View source for Chapter 5: Hybrid Threat Tactics

[[Category:FS]]
The Hybrid Threat (HT) possesses a wide range of options for executing tactical actions. This chapter explores the concepts behind those options.

__TOC__

==Tactical Concepts== 
Initiative and mobility characterize tactics the HT would use while establishing and preserving bases in which to train, self-sustain, prepare for future missions, and evolve organizational capability. Concurrently, collective tactical actions can have strategic consequences of denying an enemy a secure area or making it politically untenable to remain. Actions are aimed at keeping an enemy physically and psycho- logically stressed from constant harassment and disruption when a distinct defeat or destruction of an enemy is not practical.

Tactical actions can encompass a range of activities that can include the following:
*Collection of intelligence.
*Coercion for fiscal or logistic support.
*Assassination of designated enemy leaders or officials.
*Sabotage by small loosely affiliated groups of irregular forces.
*More traditional major offensive and defensive actions between regular military forces.

===Synergy of Regular and Irregular Forces===
The HT understands that the environment that would produce the most challenges to U.S. forces is one in which conventional military operations occur in concert with irregular warfare. The HT’s concept is not just one of making do with what is available, but is primarily one of deliberately created complexity.

Each component of the HT brings a capability to bear. The synergy of these capabilities is not to be understated. Operational environments (OEs) by their very nature provide a myriad of complexities across all the operational variables. The HT seeks to introduce additional complexity through the use of an evershifting array of forces, technologies, and techniques.
 
===Information Warfare as a Key Weapon System===
HT tactical actions will be often be designed to achieve information warfare (INFOWAR) objectives rather than purely military ones. Information and its management, dissemination, and control have always been critical to the successful conduct of tactical missions. Given today’s tremendous advancements in information and information systems technology, this importance is growing in scope, impact, and sophistication. The HT recognizes the unique opportunities that INFOWAR gives tactical commanders. Therefore, it continuously strives to incorporate INFOWAR activities in all tactical missions and battles.

INFOWAR may help degrade or deny effective enemy communications and blur or manipulate the battlefield picture. In addition, INFOWAR helps the HT achieve the goal of dictating the tempo of combat. Using a combination of perception management activities, deception techniques, and electronic warfare (EW), the HT can effectively slow or control the pace of battle. For example, the HT may selectively destroy lucrative enemy targets. It could also orchestrate and execute a perception management activity that weakens the enemy’s international and domestic support, causing hesitation or actual failure of the opera- tion. It executes deception plans to confuse the enemy and conceal intentions. More traditional EW activities also contribute to the successful application of INFOWAR at the tactical level by challenging and/or weakening the enemy’s quest for information dominance.

INFOWAR also supports the critical mission of counterreconnaissance at the tactical level. The HT constantly seeks ways to attack, degrade, or manipulate the enemy’s reconnaissance, intelligence, surveillance, and target acquisition (RISTA) capabilities. All enemy target acquisition systems and sensors are potential targets.

===Complex Battle Positions===
The HT reduces exposure to enemy standoff fires and RISTA by utilizing complex battle positions (CBPs) and cultural standoff. CBPs are designed to protect the units within them from detection and attack while denying their seizure and occupation by the enemy. Commanders occupying CBPs intend to preserve their combat power until conditions permit offensive action. In the case of an attack, CBP defenders will engage only as long as they perceive an ability to defeat aggressors. Should the defending commander feel that his forces are decisively overmatched, he will attempt a withdrawal in order to preserve combat power.

CBPs have the following characteristics that distinguish them from simple battle positions (SBPs):
*Limited avenues of approach. (CBPs are not necessarily tied to an avenue of approach.)
*Avenues of approach are easily observable by the defender.
*360-degree fire coverage and protection from attack. (This may be due to the nature of surrounding terrain or engineer activity such as tunneling.)
*Engineer effort prioritizing camouflage, concealment, cover, and deception (C3D) measures; limited countermobility effort which might reveal the CBP location.
*Large logistics caches.
*Sanctuary from which to launch local attacks.

C3D measures are critical to the success of a CBP, since the defender generally wants to avoid enemy contact. Additionally, forces within a CBP will remain dispersed to negate the effects of precision ordinance strikes. Generally, once the defense is established, non-combat vehicles will be moved away from troop concentrations to reduce their signature on the battlefield.

Cultural standoff is the fact that protection from enemy weapon systems can be gained through actions that make use of cultural differences to prevent or degrade engagement. Examples of cultural standoff are—
*Using a religious or medical facility as a base of fire.
*Firing from within a crowd of noncombatants.
*Tying prisoners in front of battle positions and onto combat vehicles.

