Worrying phenomenon affecting SOF deployed to Afghanistan. Apparently, the insider attacks against Coalition Forces that train, advise, and assist Afghan National Defense and Security Forces escalated

From my point of view, the recent escalation of the so-called ”green on blue” incidents (in fact insider attacks of a few ANDSF members [green] against Coalition Forces members [blue] who train, advise, and assist them) confirms, to some extent, the concerns regarding the deterioration of the security situation in Afghanistan.

In this sense, the confirmation are the news that have arrived from Afghanistan in the last four months (July, August, September, and October) about the members of the Coalition Special Operations Forces (SOF) killed in “green on blue” type of attacks while conducting missions.

The attacks intensified and peaked during the second half of October 2018 with the apparent assassination attempt on General Miller, the RSM commander, concluded actually not only with the killing of one of the Afghanistan's most effective leaders, largely responsible for keeping Kandahar province under control and respected by western commanders, Kandahar Province Chief of Police, Lieutenant General (AFG) Raziq, but with the injury of the Train Advise Assist Command South (TAAC-S) commander, Brigadier General (US) Smiley, as well. Later killing of one of the Czech Republic's 601st SOF Group that conducts train, advise, and assist (TAA) missions in western Afghanistan, Herat Province, allegedly by an infiltrated Taliban, on October 22nd, wraps up a bloody week in this troubled country of 17 year conflicts.

Unfortunately, two years ago, Romanian (ROU) SOF became targets of opportunity in a similar attack when two operators were shot dead by two infiltrated Talibans while the Romanians conducted TAA with their partner unit.

What is the motivation of such tragic incidents?

The reasons of such incidents come from wider range of justifications from the unknown (if, for instance, the attacker escapes, or he is physically eliminated and can no longer be interrogated), to those caused by ideology, stress, argument, radicalisation, or other cultural or personal grievances.

From what we have recently seen, if we were to make an assumption, we would estimate that among the main reasons are the attempts of the insurgent networks to infiltrate indoctrinated attackers, or individuals who have nothing else to lose, by persuasion or constraint, amidst the ANDSF teams ready to be trained, advised, and assisted by the CF. Neither can we exclude the criminal or related to corruption motivations.

On one hand, in Afghanistan, in one way or another, there is still war, and such insider attacks will persist. They are one of the Taliban’s modus operandi who will try to hit CF’s center of gravity, namely its cohesion, in order to destabilize it and to make it abandon the force-directed actions against the insurgency.

On the other hand, for NATO-led Resolute Support Mission in Afghanistan the escalation of such threats could have dangerous consequences at a strategic level, negatively affecting the will of contributing nations suffering human losses in such incidents, eventually compromising the sustainable development efforts of the ANDSF capabilities and the NATO - Afghanistan enduring strategic partnership.

What should ROU SOF do to prevent and respond to such attacks?

My experience tells me that, most of the times, there is a tendency among the servicemen to ignore the risks associated with potential insider attacks because our subconscious installs a state of dangerous sufficiency that urges us to believe that to just to us, as individuals, entity, or group, such an incident is not likely to happen. And that is why the alertness and the professionalism of the structures participating in missions in the theater of operations (TO) need to be awakened.

From the strategic level (ROU Special Operations Command - SOC) to the very tactical one,  like group, detachment, team, or even operator conducting independent missions, measures to prepare for the mission, deter, detect, deny, potentially delay, defend and neutralize, followed by consequences management, exploitation, and collection of the lessons learned from the "green on blue" incidents must be strictly set up and implement.

Put in a simplistic concept, the measures to prevent and react to an insider attack could show, schematically (it is just a variant), as in the picture below. They are similar to those simple measures and activities that are used also to safeguard our homes and private property, known under the 5xDs abbreviation (Deter, Detect, Deny, Delay, and Defend).

Prevent & react to “green on blue” type of attacks

Such approaches are not new and, at least for TO Afghanistan, similar measures were developed during combat missions, such as the International Security Assistance Force (ISAF) mission that ended on 31st December 2014, as part of some ISAF Guides meant to prepare and train troops contributing nations. Through this process passed all the servicemen who conducted missions under NATO’s command in TO Afghanistan and among those who are leading today ROU SOF’s destines one can find several such military cadres, for which the proposals bellow should not be a big surprise.

The ROU SOC will have to periodically revise the training requirements specific for combating “green on blue” incidents, based on lessons learned and experience, to amend the policies to be implemented for force protection, to reconsider the rules of engagement (from a national standpoint) in such events, and to formulate personnel’s selection specific criteria for their participation to TAA type of missions.

