Find a Security Clearance Job!


Appendix D
Order of Battle Factors

D-1. During counterinsurgency operations, the nature of the threat requires order of battle intelligence be produced in greater detail than is found in conventional operations. All larger organizations must be analyzed, mapped-out, and understood. Often the focus starts with individuals or cells. However, order of battle development should not be linear. An insurgency's "foot soldiers" are often easily identified and analyzed due to their more public exposure. However, it is paramount to identify the leaders and their relationships at all levels to accurately establish an initial order of battle. In counterinsurgency operations, the categories of personalities, culture, and internal organizational processes are added to the usual list of order of battle factors that are studied from the same perspective as in conventional warfare and include-

  • Composition.
  • Disposition.
  • Strength.
  • Tactics and operations.
  • Training.
  • Logistics support.
  • Combat effectiveness.
  • Electronic technical data.
  • Personalities.
  • Miscellaneous data.


D-2. Composition is the identification of units and political, religious, or ethnic organizations. Unit identification consists of the complete designation of a specific entity by name or number, type, relative size or strength, and subordination. Composition includes-

  • Operational and support cells (similar to sections in a military unit).
  • Echelons.
  • Staff elements.
  • Political, religious, ideological, and military aims.
  • Internal and external C2.
  • Operational organizations.
  • Internal and external support structure.
  • External ties.
  • Assassination squads.
  • Bomb and demolition squads.
  • Attack or hit squads.


D-3. Disposition consists of the geographic location of insurgent elements and how they are deployed, employed, or located. Additionally, disposition includes the recent, current, and projected movements or locations of these elements:

  • Training camps.
  • Base camp.
  • Logistic camps (external and internal).
  • Headquarters (external and internal).
  • Safe houses.
  • Front organizations.
  • Areas of control.


D-4. Strength conventionally is described in terms of personnel, weapons, and equipment. In insurgency operations, strength as a factor is augmented with attack teams, political cadre or cells, and most importantly, popular support. Popular support can range from sympathizers to assistance in conducting operations, storage or moving logistics, or just withholding information.


D-5. Tactics and operations include strategy, methods of procedure, and doctrine. Each refers to the insurgent's accepted principles of organization and employment of forces. Tactics also involve political, military, psychological, and economic considerations. Insurgent tactics and operations vary in sophistication according to the level of training the individual or organization has received. Insurgents carefully plan and train for individual and small group operations. Typical insurgent tactics and operations include, but are not limited to-

