Find a Security Clearance Job!


Chapter 3

The Threat

In the 40-odd years of the Cold War, in many locations around the world, the Army performed a deterrent role as part of the containment strategy. In other places, at other times, the Army fulfilled the Nation's expectation in operations too small to be called "wars," although no less dangerous. To the soldier on the ground, Operations Urgent Fury in Grenada and Just Cause in Panama were indistinguishable from combat operations of their forefathers. Operations Provide Comfort in Iraq and Restore Hope in Somalia, although peace operations, also proved to be dangerous.
FM 100-1
The end of the Cold War has reduced, but not eliminated, the most immediate threat to the security of the US and other western nations. However, the absence of a dominant, identifiable threat has produced a far more complex and confusing strategic environment than the one that was present during the Cold War. Forward-deployed and CONUS-based ARFOR and civilians are and will continue to be engaged in a range of military actions. These actions stem from deterring conflicts to conducting peacetime engagement operations to providing support to civil agencies at home and abroad.


3-1. During the past decade, the US has deployed forces in multiple operations that have included crisis response in combat situations as well as participation in noncombat activities. The Army's presence in South Korea, Saudi Arabia, and Kuwait and its deployments to Somalia, Haiti, Bosnia, and Kosovo are clear indicators that the military must be prepared to face not only the traditional threat, but also a nontraditional, nonecheloned enemy. To support Army commanders successfully, MP leaders must understand the nature and complexity of these threats and how they can potentially affect the desired strategic, operational, and tactical end states.


3-2. The rear area for any particular command is the area extending forward from its rear boundary to the rear of the area assigned to the next lower level of command. This area is provided primarily for the performance of support functions. Operations in the rear area assure freedom of action and continuity of operations, sustainment, and C2. Sustainment operations are those that enable shaping and decisive operations by assuring freedom of action and continuity of operations, CSS, and C2(see FM 3-0). Sustainment operations include the following elements:

  • CSS.
  • Rear-area and base security.
  • Movement control.
  • Terrain management.
  • Infrastructure development.

3-3. During the Cold War, the danger to rear areas included forces that would be deployed in support of major soviet-style operations. The adversaries using the soviet model could be expected to engage in intense combat activity in their enemy's rear area. Their forces were prepared to penetrate into the enemy's rear and to attack and destroy its reserve forces and rear-area installations. To protect the rear areas, the MP were among the first mobile fighting forces available to the battlefield commander and thus, a source of combat power. Today, the Army commander uses the MP's flexibility and their modular-force training, adaptability, and mobility to serve as a combat multiplier throughout his entire AO. During sustainment operations, the MP perform all functions to ensure freedom of maneuver in support of the overall operational effort.

3-4. Failure to protect our forces during sustainment operations normally results in failure of the entire operation. Sustainment operations determine how fast ARFOR reconstitute and how far they can exploit success. The likelihood of MP units encountering the enemy and engaging in direct combat (not only in the rear area, but also during sustainment operations) cannot be underestimated.

3-5. Threats to rear-area and sustainment operations exist throughout the full spectrum of military operations. These threats may be related or independently engaged, but their effects are frequently cumulative. Threats to rear-area and sustainment operations are usually theater-dependent and are not limited to those outlined in this manual. Joint Publication (JP) 3-10 further discusses the threat in the rear area. Although JP 3-10 defines the threat in the context of a JRA, MP leaders can expect the same level of activity anywhere that US forces are deployed.


3-6. Reception, staging, onward movement, and integration (RSOI) operations consist of essential and interrelated processes in the AO that transform arriving personnel and materiel into forces capable of meeting operational requirements. During RSOI operations, the threat encountered will depend mostly on the type of entry, the nature of the operation, and the enemy. During major contingencies, forces deploy from power-projection platforms within the US or forward bases. The PM must plan MP support during the initial stages of the deployment to ensure the protection of follow-on forces and the detection of potential threats (see FM 100-17-3).

3-7. MP support to RSOI operations includes, but is not limited to-

  • Conducting AS operations to counter or prevent enemy actions against marshalling and staging areas.
  • Conducting convoy, airport, and rail security operations.
  • Conducting populace- and resource-control operations.
  • Conducting other physical-security and force-protection measures.
  • Conducting other MP functions (as determined by the PM).


