Photo caption: Through his interpreter, an American advisor converses with his Afghan Army counterpart on an ANA FOB. The U.S. soldier is wearing personal protective equipment while armed soldiers serve as ‘guardian angels’ prepared to deal with any aggressors. [1]
By Chris Martin
Green on blue attacks have happened in the past in Afghanistan, and will continue to occur. Not all attacks can be stopped, but I believe they can be reduced significantly. Many attacks happen because complacency occurs with our host nation counter parts. As a former State Department Law Enforcement Advisor who trained the Afghan National Police (ANP), the National Directorate of Security (NDS), and the Afghan Local Police (ALP) comprehending why these attacks continue and more importantly, how to counter them, is a great concern to me. While in close and continual interaction with these security groups, through training and conducting operations, I have come to understand that having superb knowledge of your counterparts, including establishing their normal behavior and identifying any changes, is the preeminent way to thwart an insider threat attack. There will always be pre-event indicators preceding an attack, but it is contingent upon the advisors to be intuitively attentive to recognize the signs.
Behavioral Changes
When I was assigned to the Special Operations Task Force South (SOTF-South) in Afghanistan (2010-2012), I provided weapons training to the ANP. I observed the soldiers’ behaviors during dry fire and live ammunition exercises. My goal was to determine whether they exhibited any noticeable changes in performance. As an example, one particular ANP Officer’s conduct had become erratic; he indirectly flagged his counterparts and advisors with a loaded AK-47. I discussed his behavior with a another instructor. The ANP had been advised of the cardinal rules of safety before being permitted on the range. This ANP Officer, while handling a loaded weapon, failed to comply with directives given to him from the advisors. At this point, I had all the other ANP officers put their weapons down on the ground and had an advisor take up a protective posture with a weapon aimed in the direction of the ANP Officer. I took the ANP officer’s weapon, unloaded it, and had him sit down. I then notified the District Chief of Police (DCoP). It was behavioral changes of the ANP officer that alerted me that something was amiss.
In another instance, a different advisor and I led the ANP on a walking patrol through a village. At the start point, the ANP refused to go. This sudden refusal had not occurred in the past and I was obviously curious to this change and questioned the ANP officer in charge, who stated that he just did not want to do the patrol. My immediate thought was he must have knowledge about a possible attack. I asked him once again, what the problem was. He would only state that he and the patrol were not going. I notified the DCoP who later told me that the other ANPs were taunting them because they were walking through the village to conduct community oriented policing or COP. (The ANP liked COP, but they didn’t like to walk to the villages because of the distance.) Yet again, the change in behavior signified that something was awry.
Airports/Hotels
Insider attacks can take place almost anywhere. Airports and hotels are just a few of the many different places where a green-on-blue event could take place. Perhaps you are wondering, how insider attacks can be identified and countered at an airports and hotels? All airports are different, but the functions are the same. Because everything has a norm or routine, it’s important to be able to recognize what those standards are; anything that deviates should be detectable. Afghanistan airports have security, including the ANP and other security personnel; and one should pay close attention to their behavior.
When participating as a guest panelist (April 2018 at Morgan State University, Baltimore, Maryland), someone asked me how to describe the norm for a hotel that you had never been in before. My response was, because I have been in numerous other hotels, I have a general idea of what to expect in any hotel. You can easily determine what is different about a hotel and whether there are any significant and noticeable changes if you – on a normal basis, – observe the normal activities taking place in a hotel. Establishing a baseline of activities and then detecting anomalies and then responding to the event will help you to anticipate and avoid violent situations. One should always be aware of anything that digresses from repetitiveness. As I stated earlier, there will be behavioral, pre-event indicators prior to any attack.
Afghan Security Shuras
As an advisor, it is necessary to be mindful when attending security shuras, where a large group of leaders assemble; this setting offers a lucrative target for insurgents. Keep in mind, many Afghan leaders from the ALP commanders, NDS chief, ANDSF commanders, District Chief of Police (DCoP), and the District Governor (DGov) are usually in attendance. On the USG side, will be found the US counterparts of different ranks and organizations. This is a perfect scenario for the Taliban or Islamic State of Iraq and Syria (ISIS) to stage an insider attack to kill US and Gov’t of the Islamic Republic of Afghanistan officials and personnel. Keep in mind, all Afghan Security Forces are armed.