The SOF structures and staff personnel who prepare, deploy, conduct missions, repatriate after participating at TO Afghanistan missions, and resume the operational cycle, are recommended to implement more seriously at the operational and tactical levels, throughout the whole operational cycle, the measures described in the previous picture, as follows:

Preparing for the mission (continuous process):

• Ensuring selection’s process strictness for the participation at the mission only of the most qualified and motivated candidates;
• Conducting cultural awareness, diversity acceptance, and specific threat awareness training, and, not least important, developing skills to detect what is abnormal in specific TAA activities;
• Continuous and rigorous counter insider threats techniques, tactics, and procedures (TTP) training and rehearsals with accents on prevention, but also, very important, on reaction’s speed, armament handling, and accuracy of the shooting, while remaining calm and keeping the situation under control;
• Responsible rehearsal of each single mission planned and approved in the TO, in accordance with the provisions of the Concept of Operations (CONOPs), prior to their actual execution;
• Permanent evaluation of threats, vulnerabilities, and risks to the force, or to the mission and taking the necessary mitigation measures;
• Early preparation of the messaging if unfortunate incidents will occur.

Deterrence (during the entire TO deployment):

• The strict infliction of access and security rules through standard operating procedures and encouraging its own personnel to report, or stop any kind of attempt to break them;
• The strict infliction of rules in safe keeping, wearing and handling of the personnel armament and ammunition, regardless of the category they come from, "green" or "blue";
• Establishing and maintaining interpersonal relationships with Afghan partners at all levels based on respect, empathy and trust.

Detection, Denial, and Delay (all of these start with the TAA mission approved by commanders):

• Executing with the outmost rigour all the identification and verification processes of  the Afghan personnel who is about to be trained, advised, and assisted. The cooperation with the structures responsible to conduct vetting measures in the recruitment process, their support in the practice of collecting biometrics and updating the databases, as well as the timely exchange of information will greatly contribute to mitigation of risks of serious incidents;
• Increasing vigilance, applying exactly the standard force protection procedures, and detecting, as appropriate, the indicators that could announce the imminence of triggering an insider attack;
• Hierarchically and timely reporting of any suspicions, or exceptional events to commanders and superior echelons, to keep them informed about the production of possible incidents;
• Further investigation of indicators of a threat to the force and mission and the rapid dissemination of necessary warnings;
• Strict compliance with the standing operating procedures and rules relating to the wearing of protective equipment, the wearing and handling of individual weapons and ammunition, as well as posture, position and presence (in particular of the operators that provide force protection, the so-called "Guardian Angels").

Defense and neutralization

Responding to an insider attack should be based on the rapid and decisive concentration of force (it can be obtained only through continuous and sustained training and rehearsals) and on gaining and maintaining control, concurrent with asking for some back-ups and imposing some exceptional access and force protection measures. The attacker/attackers should be quickly isolated, and the threat should be completely neutralized, seeking the limitation of its effects (something easy to say, but difficult to be done when not having the appropriate personnel for the mission). For this, at least the Guardian Angels must be selected from the best and most trained SOF operators.

Consequences management, resuming the mission, exploitation, and future operations

As mentioned earlier, such violent incidents produced among coalition partners can be exploited by insurgent networks to undermine the cohesion of its members, and may have bad strategic consequences on the NATO-led mission in Afghanistan. Managing them, further investigating the circumstances and communicating well-informed facts through strategic communication messages are essential to calm down the situation and avoid escalating tensions. The work should be followed by measures to restore the morale of the military and restore and maintain cooperative relations with coalition partners in order to ensure the necessary conditions for the continuation of the mission.

Lessons learned from exploitation should be collected and disseminated in order to draw the necessary lessons and adapt the policies, doctrines, regulations, organization, equipment, and training of the SOF structures for their future operations. Those with theater of operations experience know that success builds on interpersonal relationships, respect and empathy shown to the members of the host nation, that in general things are not black and white, and an adviser caught between two cultures and two different systems, have to feel comfortable in such an environment. Finding creative solutions to complex problems, as well as bartering and negotiation in Afghanistan, will, in most cases, make the difference between success and failure.

Conclusions

Although the number of insider attacks conducted against CF members who are training, advising, and assisting the ANDSF is yet far from the peak reached in 2012 (a statistic made during the ISAF mission), the reality is telling us that these unfortunate events are “business as usual” in Afghanistan, and the insurgent networks will continue to seek and use windows of opportunity to plan and execute such kinetic actions aimed at thwarting international efforts to stabilize the country.

Due to the nature and large number of missions they have to plan and conduct in Afghanistan, SOF members, as well as strategic level coalition leaders are the most exposed to this kind of attacks, and may become targets of opportunity for insurgents at anytime. It is paradoxical that we even teach some of those attackers, temporary infiltrated and members of the ANDSF, to organize for specific military missions, or help them equip themselves with weapons, ammunition and military equipment, including acquire and refine TTPs that can be used later on in attacking even CF members. Is this some sort of a compromise accompanied by risks? Are these risks calculated and assumed? Are the ROU SOF properly prepared, experienced and vigilant to prevent and favourably resolve such incidents initiated within the ANDSF they advise?

Current commanders at all hierarchical levels must be prepared to respond to such questions and are required to take all necessary steps to successfully bring back home all the Romanian service members sent to execute high-risk missions, in theater of operations abroad, outside the Romanian territory.