3-8. The threat is divided into three levels. These levels provide a general description and categorization of threat activities, identify the defense requirements to counter them, and establish a common reference for planning guidelines. MP leaders must understand that this does not imply that threat activities will occur in a specific sequence or that there is a necessary interrelationship between each level.

Level I

3-9. Level I threats include the following types of individuals or activities:

  • Enemy-controlled agents. Enemy-controlled agents are a potential threat throughout the rear area. Their primary missions include espionage, sabotage, subversion, and criminal activities. Their activities span the range of military operations and may increase during both war and military operations other than war (MOOTW). These activities may include assassinating or kidnapping key military or civilian personnel or guiding special-purpose individuals or teams to targets in the rear area.
  • Enemy sympathizers. Civilians sympathetic to the enemy may become significant threats to US and multinational operations. They may be the most difficult to neutralize because they are normally not part of an established enemy-agent network, and their actions will be random and unpredictable. During war and MOOTW, indigenous groups sympathetic to the enemy or those simply opposed to the US can be expected to provide assistance, information, and shelter to guerrilla and enemy unconventional or special-purpose forces operating in the rear area.
  • Terrorism. Terrorists are among the most difficult threats to neutralize and destroy. Their actions span the full spectrum of military operations.
  • Civil disturbances. Civil disturbances, such as demonstrations and riots, may pose a direct or indirect threat to military operations. Although this threat may not be of great impact during war, it may significantly change and affect MOOTW.

Level II

3-10. Level II threats include the following types of forces:

  • Guerilla forces. Irregular and predominantly indigenous forces conducting guerrilla warfare can pose a serious threat to military forces and civilians. They can cause significant disruptions to the orderly conduct of the local government and services.
  • Unconventional forces. Special-operations forces (SOF) are highly trained in unconventional-warfare techniques. They are normally inserted surreptitiously into the rear area before the onset of an armed conflict. They establish and activate espionage networks, collect intelligence, carry out specific sabotage missions, develop target lists, and conduct damage assessments of targets struck.
  • Small tactical units. Specially organized reconnaissance elements are capable of conducting raids and ambushes in addition to their primary reconnaissance and intelligence-gathering missions. Small (size or capability), bypassed conventional units, as well as other potential threat forces, are also capable of conducting raids and ambushes to disrupt operations.

Level III

3-11. Level III threats are made up of conventional forces. Potential threat forces are capable of projecting combat power rapidly by land, air, or sea deep into the rear area. Specific examples include airborne, heliborne, and amphibious operations; large, combined-arms, ground-forces operations; and bypassed units and infiltration operations involving large numbers of individuals or small groups infiltrated into the rear area, regrouped at predetermined times and locations, and committed against priority targets. Level III forces may use a combination of the following tactics as a precursor to a full-scale offensive operation:

  • Air or missile attack. Threat forces may be capable of launching an air or missile attack throughout the rear area. It is often difficult to distinguish quickly between a limited or full-scale attack before impact; therefore, protective measures will normally be based on the maximum threat capability.
  • Nuclear, biological, and chemical (NBC) attack. Commanders must be aware that NBC munitions may be used in conjunction with air, missile, or other conventional-force attacks. The NBC weapons could also be used at Level I or II by terrorists or unconventional forces in order to accomplish their political or military objectives.


3-12. Table 3-1 lists the threat levels and their likely appropriate responses. The threat levels listed are based on the type of threat. The table should not be construed as restricting the response options to any particular threat.

Table 3-1. Threat Levels

Threat Level




Agents, saboteurs, sympathizers, and terrorists

Unit, base, and base-cluster self-defense measures


Small tactical units, unconventional-warfare forces, guerrillas, and bypassed enemy forces

Self-defense measures and response forces with supporting fires


Large tactical-force operations (including airborne, heliborne, amphibious, infiltration, and bypassed enemy forces)

Timely commitment of a TCF


3-13. The threat will attempt to perform the following operations against targets in the rear area:

  • Detect and identify targets.
  • Destroy or neutralize operational weapons-system capabilities.
  • Delay or disrupt the timely movement of forces and supplies.
  • Weaken the friendly force's C2network.
  • Disrupt support to combat forces.
  • Set the stage for future enemy operations.
  • Create panic and confusion throughout the rear area.