During security shuras, I sat at the opposite end the table from the District Governor. I was closest to the door in anticipation that someone from the Afghan security forces may begin shooting or a suicide bomber may try to kill my counterparts. One method of insider attack that is common is members of the ANDSF opening fire with a PKM from one of the Ford Rangers as USG personnel are leaving the security shura. What can be done to mitigate this? Thinking through the various attack scenarios will help in determining and executing proper responses. It is important to put yourself in the position of the enemy; learning to think like the enemy. This will help you anticipate attacks and identify pre-attack indicators.
Cellphones – ANDSF and Interpreters
Of course, we all know Operational Security (OPSEC) is important. When we went on vehicle patrol with the ANP, we did not tell them our destination, until the very last-minute. And we never told the local interpreters where we were going. Only the US born interpreters with security clearances were informed of our whereabouts. As a safety precaution, if we did tell a local interpreter, we gave a false location. What you have to be concerned about is local interpreters making calls inside or outside the wire to an insurgent who could then organize an attack or hasty ambush. Certainly there are pros and cons to this approach. Now that the Afghans are firmly in the lead for security operations this becomes a less viable option – for a number of reasons.
Human Behavior Pattern Recognition and Analysis and Insider Threat Situational Awareness Training
The Advanced Situational Awareness Training (ASAT) and Insider Threat – Situational Awareness Training (IT-SAT) courses should be mandatory for all advisors of Special Forces, Marine Corps Special Operations Command (MARSOC), and Security Force Assistance teams conducting Foreign Internal Defense (FID) and Security Force Assistance (SFA) missions. ASAT is a human behavior pattern recognition and analysis program that is a key tool to anticipate and avoid violent situations before they unfold. [2]
US Army Special Forces personnel, as a result of their intensive training in FID and experience in other special operations missions, have a higher level of knowledge of this topic. The Security Forces Assistance Brigades (SFAB) should make this course mandatory for their advisor teams, because it will save lives.
IT-SAT explains in-depth how your body works and perceives situations. It incorporates the 6 domains (heuristics, geography, proxemics, biometrics, atmospherics and kinesics), the 5 combat multipliers (tactical cunning, tactical patience, geometries of fires, guardian angel, and good shepherd), and the combat rule of 3’s (picking out 3 anomalies that don’t fit in big picture). When you apply all of these concepts, you will be able to make a predictive analysis based upon the behavior and actions of individual(s). This can be applied anywhere US forces are conducting SFA. The bottom line is human behavior is the same all over the world. This is why the IT-SAT course is so important to our preserving our troops well being.
Conclusion
We are losing too many advisors to insider threat attacks. The attacks will not stop because the Taliban know it is an effective method to breach the trust between the US / NATO personnel and the ANDSF. The Taliban also know that with an increase in green-on-blue incidents the Resolute Support advisors will adopt more protective measures that will be counterproductive to the overall Train, Advise, and Assist (TAA) mission. If you are an advisor to the ANDSF you need to be alert and aware, once you set foot inside Afghanistan you are on the battlefield.
**********
[1] Photo from “Facing the Insider Threat in Afghanistan”, Company Command, Association of the United States Army (AUSA), September 2013.
[2] There are a number of Insider Threat Situational Awareness Courses provided by different agencies, military organizations, and commercial firms. One current example is the NATO School at Oberammergau, Germany that offers a one week course. See N2-112, Insider Threat Situational Awareness Course.
References:
NATO in Afghanistan – An insider threat, NATO, August 20, 2012. A 4-min long video about the insider threat posed by members of the Afghan security forces.
www.youtube.com/watch?v=eZV83L5vWDk
“Advisors and the Insider Threat in Afghanistan”, Afghan War Blog, February 11, 2018.
www.afghanwarblog.com/2018/02/advisors-and-insider-threat-in.html
About the Author: Chris Martin was a Police Officer with the Metropolitan Police Department of Washington D.C. He has 25 years of law enforcement experience domestically and internationally. He was assigned to Special Operations Task Force South in Afghanistan, working as a Law Enforcement Advisor for the United States Department of State. He was also a United States Department of Defense Advisor / Law Enforcement Professional (LEP) assigned to ISAF- SOF in Afghanistan. He was a Tactics/Training specialist for Academi Training Center, training Nigerian Security forces on a Department of State Contract. Chris was also an Instructor for a leading irregular warfare consulting firm that is an affiliated Central Intelligence Agency based company. He taught Human Behavior Pattern Recognition and Analysis, Advanced Situational Awareness Training and Insider Threat Awareness training (ASAT/IT-SAT) to US and coalition forces in Afghanistan. He is the President of Martin Group International, LLC, an irregular warfare consulting firm from the Washington D.C. area. He has spent the last 20 months in Nigeria, the last nine in Abuja.
