the specific insurgent or IED maker be fixed at a certain time and place.
Several weeks later, the SOF TF, working very closely with the fusion cell at the regional command headquarters, as well as with the PRT's intelligence section and other units, identified three suspected insurgents and IED facilitators in the same area where the PRT's infantry company usually operated. The Afghan provincial prosecutor had already issued warrants for two of the three suspects. The third individual's warrant was in process but not ready to be executed. One of the suspected insurgents was considered more of a priority, but the TF could not make a positive identification (PID) because they had only a vague physical description of him. The homes of the three suspects were known, down to the exact house; they were known to be part of the same network; and they went regularly to evening prayers in the village mosque. But the men themselves were not fixed—there was other information suggesting that the pattern of life (POL) of each insurgent had not been confirmed. The prosecutor had firm evidence on the second most important suspect, Suspect Y, but neither he nor the police as a whole, including the National Directorate of Security in the province, had such firm evidence on the other suspects. The prosecutor wanted the three men arrested anyway. (See figure 1 for a depiction of the target set. The use and development of the pie chart is explained later in the article.)
ISAF intelligence confirmed that all of the suspects were part of an insurgent IED network. Everybody wanted Suspect X arrested because he was believed to be a network leader and was therefore the top priority. The prosecutor had issued a warrant for his arrest, according to the judicial process at the time. The SOF TF were not too concerned by the fact that evidence for Suspect X was missing; from their point of view, it was more likely that they and the PRC would be able to find, fix, and arrest Suspect Y because they had more information, including evidence from the prosecutor and likely also from the PRT. It was easier for the PRC and the TF to identity Suspect Y than the others, and he was also considered easier to track once he had been found and fixed. The SOF TF, as a norm, used the CARVER matrix—criticality, accessibility, recuperability, vulnerability, effect, and recognizability—to assess the target or target system.3 Suspect Y thus became the priority for the PRC, as well as the SOF TF at the time, based on recognizability. Both the PRC and the SOF TF believed, however, that if they could arrest Suspect X, it would have much more of an effect on the IED threat network.
The deliberate planning of the operation went ahead, and it was eventually authorized from the regional command level, as well as from the Afghan provincial chief of police. Because of the shortage of rotor-wing assets and intelligence, surveillance, and reconnaissance (ISR) support, such operations were usually time-based instead of trigger-based. The staff therefore estimated a time window by assessing the patterns of the suspected insurgents' movements.
Execution and Dry Hole
Right on schedule, the PRC, along with the prosecutor and mentors and combat supporters from the SOF TF, landed on target in darkness. The use of rotor-wing aircraft was uncommon in this particular area and therefore contributed to the effect of speed and surprise. Suspect Z, the lowest priority of the three suspects, was the only one who was partially fixed at the time, following the criteria and processes used by the SOF TF. Notwithstanding, in a matter of minutes, Suspect Y's compound and other houses of interest were surrounded and searched following standard procedures and directives, which included the use of trained female Afghan police officers from the PRC. Seven Afghan men were found and held for identification using biometrics and physical description, but none was positively identified, so the prosecutor had to let all seven men go before the helicopters came to pick up the ground force and return them to base. Eventually, all the material the team had gathered in their search was systematically processed by various elements of the Afghan police, the SOF TF, and the PRT, as well as other ISAF organizations.
Exploitation and Breakthrough
After two weeks of analysis, a positive match came from a crime lab, which confirmed the identification of one of the seven men found on target and connected him with the IED component that had been found by the PRT earlier in the fall. Further research, however, also concluded that none of the seven was Suspect X, Y, or Z. This match belonged to a new suspect, Q, a previously unknown IED maker. The SOF TF now had everything it needed for a positive identification and a likely location, as well as confirmed evidence. Suspect Q and his likely whereabouts were known to the PRT troops and the infantry company's intelligence officer, so the TF went to them for more information on the suspect. Suspect Q quickly got a pie chart of his own, to help the staff visualize and focus on the efforts and directives that would be needed during the planning and preparation phase of this new arrest operation (see figure 2). It was very easy to get a warrant for Suspect Q's arrest, once the case and the evidence were processed and presented to the prosecutor. The TF's rule-of-law subject matter expert also made considerable efforts to ensure that the prosecutor understood the value of certain biometric evidence, something which was completely new to the prosecutor and the Afghan court in the province.