3-14. Typical examples of enemy priority targets include the following:

  • NBC-weapons storage sites and delivery systems.
  • Key command, control, communications, computers, and intelligence (C4I) facilities.
  • Air-defense artillery (ADA) sites.
  • Airfields and air bases.
  • Port facilities.
  • Main supply routes (MSRs) and MSR checkpoints.
  • Key LOC.
  • Reserve assembly areas (AAs).
  • Troop barracks.
  • Critical civilian and logistics facilities.


3-15. The fact that the Cold War has ended does not imply that our traditional threat has ended. North Korea and Iraq are constant reminders of this fact. For the near future, Army commanders will fight units with Cold-War-era equipment and tactics. The Army trains and is prepared to fight an enemy capable of interfering with our freedom of maneuver throughout the battlefield. On an extended battlefield with asymmetric threats, the danger to high-value assets (HVAs) (including CSS, C2, communication nodes, and MSRs) only increases. The idea that the danger to the rear area decreases as you travel farther away from the forward edge of the battle area (FEBA) is not true. Threat intensity does not depend on geographical location; it depends on what operations the enemy believes must be initiated (and to what degree) to achieve its objective in the rear area. Military commanders depend on the MP to delay and defeat threats in their AO with a mobile reaction force.


3-16. The nature of the COMMZ will encourage Level I and II threats to concentrate along the LOC and other areas of military significance. MP units will encounter an enemy that is capable of disrupting operations throughout the COMMZ while employing terrorist activities, enemy-controlled agent activities, enemy sympathizers, and saboteurs. If the enemy is Level III capable, MP leaders must expect infiltrations and air, missile, or NBC attacks as a precursor to a major Level III operation.


3-17. The activities in Levels I and II will be similar in composition and density as in the COMMZ, but they will target key corps units, key facilities, and corps sustainment capabilities. The threat activities, especially at smaller unit levels, may even precede hostilities. MP leaders must be alert and prepared to encounter unconventional forces conducting diversionary or sabotage operations and small combat units conducting raids, ambushes, or reconnaissance operations or collecting special warfare intelligence. With the fast tempo of offensive operations, MP leaders must also be alert and prepared to encounter bypassed forces that can disrupt operations in the corps rear area.


3-18. The division rear area (DRA) contains many types of CS and CSS units and conducts many complex operations. As in the COMMZ and the corps rear area, the full spectrum of Level I, II, and III activities may occur in the DRA. The main target will be the division's HVA (including key C2facilities; airfields; artillery, aviation, and air-defense assets; LOC; and essential CSS units). The threat may conduct diversionary attacks, sabotages, raids, ambushes, and reconnaissance operations to affect the commander's freedom of maneuver and the continuity of operations. Unlike corps MP, the likelihood of division MP encountering bypassed enemy forces is expected. Failure to delay or defeat these forces will impact division operations.


3-19. As US forces are deployed throughout the world, they will have to face nontraditional, asymmetric threats (other than those listed in Table 3-1, page 3-5) that may be geographically specific. As part of situational awareness, and in coordination with military intelligence (MI) and CID personnel, MP leaders must evaluate and assess the impact of these threats in their AO. A TO is vulnerable to any or a combination of the following threats:

  • National or international organized crime.
  • Narcotics traffickers.
  • Narcotics terrorists.
  • Extremist groups.
  • Paramilitary groups.
  • Ethnic or religious disputes.
  • Trade in illegal weapons or strategic materials.

3-20. MP leaders must be aware that other threats exist and that they have the same potential as the Level I and II threats to disrupt operations in rear-area or sustainment operations. In some instances, the above threats' capabilities or the massing of personnel may have the same potential threat as a Level III threat.


3-21. The disruption of rear-area and sustainment operations directly affects military efforts. Three types of forces may be used to counter the threat in these areas-a base/base-cluster self-defense force, a response force, or a tactical combat force (TCF).


3-22. A base cluster is established when the appropriate echelon rear-operations cell or command post (CP) places geographically contiguous or noncontiguous bases under the control of a headquarters. The base cluster becomes the next higher tactical C2headquarters of those bases. The rear-operations cell or the rear CP may also establish a base cluster for a corps support group (CSG), an area support group (ASG), or other CSS units operating in the corps or division rear areas.

