source: UPLOAD TO CHAT.pdf

category: Doctrine

text: The US Army's intelligence doctrine restricts thinking to conventional asymmetric scenarios. Its HUMINT is limited to elicitation, interrogation, document exploitation, tactical questioning, reconnaissance, and surveillance, and its counterintelligence is focused on defensive security measures at fixed installations. No doctrine exists for a proactive, coordinated intelligence offensive. In contrast, the 5D Intelligence Framework introduces five active phases (Detect, Deny, Deter, Deliver, Destroy) to guide comprehensive intelligence operations. This framework acts as an advanced warning and force-protection system that penetrates local populations and counters asymmetric enemy battle systems.

summary: Critiques US Army intelligence limitations and presents the 5D Intelligence Framework (Detect, Deny, Deter, Deliver, Destroy) as a more proactive, holistic approach for asymmetric warfare.


source: SOP INT SECTION.pdf

category: SOP

text: The battalion intelligence section’s mission is to provide timely, relevant, and accurate intelligence to the battalion commander, staff, and company commanders while ensuring operational security. Key tasks include collecting, collating and analyzing information about the current situation; conducting Intelligence Preparation of the Battlefield (IPB) to develop situational awareness; prioritizing force protection through ranked target assessment; planning reconnaissance and surveillance; preparing intelligence products for operations; and disseminating those products to commanders and units.

summary: Defines the battalion intelligence section’s mission and core tasks such as IPB, situational awareness, force protection target assessment, recon planning, and intelligence dissemination to support operational commanders.


text: Tactical decision-making follows the 1/3–2/3 rule: no more than one-third of the available time should be spent on planning. Three planning timelines are defined based on notification: Elaborate TDP (notification >72 hours before execution; planning completed within 24 hours of notification), Compressed TDP (notification 24–72 hours before execution; planning in 8–24 hours), and Urgent TDP (notification <24 hours before execution; planning time set to one-third of remaining time). These constraints ensure efficient allocation of time for mission planning and execution at the battalion level.

summary: Explains time management for battalion planning: use the 1/3–2/3 rule and defines elaborate, compressed, and urgent planning timelines based on notification time.


text: When a mission is received, the S-2 initiates intelligence preparation (IPB). The S-2 studies the situation, formulates intelligence requirements, and prepares an initial briefing. The S-2’s deputy (2IC) collects intelligence and reconnaissance data from brigade sources, tasks surveillance assets, and creates the initial situation template. An IPB officer manages the intelligence process by nominating requirements, deploying HUMINT and reconnaissance assets, and updating intelligence and force protection assessments. Junior staff (JCOs) compare higher-echelon intelligence with battalion needs to identify gaps, perform terrain analysis, maintain target folders, and compile threat and vulnerability assessments. The S-2 then conducts mission analysis, refines intel tasks, briefs an initial intelligence report (covering general situation, terrain, enemy strength and dispositions, likely enemy COAs), and completes the intelligence estimate to support friendly COA development.

summary: Describes the battalion S-2 section’s mission planning process: roles of the S-2, IPB officer, and subordinates in collecting intel from higher HQ, identifying gaps, analyzing terrain and threats, and producing the intelligence estimate.


category: Threat Framework

text: The 5D framework (Detect, Deny, Deter, Deliver, Destroy) provides multi-dimensional guidance for intelligence-driven crime investigations, especially when evidence is missing or destroyed. Instead of relying on physical clues alone, it uses layered intelligence, counterintelligence, and operational tactics to unearth hidden evidence and intent. Investigators combine HUMINT, surveillance, forensic analysis, and perception management to reveal the criminal network by exploiting multiple channels of information.

summary: Introduces the 5D framework for crime investigation when evidence is absent: a layered intelligence approach that forces hidden intent and evidence into the open.


text: Phase 1 – DETECT: Establish initial contact with hidden threats when direct evidence is missing. Techniques include interviewing staff or bystanders (e.g., hospital workers, security guards, vendors) and conducting covert site reconnaissance for anomalies (fresh plaster, displaced items). Investigators may secure and search concealed areas (basements, ducts) to uncover hidden evidence, and apply micro-forensic methods (chemical residues, dust patterns, CCTV timing analysis) to detect signs of tampering.

summary: Details the Detect phase: using interviews, covert searches, and micro-forensics to find initial clues and concealed evidence when none is immediately visible.


text: Phase 2 – DENY: Frustrate the criminals’ ability to hide evidence or control the narrative. Conduct counterintelligence to identify insider leaks or suspicious behavior, and enforce strict OPSEC on interrogation details and forensic plans. Restrict access to key facilities (morgues, medical records, staff areas) and digital logs. Control information flow to prevent premature assumptions. By denying adversaries freedom of movement and information, false narratives and tampering are prevented.