  • Assassination. A term generally applied to the killing of prominent persons and symbolic personnel as well as "traitors" who defect from the group.
  • Arson. Less dramatic than most tactics, arson has the advantage of low risk to the perpetrator and requires only a low level of technical knowledge.
  • Bombing. The IED is the insurgent's or terrorist's weapon of choice. IEDs can be inexpensive to produce and, because of the various detonation techniques available, may be a low risk to the perpetrator. However, suicidal bombing cannot be overlooked as an employment method. Other IED advantages include their ability to gain publicity, as well as the ability to control casualties through timed detonation and careful placement of the device. It is also easily deniable, should the action produce undesirable results.
  • Hostage taking. This is an overt seizure of one or more individuals with the intent of gaining publicity or other concessions in return for release of the hostage. While dramatic, hostage and hostage barricade situations are risky for the perpetrator.
  • Kidnapping. While similar to hostage taking, kidnapping has significant differences. Kidnapping is usually a covert seizure of one or more specific persons in order to extract specific demands. It is normally the most difficult task to execute. The perpetrators of the action may or may not be known for a long time. Media attention is initially intense, but decreases over time unless the kidnapping is accompanied by acts of barbarism that extend news coverage. Because of the time involved, successful kidnapping requires elaborate planning and logistics. The risk to the perpetrators may be less than in the hostage situation.
  • Intimidation/Blackmail. Insurgents may attempt to gain coerced political, fiscal, or logistic support from local government officials, local businessmen, or other influential community leaders through intimidation or blackmail. This could be in the form of threats on the individual's life, kidnapping of people close to the individual, or threats to disrupt or destroy (for example, bombing or arson) infrastructure that is important to the individual.
  • Seizure. Seizure usually involves a building or object that has value in the eyes of the audience. There is some risk to the perpetrator because security forces have time to react and may opt to use force to resolve the incident, especially if few or no innocent lives are involved.
  • Raids or attacks on facilities. Armed attacks on facilities are usually undertaken for one of three purposes:
    • Gain access to radio or television broadcasts to make a statement.
    • Demonstrate the government's inability to secure critical facilities or national symbols.
    • Acquire resources (for example, robbery of a bank or armory).
  • Sabotage. The objective in most sabotage incidents is to demonstrate how vulnerable a particular society or government is to insurgent actions. Industrialized areas are more vulnerable to sabotage than less highly developed societies. Utilities, communications, and transportation systems are so interdependent that a serious disruption of any one affects all of them and gains immediate public attention. Sabotage of industrial or commercial facilities is one means of identifying the target while making a statement of future intent. Military facilities and installations, information systems, and information infrastructures may become targets of insurgent sabotage.
  • Hoaxes. Any insurgent group that has established credibility can employ a hoax with considerable success. A threat against a person's life causes that person and those associated with that individual to devote time and efforts to security measures. A bomb threat can close a commercial building, empty a theater, or delay an aircraft flight at no cost to the insurgent. False alarms dull the analytical and operational efficiency of key security personnel, thus degrading readiness.
  • Use of technology. Technology has important implications for the insurgent threat. Infrastructure technologies provide attractive targets for insurgents, who can apply a range of rudimentary and advanced attack techniques to disrupt or undermine confidence in a range of systems. Key elements of the national infrastructure- transportation, telecommunications, energy, banking, public health, and water supply-are becoming increasingly dependent on computerized systems and linkages.
  • Use of chemical, biological, radiological, or nuclear weapons. Some insurgent groups may possess chemical and biological weapons, and there is a potential for use of both chemical and biological weapons in the future. These types of weapons, relatively cheap and easy to make, may be used in place of conventional explosives in many situations. The potential for mass destruction and the deep-seated fear most people have for chemical and biological weapons could be attractive to a group wishing to make the world take notice. Although an explosive nuclear device is acknowledged to be beyond the financial and technical reach of most insurgent groups, a chemical or biological weapon, or even a radiological dispersion device using nuclear contaminants, is not. The technology is simple and the payoff is potentially higher than conventional or nuclear explosives.
  • Psychological Operations. Since insurgents want to win over the support of the population-or at least separate the support of the population from the HN government, they will engage in many different types of PSYOP with this intent. They can accomplish this through many different means. For example, insurgents may stage and publicize real or fake atrocities, which they will blame on the HN government or US forces. They will also be quick to take advantage of any inadvertent mistakes that the local national government forces or US forces may make when dealing with the local population.


D-6. The type and depth of individual and group training that insurgents receive is tied to their tactics and operations. Higher education also plays a role in insurgent training. Insurgent training may include, but is not limited to-

  • Indoctrination and strategy (political, ideological, or religious).
  • Operations.
  • Tactics.
  • Weapons (individual and crew served), including such specialties as demolition, weapons, and assassinations.
  • Communications.
  • Logistics.
  • Transportation (covert movement).
  • ISR.
  • PSYOP.
  • Media manipulation.


D-7. The effectiveness of insurgent operations depends heavily on logistics. This dependency fluctuates horizontally and vertically between the various groups and levels of operation. The intensity of logistic activity is based on operations. Critical components of logistics include, but are not limited to-

  • Financing.
  • Food.
  • Water.
  • Weapons and ammunition.
  • Bomb-making components.
  • PSYOP materials (paper, ink, printing press).
  • Medical.
  • Transportation (on-hand and required).


D-8. Combat effectiveness for insurgent forces is not measured the same way as combat effectiveness for conventional forces. Combat effectiveness factors for insurgent forces include, but are not limited to-

  • Outside support (financial, physical, moral).
  • Intimidation.
  • Fear.
  • Political change.
  • Motivation.
  • Popular support.


D-9. In counterinsurgency operations, the lack of an obvious formal insurgent organizational structure or architecture impedes development of an extensive threat electronic order of battle database and an electronic technical database. The insurgent has communications equipment available ranging from the most modern to the most primitive. Insurgent forces can use high frequency (HF), short-wave, and ham radio sets; cellular phones; the Internet; the mail; and couriers. Citizen band-set is also used. While not playing a significant historical role, the insurgent's potential use of radar cannot be ruled out.