The findings, along with the intelligence and evidence to back them up, were released to the Afghans. Once again, the SOF TF staff worked to get the ISR and rotor-wing support the operation required, as well as the various CONOPS approvals. This time, however, the rotor-wing support was not available, and it would be too difficult and dangerous for the PRC and the SOF TF to go by armored vehicles into the IED-infested area where Suspect Q was believed to be.
As luck would have it, the PRT infantry company was ready to conduct a handover-takeover with an incoming company. The SOF TF staff urged their PRT counterparts to make sure that the handover took place in the targeted village, in order to both arrest Suspect Q and conduct a road-clearing and patrol mission. The Afghan PRC and the SOF TF—less than a handful of people at the time of the operation—were embedded in the company-plus–sized operation. After a couple of hours of conventional road clearing, the teams entered the village. Suspect Q was identified hanging around very near where the IEDs had been found, and where the PRC and the SOF TF had conducted their night operation weeks earlier, doing his business as usual while he observed the ISAF soldiers and local Afghan National Security Forces personnel. Suspect Q was arrested very smoothly and expeditiously by the Afghans, and was subsequently taken to police headquarters to be processed.
During the investigation and subsequent judicial processing of Suspect Q by the Afghan prosecutor, the Taliban shadow governor of the district called several times to insist that Suspect Q be released without trial. This had never happened before, so the prosecutor became even more insistent on prosecuting Suspect Q. During the process, the provost, the ISAF military police, and the rule-of-law experts from the SOF TF supported the prosecutor and police in their efforts to ensure a fair trial and fair treatment for Suspect Q. Eventually, Suspect Q was sentenced to 10 years in jail for acts of terrorism.
A Discussion of SOF Fusion
Counterterrorism organizations and units normally use a decision support template to make decisions, and to help them understand when there is risk involved and when they have actionable intelligence. The decision support template usually consists of a high-value (high-payoff) target list, named areas of interest, target areas of interest, time-phase lines, and decision points.4 This template is a product of the intelligence preparation of the operational environment or battlefield, and forms the foundation for a commander's decision making. This process and the products are well known and have been available for years. The question remains, however, whether the template can be as useful in a conventional police-led operation when the process and products have a focus other than terrorism or counterinsurgency.
A Decision-Making Model
Normally, the decision points are made up of what is known as the Commander's Critical Information Requirements (CCIR). The CCIR consists primarily of Priority Intelligence Requirements (PIR) and Friendly Forces Intelligence Requirements (FFIR). A PIR can be broken down into Specific Intelligence Requests, which can be broken down even further into Essential Elements of Information. Several elements of a Specific Intelligence Request might go into the PIR that the TF uses to positively identify a person behind an attack on coalition forces, including
- the person's physical description,
- the person's biometrics, and
- a recent photograph of the person.
The SOF TF had developed, over the years, a simple formula to enable more rapid decision making and also to push the level of decision making down to the operators as much as possible, to help maintain the initiative and tempo. The formula is: DP = CCIR = (PIR + FFIR). That is, the commander, or whoever has the authority, can make a decision based on information regarding the enemy and the enemy's condition set plus information regarding his own forces and their condition set. To support and further develop the results, the SOF TF used a formula similar to this: If (PIR) and (FFIR), then (DP) (see figure 3).
There can be several PIRs and FFIRs that go into a decision point, depending on the outcome of the planning and war gaming processes. The operations officer or section is responsible for developing information for their own or other friendly forces' FFIR. The intelligence officer or section is responsible for developing what the organization needs to know regarding the adversary—the PIR. This distinction is important because it normally takes longer to collect and estimate the enemy's condition and courses of action than it does to develop one's own courses of action. The operations section usually already has all the information it needs regarding its own forces, organization, equipment, and strengths and weaknesses compared to the enemy. Therefore, intelligence planning and preparation can be characterized by proactivity, foreknowledge, patience, and reflection.