summary: Explains the Deny phase: security and counterintelligence measures to prevent suspects from tampering with evidence or influencing the investigation.


text: Phase 3 – DETER: Shape adversary behavior by creating anticipation of consequences. Deploy visible measures such as increased patrols, unexpected inspections or audits, and psychological operations that highlight the thoroughness of the investigation. Lawfully question potential collaborators repeatedly to signal that silence won’t protect them. Hardening actions include securing records, enforcing CCTV redundancy, and off-site data backups. Use tactical HUMINT to engage insiders who may cooperate under pressure. These actions cause the criminal network to hesitate or inadvertently reveal themselves.

summary: Describes the Deter phase: using overt pressure (patrols, inspections, questioning) and security hardening to make criminals anticipate consequences and hesitate or expose themselves.


text: Phase 4 – DELIVER: Separate innocent stakeholders from the criminal nexus and rebuild trust. Conduct transparent communication and community engagement to show that investigations are independent and fair. Support threatened personnel or civilians (safe channels for whistleblowers, protective measures). Exploit intelligence to distinguish coerced individuals from actual collaborators. Quickly prosecute minor facilitators to demonstrate certainty of justice. These actions reassure the public and encourage more people to provide intelligence.

summary: Covers the Deliver phase: actions to protect and reassure civilians and insiders (public communication, safe reporting) and to ensure justice, thereby drawing out more intelligence sources.


text: Phase 5 – DESTROY: Dismantle the criminal network’s structure. Map and encircle all components of the network (leadership, facilitators, safe houses, logistic links). Execute precision raids on identified nodes to seize hidden evidence (digital devices, documents, communication records) guided by intelligence. Conduct wide-area sweeps in suspected zones (e.g., disposal areas, storage rooms) for additional evidence. Prosecute in layers: target both front-line operatives and back-end supporters simultaneously, ensuring the network cannot reconstitute.

summary: Summarizes the Destroy phase: coordinated raids and prosecutions to break and dismantle the criminal network based on the intelligence gathered.


text: These phases form a systematic escalation: begin at Detect (even if no evidence is visible) and move sequentially through Deny, Deter, Deliver, Destroy. This forces investigators to look beyond physical evidence into intent, deception, and network structure. The model integrates intelligence, counterintelligence, and policing into one continuum. It prevents prematurely closing cases by ensuring each channel is fully exploited, so hidden leads aren’t overlooked.

summary: Explains that the 5D phases create a step-by-step approach to investigation, ensuring every aspect (evidence, deception, networks) is considered before concluding the case.


text: When evidence is absent or destroyed, the 5D framework becomes the operational compass. By sequentially applying Detect, Deny, Deter, Deliver, Destroy, investigators conduct a comprehensive intelligence operation rather than relying on forensic clues alone. This method targets intent, deception and network vulnerabilities until the truth is uncovered.

summary: Concludes that without hard evidence, investigators should use the 5D intelligence strategy (detect, deny, deter, deliver, destroy) as a guiding method to uncover hidden threats.


category: Ops Guidance

text: Intelligence Summary: Three terrorists are sighted near a military convoy route close to an army camp, indicating a high risk of ambush on convoys or personnel. Mission: Assess and neutralize this terrorist threat while ensuring the safety of friendly forces. Commander’s Intent: Proactively detect and deny hostile intent, and neutralize the threat with minimal collateral damage to preserve freedom of movement. Enemy Situation: A 3-person hostile cell (likely a reconnaissance/ambush team) is present, equipped with small arms, likely IED capability, and basic support. Friendly forces include the convoy and a nearby camp (2 km west) with quick-reaction capability. Constraints: Rules of Engagement with civilians, limited ISR coverage, and potential enemy concealment. Terrain & Human Terrain: The area is a road corridor with vegetation and structures offering ambush cover. A mixed civilian population of unknown loyalties is in the area, complicating ISR placement and engagement decisions.

summary: Presents an intelligence snapshot of terrorists near a convoy path with ambush potential. It includes the intelligence summary, mission and intent, enemy threat details, friendly forces and constraints, and terrain/human terrain considerations for planning a response.


source: ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf

text: Traditional planning models (Intent+Capability=Action) are extended by incorporating the enemy’s Propensity to attack. The proposed situational awareness formula is: Confirm/deny intelligence on both anticipated courses of action (COAs) and potential surprise attack options. In other words, planners must validate intel for expected enemy plans and separately evaluate surprise scenarios. Propensity (the adversary’s motivation to act) multiplies their intent, ensuring that both will and conventional factors are considered in estimates.