3-23. US ARFOR have the inherent responsibility to contribute as many forces as possible for base defense and local security for themselves and their facilities, installations, and activities. Each base and base-cluster commander must develop a defense plan to detect, defeat, and minimize the effects of Level I and limited Level II threat attacks on his base or base cluster (including NBC attacks). To maximize the unit's mission accomplishment, defense plans must be flexible and allow for differing degrees of security based on the probability of threat activity. Defense plans are given to MP units operating near the base or base cluster. The base commander most often employs a series of defense measures providing internal and perimeter security. His internal reaction forces use organic weapons to neutralize and defeat most low-level threat activity. Although not fully equipped to engage major conventional or unconventional enemy forces that may confront him, a base commander must deploy his personnel to defend themselves until MP, HN, local police, or combat forces (if available) can respond.


3-24. A response force is summoned when the base or base cluster is faced with threat forces that are beyond their self-defense capability. If the MP are the designated response force, they must-

  • Coordinate with the supported bases or base-cluster commanders to conduct a joint IPB.
  • Review base and base-cluster self-defense plans.
  • Exchange signal-operating-instructions (SOI) information.
  • Identify MP contingency plans to counter likely enemy activities.
  • Integrate ADA, engineer, chemical, field-artillery (FA), Army-aviation, and close-air-support (CAS) fire support into their plans (if available).

3-25. MP units help the base or base cluster return to its primary mission by defeating Level II threats. MP units closely watch likely avenues of enemy approach, possible landing zones (LZs), drop zones (DZs), C2facilities, and other key installations. They accomplish this through the MMS, AS, and PIO functions.

3-26. If MP units are not the designated response force, they may become the initial response force for units within their AO. When this occurs, they block, delay or, if possible, destroy enemy elements within their capability. If the attack is by a larger or more capable force, they will maintain contact and continue to develop the situation or delay until the appropriate response force appears or the battlefield commander commits the TCF.


3-27. When the MP response force encounters or engages threats beyond its ability to defeat, it immediately notifies the higher headquarters. The battlefield commander will then evaluate the situation and commit the TCF to defeat the Level III threat. The TCF is normally a combined-arms organization tailored by the corps or division G3, based on METT-TC. The TCF normally receives fire, aviation, or other support needed to fight and defeat the threat. Once the TCF is identified and before it is committed to battle, it will conduct direct coordination with the MP or other response forces regarding the exchange of reconnaissance information, battle-handoff procedures, and contingency plans for TCF operations. Once the TCF is committed, the MP unit performing as the response force becomes OPCON to the TCF commander.


3-28. The MP brigade or battalion is capable of conducting TCF missions only when properly augmented. MP augmentation may be in the form of fires, small combat units, aviation assets, or CAS. The specific type of augmentation is METT-TC dependent. Additionally, the MP C2headquarters must receive the respective liaison officers to ensure that augmentation forces are synchronized and employed according to their capabilities. The MP commander's situational awareness and battlefield visualization are key elements to TCF operations. Once designated as the TCF, the MP unit commander establishes liaison with the appropriate rear CP to obtain-

  • The current rear-area IPB.
  • The friendly unit disposition.
  • Defense plans.
  • Priorities for protection.
  • The fire-support plan.

3-29. Based on the above information, the MP commander conducts his own IPB and develops a concept of operations. He then forwards it to the appropriate higher echelon for coordination and approval.

3-30. The MP's ability to employ organic MP assets as part of the TCF is limited by the following factors:

  • MP availability. Normally, all MP assets available are committed at all times. The specific function and scope that MP units perform during the operation are determined by the Army commander's needs, the intensity of the conflict, and the availability of MP resources. The commander, with advice from the MP leader, must decide which MP operations must be scaled back, delayed, or shifted before the MP unit can be designated as part of the TCF.
  • MP dispersion. MP units are normally displaced over a large geographical area. Technological capabilities and mobility allow them to operate over great distances. In today's battlefield, a typical MP company employment covers between 1,000 and 1,200 square kilometers and performs numerous missions in support of all five functions. The distance between elements, the reprioritization and movement of other MP units, the difficult terrain, poor roads, and bad weather may slow down the MP's commitment as a TCF.

Join the mailing list