The information and intelligence support the commander's decision making. Because this particular SOF TF normally consisted of a small staff, its team members developed another simple tool that would enable the planning and direction of their operation-intelligence fusion to be both creative and organized. This tool is, foremost, a matter of approach and mindset. It has become somewhat irrelevant within the TF to argue whether intelligence drives operations or operations drive intelligence. One way to settle this is to decide that intelligence drives the commander and the commander drives operations. The norm, if there is no consensus regarding intelligence collection, is that the intelligence officer has the final say on why and what, while the operations officer has the final say on how and when. It helps if the staff officers see themselves as combinations of operations/intelligence or intelligence/operations, depending on their primary function, rather than being categorized into stovepiped sections or functions.
Analysis of a Manhunt
The team developed a color-coded pie-chart tool to consolidate information and allow decision makers to have a common understanding and awareness of a target (see figure 4). The pie chart depicts the information required to make a decision on whether to take action against the target. The information is color-coded to indicate how much information and knowledge is available regarding a certain target. Red means no or little information, yellow means the requirement is partially satisfied, and green means it is fully satisfied. In general, when the information requirements have been satisfied, and especially if there is a positive identification and the target location is known or will be known, the organization can prosecute the target with an expectation of success, if it so chooses.
In the example provided in figure 4, the target is a person, and the information that has been assessed as important is as follows:
- Positive ID: Is the person identified? Does the organization have a picture, description, or biometrics, and so on?
- Means of transportation: What cars, motorcycles, trains, and other public transportation does the targeted person use?
- Locations: What are the home, work, and other addresses associated with the target?
- Associated persons: Who are the targeted person's closest friends, co-workers, and relatives? These individuals can become the subject of a pie chart of their own.
- Background information: What schools has the targeted person attended? What level of education has he achieved? What is his social status? What are his interests, and so on?
- Activity: What does the target do, and why?
- Patterns of life: How and when does the target move? Where does he go, and what does he do?
In the example of Suspect Q, positive identification and locations were priorities, along with the suspect's pattern of life. Using this pie chart, the small TF staff could plan, discuss, analyze, and direct resources, depending on what information was still missing. If there was not enough information to positively identify a target, then the next objective for the intelligence resources would be to collect that particular type of information.
Furthermore, as in Suspect Q's case, the pie chart can be modified depending on what the staff consider important. For instance, the focus of counterinsurgency in Afghanistan in recent years moved from military operations towards police operations. Police operations are subject to investigations and a regular judicial process. Arrest and search operations require warrants and preferably some kind of evidence to present in court. In the case of Suspect Q, the warrants and evidence against the target were considered FFIR. Figure 5 presents the positive identification, locations, and pattern of life of Suspect Q as PIR.
Such evidence could obviously be intelligence-related, but in this particular case it was important to be able to present the evidence openly in court, and for it to come from someone outside of the TF or the partnered PRC unit. Also, the target might already be wanted for questioning or already have been arrested in conjunction with ongoing criminal activity, in which case the available evidence might not be intelligence-related. Evidence is a prerequisite for a warrant: without substantial evidence, there would most likely be no warrant, and without the warrant, the PRC would not be able to execute the operation.
In Suspect Q's case, however—like so many other TF operations—a warrant was issued for a search or an arrest with the aim to "hopefully" find some evidence on location that could be used in court. Before the analytical model described in this article was developed, on multiple occasions, the suspected targets were released without charges because of lack of evidence or some other culturally or politically sensitive reason. This hit-or-miss approach changed after the judicial system became more mature and its officials better understood the rudiments of the rule of law. The process needs to start with information, which is developed into intelligence and confirmed with evidence. The only alternative is to secure evidence from an existing crime scene, as was the case with Suspect Q and the IED that led to his identification.
In the example illustrated by figure 5, a warrant has been issued and the target's activity and pattern of life are well-known; these areas are colored green. The information requirements for positive identification, location, and evidence, however, are only partially satisfied and are therefore colored yellow. With the situation depicted in figure 5, it becomes apparent that any decision to make a search, arrest, or strike will have to involve some risk. With this model, a commander can visualize and understand where there are risks based on whether sufficient information is available for each factor.