summary: Defines an augmented SA model: incorporate enemy 'propensity' and explicitly consider both anticipated and surprise attack plans in intelligence estimates.


text: Mazumdar identifies five attack target modes that cause tactical surprise: (1) High-Priority Targets (HPTs) – high-profile figures or sites whose loss would severely shock the enemy; (2) High-Value Targets (HVTs) – key personnel or assets whose disruption cripples enemy operations; (3) Mass-Effect Targets – attacks designed to maximize casualties and terror (large-scale bombings or coordinated assaults); (4) Recognizability Targets – symbolic sites or leaders whose attack has outsize political or cultural impact; and (5) Running Targets – opportunistic hits on troops or convoys. Each mode reflects different motivations and tactics.

summary: Lists five surprise target types (HPT, HVT, Mass-Effect, Recognizability, Running) used by terrorists to maximize shock and impact, describing each mode’s characteristics.


text: The concept of Propensity is broken into four variables (Movement, Tactics, Target, Time) abbreviated MTTT. Sudden changes in any of these can cause surprise. For example, an unexpected change in enemy movement (new approach routes) or tactics (switch to suicide attacks instead of rifles) can invalidate intelligence. Similarly, changing targets (attacking a less-defended location) or timing (attacking much earlier or later than predicted) drives surprise. MTTT provides a structured way to analyze and predict how adversaries might alter their plans in these four dimensions.

summary: Introduces the MTTT framework (Movement, Tactics, Target, Time) as the set of variables whose unexpected changes by the adversary generate tactical surprise.


text: Each MTTT factor can directly trigger surprise: “Unexpected Movement” means the enemy shifts approach at the last minute; “Unexpected Tactics” means using methods (e.g., suicide bombers) outside predicted patterns; “Unexpected Target” means hitting a different, softer objective than expected; “Unexpected Time” means attacking at a non-predicted time. Any of these unpredictable shifts can undermine even accurate intelligence, so planning must anticipate changes in movement, tactics, targets and timing.

summary: Explains how unexpected changes in each MTTT variable (movement, tactics, target, time) by the enemy cause true surprise and upset planning assumptions.


text: High-Priority Targets (HPTs) are adversaries with a known history of threatening terrorist operations (e.g., a prominent commander). These are targets that terrorists are willing to sacrifice heavily to attack, even if they are well-defended. HPT assaults involve concentrated group attacks with automatic weapons, aimed at penetrating the target’s strong defenses quickly. The goal is to achieve surprise by exploiting complacency under high security (for example, an ambush inside a fortified command post):contentReference[oaicite:0]{index=0}.

summary: Describes High-Priority Targets (e.g., key leaders) and how attackers mount sudden, forceful assaults despite heavy security to achieve surprise.


text: High-Value Targets (HVTs) are key figures or assets critical to enemy operations (plans, supply, intelligence). Terrorists often attack mobile or accessible HVTs rather than fortified installations, using ambush tactics with automatic weapons. An HVT strike might target a moving convoy or patrol containing a high-value officer. These attacks exploit the target’s operational importance and typically involve hitting a target where it is unexpectedly vulnerable:contentReference[oaicite:1]{index=1}.

summary: Defines High-Value Targets as critical enemy figures/assets; explains they often attack on the move via ambushes, leveraging the target’s operational importance.


text: Mass-Effect Targets are designed to inflict maximum casualties and psychological impact (for example, large-scale IED attacks). Running Targets involve sporadic, opportunistic strikes on troops or convoys from multiple directions using small arms and IEDs, intended to harass and demoralize over time. Recognizability Targets involve attacks on symbolic locations or high-profile individuals (e.g., at religious sites or public monuments). Such attacks (often suicide bombings) aim for high social or political impact despite limited scale:contentReference[oaicite:2]{index=2}:contentReference[oaicite:3]{index=3}:contentReference[oaicite:4]{index=4}.

summary: Combines Mass-Effect, Running, and Recognizability target types: explaining large casualty attacks, random hit-and-run ambushes, and symbolic attacks (often suicide) on civilians or landmarks.


text: MTTT analysis should be used proactively. Analysts review six-plus months of historical enemy activity (movement patterns, tactics used, targets chosen, timing) to predict possible changes in adversary plans. Incorporating these surprise indicators into planning reduces errors in anticipating enemy actions:contentReference[oaicite:5]{index=5}:contentReference[oaicite:6]{index=6}. The text emphasizes that even accurate intelligence can fail if situational awareness is wrong; leaders must explicitly plan for unexpected shifts in MTTT variables to avoid surprise.

summary: Recommends using historical MTTT analysis in planning to anticipate unexpected changes, and notes that even accurate intelligence requires preparation for surprise to avoid mission failure.