===Systems Warfare===
The HT will disaggregate enemy combat power by destroying or neutralizing vulnerable single points of failure in enemy warfighting functions. A system is a set of different elements so connected or related as to perform a unique function not performable by the elements or components alone. The essential ingredients of a system include the components, the synergy among components and other systems, and some type of functional boundary separating it from other systems. Therefore, a “system of systems” is a set of different systems so connected or related as to produce results unachievable by the individual systems alone. The HT views the OE, the battlefield, its own instruments of power, and an opponent’s instruments of power as a collection of complex, dynamic, and integrated systems composed of subsystems and components.

Systems warfare serves as a conceptual and analytical tool to assist in the planning, preparation, and execution of warfare. With the systems approach, the intent is to identify critical system components and attack them in a way that will degrade or destroy the use or importance of the overall system.

The primary principle of systems warfare is the identification and isolation of the critical subsystems or components that give the opponent the capability and cohesion to achieve his aims. The focus is on the disaggregation of the system by rendering its subsystems and components ineffective. While the aggregation of these subsystems or components is what makes the overall system work, the interdependence of these subsystems is also a potential vulnerability.

===Adapting By Function===
The HT will choose the most effective option for executing each combat function, without regard to original purpose, laws of war, or military hierarchy. For example, a child on a street corner with a cell phone may be the most effective means of providing early warning to the leaders involved in a tactical action. If so, the HT will employ that option, even if more sophisticated or expensive RISTA devices or techniques are available.

The HT will typically acquire a capability to permit it to act with freedom with respect to its natural, regional enemies. These capabilities will be adapted to exploit their pertinent characteristics to best advantage against enemy forces.

==Functional Tactics==
The HT employs functional tactics. It determines the functions that need to be performed as part of an action to bring about its success. Then it allocates appropriate actors to each function and synchronizes the effort.

A number of different functions must be executed each time an HT force attempts to accomplish a mission. An HT commander identifies the specific functions he intends his various subordinate forces or elements to perform. The functions do not change, regardless of where the force or element might happen to be located on the battlefield. However, the function of a particular force or element may change during the course of the battle. While the various functions required to accomplish any given mission can be quite diverse, they can be broken down into two very broad categories: action and enabling.
---- 
''Note.'' In larger groupings of forces, HT commanders refer to the subordinates performing various functions as ''forces''. In smaller groupings, commanders call them ''elements''.
----

===Action Functions===
The ''action'' function is performed by the set of capabilities that actually accomplish a given mission. One part of the unit or grouping of units conducting a particular ''action'' is normally responsible for performing the primary function or task that accomplishes the goal or objective of that ''action''. In most general terms, therefore, that part can be called the ''action force'' or ''action element''. In most cases, however, the higher commander will give the action force or element a more specific designation that identifies the specific function it is intended to perform, which equates to achieving the objective of the higher command’s mission.

====Examples====
For example, if the objective of the action is to conduct an assault, the element designated to complete that action is the assault element. In larger offensive actions, an action force that completes the primary offensive mission by exploiting a window of opportunity created by another force is called the exploitation force. In defensive actions, the unit or grouping of units that performs the main defensive mission in the battle zone is called the main defense force or main defense element. However, in a maneuver defense, the main defensive action is executed by a combination of two functional forces: the contact force and the shielding force.

If the HT objective is to destroy a city with a weapon of mass destruction (WMD), then the WMD is performing the action function. In another instance, the HT objective could be to seize a friendly capital city and it might employ a WMD in another area to force a response by enemy forces that leaves the capital exposed. In that case, the force used to seize the capital is performing the action function, and the WMD is performing a different (enabling) function.
---- 
''Note.'' In defensive actions, there may be a particular unit or grouping of units that the HT commander wants to be protected from enemy observation or fire, to ensure that it will be available after the current battle or operation is over. This is designated as the protected force. This protected force could become the action force in a subsequent battle or operation.
----

====Extended Example====
An extended example of an HT raid follows to illustrate the action function. (See figure 5-1.) In this example, an insurgent force conducts a raid on an enemy combat outpost. In this raid, the assault element executes the action function, exploiting the breach created by the breach element (an enabling function).

Local insurgents conduct reconnaissance and surveillance 1) on enemy combat outposts in battle zone. Observers record and report actions such as scheduled deliveries, work shift changes, identification procedures and other routines. Preplanned feints or demonstrations have allowed collection on the complexity of the security around the target that includes—
*Manning strength of the combat outposts and its weapon systems.
*Reaction time of response units.
*Any hardening of structures, barriers, or sensors.
*Personnel, package, and vehicle screening procedures.
*Type and frequency of emergency reaction drills.
This intelligence identifies an attack target that will most likely lead to insurgent success by avoiding substantial enemy security measures. Observation continues before, during, and after the raid by insurgent elements not involved in the assault or direct support.