Furthermore, figure 5 suggests that if no more evidence can be collected, then most likely the detained person or target of interest will be released. On the one hand, although the operation may be deemed worth conducting, if there is no reliable target description or confirmation that the target is present and if there is a danger that the operation might not uncover enough evidence for the prosecutor to continue the investigation, then the decision to act can be considered to have a moderate risk of failure. On the other hand, if the target is fixed, located, and positively identified (all green), and there is sufficient evidence (green), then it is almost certain the target will be arrested with enough evidence to go to court and get a conviction.
The Decision Tree: Combining It All into One Picture
A decision tree that combines the different phases of an operation with the If-And-Then model to identify decision points and outcomes might look like figure 6.
There are essentially two decisions to be made in this example. From the find-phase, assuming the target is present and confirmed, the operation can move into a fix-phase and finally a finish-phase (the yellow-star decision points). If the target is not confirmed but the location is confirmed, then resources can be allocated to confirm the pattern of life and/or target refinement (the blue-star decision points).
Once the target is confirmed and positively identified, then the pie chart sections for identification and location will be colored green, indicating that the threshold and risk, as well as the uncertainty, are lower compared to the find-phase. The decision maker can therefore make a better and more conscious decision to move into the finish-phase and strike in order to arrest the target. Evidence, in this case, is still only partially satisfied (yellow). It is likely that there will be evidence at the target location or that the target will confess. While the TF could support the prosecutor's decision-making process using the pie chart and other tools, it is ultimately the prosecutor's decision whether to act. In this particular example (figure 6), the prosecutor has already issued a warrant (indicated by the color green) and wants the suspect in custody. The operation has been focused to lower the uncertainty by enhancing or conducting target refinement, and developing actionable intelligence from that information.
Conclusion: Some Key Take-Aways
Operators should always use processes their team is familiar with, but they should also be prepared to alter the criteria they use for FFIR and PIR in order to solve the mission or the problem. The If-And-Then formula needs to be developed further and used to support the current ops or the battle captain's decision making if the commander is not available to provide the authorities to act. The conduct of military operations, which are usually planned over a long period of time using all the available intelligence resources to develop an understanding of the target and the mission, is still quite different from a police force's quick-reaction, event-driven, and often evidence-based operations, in which operators can end up at a location without knowing what is going on or what they may encounter.
The SOF TF staff always held an open brainstorming forum to plan operations, and let people who were not part of the core planning team excuse themselves whenever they felt they were no longer needed. The pie chart has proven to be a good working tool for operations and intelligence fusion, which allows the operations and intelligence officers and staff to work out their priorities together and develop a common understanding of the situation. The fields in the pie chart can be changed depending on the operation and its particular friendly-force information and priority intelligence requirements. This approach, along with a fusion mindset, are key to working smarter and putting the focus on unity of effort instead of rivalry. For the SOF TF described in this article, the interagency and combined approach came into effect in a way that exceeded all expectations. The TF members learned a great deal from this experience and continue to refine their methods and processes so they can work smarter and better. It is hoped that the Afghan partner force also gained something from the experience of working with the SOF TF's methods. ²
About the Author(s):
The author is a European SOF operations and intelligence officer currently studying at the US Naval Postgraduate School.
This is a work of the US federal government and is not subject to copyright protection in the United States. Foreign copyrights may apply.
- Deployable Training Division Joint Staff J7, Commander's Critical Information Requirements (CCIRs), 3rd ed. (Suffolk, Va.: Deployable Training Division, July 2013): http://www.dtic.mil/doctrine/fp/fp_ccirs.pdf
- All figures in the article were developed by the author.
- Army National Guard Battle Command Training Center, Battle Staff Guide: A Reference Tool for Commanders and Battle Staffs (Fort Leavenworth, Kan.: Army National Guard, August 2010), 347: http://www.benning.army.mil/mcoe/dot/mc3/reserve/content/pdf/Battle%20Staff%20Guide_Aug2010.pdf
- US Army Intelligence Center and Fort Huachuca, Combat Commanders Handbook on Intelligence, ST 2-50.4/FM 34-8 (Huachuca, Ariz.: USAIC&FH, 6 September 2001): https://fas.org/irp/agency/army/st2-50-4.pdf