text: Commander’s Intent: Purpose – Reduce the operational reach, coordination and control of organized drug networks. Method – Employ continuous, multidisciplinary intelligence collection and analysis (reports, open-source info, lawful investigations, authorized technical means) to identify key decision nodes and vulnerabilities; then execute coordinated non-kinetic and lawful enforcement measures to disrupt them. End State – Networks are disrupted, key decision-makers are removed or neutralized through lawful means, and community safety and the rule of law are measurably improved.

summary: Specifies the commander’s intent: continuously gather and act on intelligence to disable the key nodes of the drug network through lawful means, achieving network dismantlement and safer communities.


text: Concept of Operations (Phased): Phase I (Prepare/Shape) – Build an integrated intelligence picture from multiple lawful sources; establish command structures and legal oversight; define objectives, success metrics and risk measures. Phase II (Detect & Analyze) – Maintain continuous, layered analysis to spot patterns and precursors of drug activity; produce prioritized intelligence products (threat assessments, target nominations) that guide planning. Phase III (Disrupt) – Use intelligence to coordinate lawful actions (investigations, prosecutions, financial disruption, regulatory measures) across agencies; ensure timing and authority are synchronized. Phase IV (Consolidate & Hold) – After disruption, follow up with sustained law enforcement presence, community engagement and social services to prevent network reconstitution; institutionalize lessons learned into doctrine and training.

summary: Outlines the phased operation: 1) prepare with fused intelligence and planning, 2) detect patterns and generate intel products, 3) disrupt networks via coordinated enforcement, and 4) consolidate gains with community and stability measures.


text: Tasks (conceptual roles): Intelligence Element – integrate multi-source analysis, maintain legal evidence chains, and advise commanders on information needs. Operations/Enforcement Element – coordinate lawful actions based on intelligence, ensure all actions have proper legal authority and oversight, and provide visible, accountable enforcement to stabilize operations. Investigations/Prosecution Element – convert intelligence into admissible evidence and coordinate timing of actions to preserve evidence and due process. Counterintelligence/Oversight Element – monitor adversary intelligence threats, enforce legal/ethical safeguards, and protect sources. Civil Affairs – maintain communication with affected communities and provide interventions to reduce demand. Logistics/Support – provide technical and legal support, and ensure data systems are secure and compliant.

summary: Lists the roles of different elements: how intelligence, operations, investigations, counterintelligence, civil affairs, and logistics teams each contribute to the counter-drug effort.


text: Command & Coordination: Establish a clear, lawful chain of command for intelligence production and operations. Use a fused center or joint cell for shared situational awareness and deconfliction. Embed legal counsel in all phases where investigative or enforcement action is considered. Rules/Ethics/Legal: All collection, analysis and operations must comply with domestic law and human rights; minimize civilian harm; maintain oversight. Maintain audit trails of decisions, collections and actions. Risk Management: Identify major risks (civilian harm, legal exposure, community erosion, adversary retaliation). Apply mitigation: legal review of tactics, transparency to oversight, community liaison, evidence protection. Continuously reassess risks before, during and after operations.

summary: Emphasizes lawful command structure and oversight, strict legal/ethical rules, and ongoing risk management (civilian harm, legal exposure, etc.) in the operation.


text: Measures of Effectiveness: Track indicators like reduced violent incidents and public harm attributable to targeted networks, increased lawful prosecutions from sustained intelligence, and decline in network capacity indicators (e.g., disrupted logistics, reduced coordination signals) based on aggregated analysis:contentReference[oaicite:7]{index=7}. Also monitor improved community confidence and cooperation with authorities. Intelligence Principles: Persistency – intelligence collection and analysis must be continuous, not merely reactive. Fusion – combine multiple lawful sources for a comprehensive, defensible picture. Proportionality – choose responses that fit the objective and minimize collateral harm. Accountability – record and justify decisions and maintain auditable evidence chains. Adaptability – regularly update methods based on adversary adaptation and oversight feedback.

summary: Specifies success metrics (reduced incidents, more prosecutions, network degradation, community trust) and key intelligence principles (persistent collection, multi-source fusion, proportionality, accountability, adaptability).


text: Training & Organizational Change: Train multidisciplinary teams in legal collection methods, open-source analysis, evidence handling, and interagency coordination. Establish standing intelligence support units within enforcement agencies to provide commanders with timely, lawful assessments. Institutionalize after-action learning loops to refine doctrine; adapt training and policy based on lessons learned. Emphasize organizational change to build a culture of intelligence-led, lawful enforcement.

summary: Recommends training and structural reforms: train multi-skilled intelligence teams, establish permanent intel support cells, and use lessons learned to update doctrine.