Once a specific combat outpost has been selected as the target, insurgent forces plan and rehearse actions in an assembly area 2) In a coordinated sequence of actions, insurgent elements move to designated positions that in this example are—
*An attack by fire position.
*A support by fire position.
*An assault position.

The attack by fire element 3) occupies hide positions in the vicinity of fighting positions. The support by fire element 4) moves along a separate route to a position overwatching the combat outpost and occupies a nearby hide position. Light mortars are emplaced away from the direct fire systems of medium and heavy machine guns and antitank weapons. Indirect and direct fires intend to fix the combat outpost and disrupt the enemy defense.

The attack by fire element emplaces an antitank (AT)-capable series of mines near the bridge 5) to delay any quick reaction force (QRF) from impacting on the raid at the combat outpost. Insurgents rally at the attack by fire position 3) and wait. This choke point is also planned for indirect fire support.

The assault and breach elements move via a covered and concealed route, continue through an assault position without halting, and position for the attack. The action of the assault element is enabled by a breach element, which breaches the identified weak point in the combat outpost defensive position and secures the breach and immediate flanks for the assault element to attack into the combat outpost.

On order, the support by fire element initiates the raid 6) with direct and indirect fires on the combat outpost. As the support by fire element shifts fires and continue to fix the combat outpost, the breach element 7) moves forward and breaches the defensive perimeter. The assault element supports the breach point with fires and attacks through the breach 8) once the penetration is confirmed by the breach element.

The attack by fire element 3) detonates AT mines at the bridge exit to delay the QRF. Medium and light machine gun fire and antitank guided missile fire block the QRF 5) while the assault is in progress.

The assault element attacks into the combat outpost to defeat the enemy force and seize hostages. The assault and breach elements withdraw quickly with hostages, under pressure from the combat outpost perimeter. The withdrawal route through restricted terrain is prepared with antipersonnel (AP) mines and is planned for indirect fires of high explosive and smoke to delay pursuit by enemy forces. The insurgents in this group break contact 9) and move to a safe haven with their hostages.

The attack by fire element 3) disengages from the firefight at the bridge and exfiltrates to a safe haven. The support by fire element disengages in a phased withdrawal of direct fire systems. The mortar section continues to provide harassment indirect fires and disengages when the direct fires elements have departed their positions and exfiltrate to a safe haven. Observation throughout the attack may be videotape recorded, along with written observer reports, to produce after-action analysis and lessons learned for effective future combat actions.

===Enabling Functions===
The ''enabling'' function is performed by a set of capabilities that acts to assist those capabilities per forming the action function. In relation to the force(s) or element(s) conducting the action function, all other parts of the organization or grouping of organizations conducting an action provide ''enabling'' functions of various kinds. In most general terms, therefore, each of these parts can be called an enabling force or ''enabling element''. However, each subordinate force or element with an ''enabling function'' can be more clearly identified by the specific function it performs.

====Examples====
For example, a force that enables by ''fixing'' enemy forces so they cannot interfere with the primary action is a ''fixing force''. Likewise, an element that creates a ''breach'' that enables an assault element to assault the enemy forces on the far side of an obstacle is a ''breach element''.

In larger offensive actions, one force can enable another by conducting an assault that enables another force to exploit the effects of that assault in order to accomplish the primary objective. Thus, that type of enabling force can be called the ''assault force''. In this case, the force that conducts the initial assault is not the one that is actually intended to achieve the objective of the higher command’s mission. The role of the assault force is to create an opportunity for another force—the exploitation force—to accomplish the objective. Thus, the assault force, conducting the first part of a two-part offensive action, acts as an enabling force. In order to create a window of opportunity for the exploitation force to succeed, the assault force may be required to operate at a high degree of risk and may sustain substantial casualties. However, other types of enabling forces or elements may not even need to make contact with the enemy.

If the mission is to enter an enemy base and set off an explosive device, an enabling function would be to penetrate the perimeter defenses of the base or to assist in the infiltration of the element emplacing the device. In the defense, an enabling function might be to counterattack to restore a portion of the area of responsibility (AOR) to HT control.
---- 
''Note.'' A unit or group of units designated as a particular functional force or element may also be called upon to perform other, more specific enabling functions. Therefore, the function of that force or element, or part(s) of it, may be more accurately described by a more specific functional designation. For example, a ''disruption force'' generally ''disrupts'', but also may need to ''fix'' a part of the enemy forces. In that case, the entire disruption force could become the ''fixing force'', or parts of that force could become ''fixing elements''.
----

====Extended Example====
An example of an HT area defense follows to illustrate the enabling function. (See figure 5-2.) In this example, a hybrid force of guerrillas, insurgents, and military units conducts an area defense to protect their leadership from attack or capture.