D-10. Personality is a critical factor when conducting counterinsurgency operations. Attention must be focused on individuals and leaders. Insurgent organizational diagrams can be built through multidimensional link analysis (determining relationships between critical personalities and then their group associations). This applies to virtually any threat represented in counterinsurgency operations. Once relationships and the level of contact or knowledge the personalities have are known, many of their activities can be determined. Personality files include, but are not limited to-

  • Leaders (political, ideological, religious, military).
  • Staff members.
  • Organization's spokesperson.
  • Family members (immediate and extended).
  • Previous experience and skill training in professional disciplines, trades, and specialties.
  • Media manipulation personnel and PSYOP campaign personnel.
  • Trainers.
  • Code names and nicknames.

D-11. Leaders on the ground must understand the political and physical strengths and weaknesses of the insurgent leadership and how best to exploit those weaknesses. Considerations include-

  • Who are the leaders? Is there a single, dominant, charismatic leader?
  • Is the leadership highly dedicated to an ideology?
  • Are the leaders committed to a specific organizational and operational pattern?
  • Are there differences of opinion among leaders as to purpose and methods? Will a schism or other event occur as a result?
  • What is the relationship between the leadership and the operational and support elements? Are decisions made centralized or decentralized?
  • What is the decision making process of the insurgent leadership? Are decisions made centralized or decentralized?


D-12. Culture is the ideology of a people or region and defines a people's way of life. A people's culture is reflected in their daily manners and customs. Culture outlines the existing systems of practical ethics, defines what constitutes good and evil, articulates the structures and disciplines that direct daily life, and provides direction to establish patterns of thinking and behavior. Cultural issues include, but are not limited to religion, political and economic beliefs, tribe, clan, ethnicity, and regional affiliation, military attitudes, and law and justice:

  • Religion-beliefs, customs, and protocols.
  • Ideology-political and economic beliefs, and work ethic.
  • Family-tribe, clan, and family; hierarchies, allegiances, and loyalties; family economic interests; matriarchies versus patriarchies.
  • Ethnicity-race, nationality (for example, Arab, Bedouin, and Turkic; Kurd and Armenian; Tibetan, and Chinese; Korean, Mongolian, and Chinese.
  • Regional affiliations-Internal to a nation and determine those that extend past national borders.
  • Military attitudes-order, weapons, honor, and hunting.
  • Law and justice-one system of law or multiple systems; property rights; correction versus punishment.


D-13. An organization's flexibility or rigidity is a key determinant as to its strengths and vulnerabilities. This flexibility or rigidity can be accurately estimated by answering several questions. Determining organizational attitudes toward those who achieve is powerful.

  • Are achievers viewed as potential competitors, or as important organizational contributors? Is the attitude consistent throughout the organization?
  • How do organizations replace leader and cadre casualties? What are the primary factors that determine how these replacements are selected?
  • Rewards and punishments-what are they, and are they consistently applied?
  • Are internal rivalries Byzantine, or is does organizational discipline have primacy?
  • How are policies adjusted and adjudicated-gunfights or dialogue?
  • What are potential divisions and policy fractures? Which leaders support specific positions, and why?
  • Leader motivations-organizational, family, personal.


D-14. Miscellaneous data includes supporting information needed but not covered by an order of battle factor. This could include-

  • Family history.
  • False unit identification.
  • Names or designators
  • Political and military goals
  • PSYOP.
  • Demographics.

D-15. PSYOP activities may result in insurgent-sponsored, commercial, or clandestine radio broadcasts. Covert broadcasts normally originate outside the national boundaries or from remote, inaccessible areas. Commercial radio broadcasts may use code words to control and coordinate threat operations. Television broadcasts are used similarly.

D-16. PSYOP files contain-

  • Copies of leaflets, posters, and other printed material.
  • Video recordings of television broadcasts.
  • Audio recordings of radio broadcasts.
  • Copies of speeches.
  • Analysis of local grievances.
  • Background material.

D-17. Without an insurgent organizational or operational structure, intelligence analyses during counterinsurgency operations primarily rely on pattern and trend analysis. This allows the analysts to understand the relationships of key insurgency personnel and methods of operation to predict likely insurgent operations and pinpoint critical nodes of insurgent operations (personnel, intelligence, training, and logistics).

Join the mailing list

Unconventional Threat podcast - Threats Foreign and Domestic: 'In Episode One of Unconventional Threat, we identify and examine a range of threats, both foreign and domestic, that are endangering the integrity of our democracy'