Guerrilla forces, reconnaissance teams, and insurgents 1) work together as a disruption force to force the enemy off his timetable and prevent his gaining accurate information about HT dispositions. This provides the defenders with the ability to reposition to best respond to enemy attack. CBPs 2) protect the HT leadership by preventing the enemy from discovering and attacking them. Combat security outposts (CSOPs) 3) perform the enabling function of providing time for exfiltration should the enemy prove able to defeat forces in the initial CBP.

====Enabling by Disruption, Security, and Fixing====
Three specific types of enabling function are so common as to warrant additional attention. These are disruption, security, and fixing. The following sections describe these functions and provide examples.

=====Disruption=====
''Disruption'' forces or elements operate in what the HT refers to as the disruption zone. They can—
*Disrupt enemy preparations or actions.
*Destroy or deceive enemy reconnaissance.
*Begin reducing the effectiveness of key components of the enemy’s combat system.
This function is so common that it appears in many examples of other functions in this chapter, as well as in the scenario blueprint examples in appendix A. Therefore, no specific examples are included here.

=====Security=====
The ''security'' function is performed by a set of capabilities that acts to protect other capabilities from observation, destruction, or becoming fixed. Security is provided by isolating the battlefield from enemy elements that could alter the outcome. This can be accomplished by providing early warning and reaction time or actively delaying or destroying arriving enemy forces.

An extended example follows to illustrate the function of security. (See figure 5-3 on page 5-8.) Insurgent forces in company strength have agreed to provide security for a local criminal organization at a drug manufacturing site 1) in a remote area contested by two sovereign states. Insurgent reconnaissance identifies that the drug site is not located along a logical enemy avenue of approach and is a satisfactory location for development of a CBP defense. The CBP 2) is configured to protect elements and materiel within the defensive perimeter and support zone from detection and attack, and deny their seizure and occupation by the enemy. Although the HT may be aware of possible and likely coalition approaches into the guerrilla battle zone, the primary purpose of this CBP is to provide sanctuary. If necessary, this protection for the temporary drug manufacturing and storage shelters activates a defense or delay.
 
Security observation posts (OPs) monitor possible enemy access routes 3) into the CBP. The insurgents identify most likely and most dangerous directions of attack and prioritize the CBP defense to them. Indirect and direct fires are planned for kill zones that support the defense in key locations such as the only ford across the river. Confirmed as a difficult ford crossing, the near bank 4) has AP mines emplaced to slow any attack. The disruption force 3) uses AP mines, trip wires, and abatis to provide early warning and impede any enemy maneuver toward the CBP. On order, indirect fires into a kill zone or preplanned targets supplement this early disruption of any attack. The other possible direction of attack is an exposed deep swamp 5) with excellent fields of direct fire, and the insurgents plan a kill zone there with indirect fires.

Enemy forces have elements of a light infantry battalion operating in conjunction with drug enforcement officials. The jungle terrain, marshland, and the dense vegetation make movement off the limited trail systems almost inaccessible. Fighting positions orient on the most likely and most dangerous direction of attack into the CBP defense 6).

The insurgent reserve 7) is positioned near the CBP support zone for rapid response to preselected battle positions. Light and medium mortars are positioned to provide immediate indirect fires against any direction of attack.
 
The insurgent force is also prepared for the possibility that an enemy attack is successful in penetrating into the battle zone and the drug manufacturing site is in jeopardy of capture. In that case, the insurgent force conducts a delay to allow evacuation of drug material along a preselected exfiltration route 8). It has also emplaced nuisance AP mines along that route to delay any pursuing enemy forces. Automatic rifle teams using a series of hasty defense bounding overwatch positions can impose further delay.

Security OPs will remain in position in the disruption zone when bypassed unknowingly by enemy forces. These observers will assist in calls for indirect fire to disrupt enemy forces in the assault on the CBP. Insurgent forces in the CBP conduct an orderly delay and disengage, on order, to exfiltrate in small groups to rendezvous points in the area. Observations before and during an attack, and reports from any stay-behind insurgent element will be collated in after-action analysis and lessons learned for effective future combat actions.

=====Fixing=====
The ''fixing'' function is performed by a set of capabilities that acts to prevent opposing capabilities from interfering with mission accomplishment. Fixing is accomplished when a part of the enemy force does not participate in actions that could lead to the failure of the HT course of action. This can be accomplished in a variety of ways, including—
*Suppressing a force with fires.
*Deceiving it with INFOWAR.
*Forcing it to conduct consequence management.
*Involving it in a firefight away from the main action.
*Restricting its movement with countermobility effects.
*Depriving it of logistics resources.

An extended example of an HT raid follows to illustrate the function of fixing. (See figure 5-4 on page 5-10.) In this example, a guerrilla force conducts a raid to secure a high-value target.

Local guerrillas maintain regular surveillance 1) of the operations of a humanitarian relief organization (HRO) in an urban area near the guerrilla sanctuary. Observers record and report actions along major routes in and out of the target area, and focus attention on a particular HRO support site 5) in a warehouse section of the town. Intelligence priorities of effort include—
*Scheduled deliveries.
*Work shift changes.
*Contract security at the site.
*Identification procedures.
*Other routines at this HRO site and urban activities in the vicinity.

Guerrillas know that this urban complex is defended by a motorized infantry company with no other enemy ground maneuver forces nearby. Most of the infantry company combat power is oriented north of the river line to protect the only multi-span bridge and ferry site in the area. Enemy defense concentrates around a combat outpost on the one trafficable north-south road. Guerrilla surveillance confirms that other company elements north of the river are conducting screening patrols on an intermittent basis.
 
The HRO operation is actually several organizations with loosely affiliated field offices located throughout the urban center. None of the HRO activities want military forces near their support sites due to guerrilla propaganda that claims the HRO missions are part of a military coalition and governmental ploy to control the local populace with food, water purification, health services, and general supplies.

A small enemy QRF is positioned south of the river for rapid response to either the bridge and ferry site or the general urban area. Preplanned guerrilla feints or demonstrations have collected intelligence on the security around the target that includes—
*Manning strength, transportation, and weapon systems of the QRF.
*Reaction time and priority routes of QRF response.
*Any hardening of combat outpost barriers.
*Any changes in personnel, package, and vehicle screening procedures during peak periods of traffic flow.

Reconnaissance has identified an unmarked ford site for infiltration by guerrilla elements into the urban complex. After rehearsing actions 2) in an assembly area, guerrilla elements position in hide positions 3) and a safe haven near the HRO site and QRF. A vehicle-borne improvised explosive device initiates the raid when it rams the combat outpost checkpoint 4) and detonates. Simultaneously, the attack by fire element fixes 4) the QRF with medium machine gun and light mortar fires. Several AT mines are positioned in a hasty group to impede the probable motorized QRF approaches to the HRO target site.

The guerrilla main effort assaults the HRO site 5), seizes control of the warehouse and HRO personnel, and moves to designated supply pallets. Guerrillas quickly load supplies into an HRO truck and drive to a rendezvous on the outskirts of the urban area to transfer supplies 6) and disperse into the populace. Other dismounted guerrilla elements move designated supplies to several caches within the urban complex. An additional group with HRO hostages rallies with other guerrillas and exfiltrates north of the river. The attack by fire element disengages, on order, from the QRF and exfiltrates to a safe haven. Surveillance OPs assist exfiltration and control passage lanes through nuisance AP mines 7) and coordinate a sniper to delay 8) any pursuing forces in the group of AP mines.

Guerrilla elements divide into small groups and exfiltrate to a tentative assembly area 9) or designated safe havens. Observation continues before, during, and after the raid by guerrilla elements not involved in the combat assault or direct support. This continuous reconnaissance and surveillance complements after-action analysis and lessons learned for effective future combat actions.

====Other Enabling Functions====
The commander may designate a subordinate unit or grouping to conduct a ''deception'' action (such as a demonstration or feint). This unit or grouping is, therefore, a ''deception force'' or ''deception element''. Its function is to lead the enemy to act in ways prejudicial to enemy interests or favoring the success of an HT action force or element.

A commander may also designate some subordinates to perform various ''support'' functions. These
''support elements'' can provide the following types of support:
*Perform support by fire (in which case it can be called more specifically a ''support by fire element'').
*Provide combat or combat service support.
*Provide command and control functions.

At a commander’s discretion, some forces or elements may be held out of initial action, in reserve, pending determination of their specific function, so that he may influence unforeseen events or take advantage of developing opportunities. These are designated as ''reserves (reserve force or reserve element)''. If and when such units are subsequently assigned a mission to perform a specific function, they receive the appropriate functional force or element designation. For example, a reserve force in a defensive operation might become the ''counterattack'' force.