IPB: Evaluate the Threat

This post is the fourth in the series on Intelligence Preparation of the Battlefield and the Community.  In the previous post, I discussed Describing the Battlefield’s Effects.

Evaluating the threat is probably my favorite part of conducting Intelligence Preparation of the Battlefield (IPB).  Evaluate the Threat really lets your mind wander and consider all the possibilities of threat force employment.  It’s a leave no stone unturned kind of exercise in a thinking man’s war.  If you don’t have a philosophical warfighter in your tribe, get one!

The Military Intelligence Creed states that the philosophical warfighter is

Always at silent war, while ready for a shooting war; the silent warrior of the Army team.

IPB is the first task of silent war so let’s get started.

Our goal in this step is to determine the threat force capability by identifying established doctrine, tendencies, order of battle, and organization of the adversary.  The consequence of failure is

The threat will surprise the friendly force with capabilities that the [intelligence element] failed to account for.

Create Threat Models.

Threat models are simply organizing the qualities we know about the enemy, how they think, how they act, and how they respond to friendly force activity.  We previously discussed enemy ‘doctrine’ – or, the collection of previous known enemy actions and tactics, techniques, and procedures (TTP).  Knowledge of enemy doctrine is critical in developing accurate threat models.

For instance, we follow reports from our intelligence collectors – police reports, local news outlets, or the grapevine – and we learn that around 10-15 individuals are being led by a man named Leroy Jenkins.  This gang uses assault rifles in a neighboring town to rob homes with two car garages. (In a later post, I’ll cover how to grade sources on reliability.  Sources with higher grades are going to be more trustworthy and should have a greater weighting when considering new information.)  Now we have a really good start to creating a threat model.  The first thing I would do is name this group.  In this scenario, they’re going to be the Leroy Jenkins Gang (LJG).  If the future of gang warfare is anything like Iraq and Afghanistan, get ready to name gangs (cells or insurgent groups) and track them.  If they split into separate groups, be proactive and delineate them in your records. (These steps are going to be the same whether you’re just fending off ‘zombies’ or in the event you find yourself under stormtrooper occupation.)  Please trust me when I say that this effort is worth your time!  When it comes to dealing with or defending from these groups, having a knowledge of your adversary is going to be critical whether you deter, navigate, or simply destroy the threat.

You’ll want to start a database and record this information.  To evaluate the threat we must find, know, and never lose the enemy.  We need to track him, watch how he changes in the course of events and how those events affect his actions on the battlefield.  In a later post, I’ll cover writing Intelligence Information Reports, why they are critical in getting out actionable intelligence into the hands of your peers and other tribes, and how to disseminate them.

To record information about adversarial groups, I would use a platform where manipulating data is easy, that you can store digitally, that you can encrypt, and that you can send over the internet or just as easily write down for dead drop communication.  My poisons of choice are Powerpoint and Spreadsheet.  Even if you don’t actively record this information, please create a mechanism to pass this information somewhere.  Maybe you trust your local militia because they’re squared away and protect you — then send it to them!  Every militia or defense group should have an intelligence element, whether it’s one person or an entire intelligence cell.  If they don’t, they’re wrong. Every piece of information is important and, to modify another borrowed Army phrase, every Patriot is a sensor.  (In a later post, I’ll cover Trends and Predictive Analysis.  Predictive analysis is predicated on using patterns in the adversary’s planning, supply, or operational cycles to predict the time and place of his next action.)

You may not be able to passively collect enough information to establish an enemy’s doctrine.  If the information seemingly just isn’t there, then spread your collection net.  Inform other locals about the situation and ask that they inquire with others.  If gangs are active around your home or retreat location, then useful information exists somewhere.

At a minimum, here’s a short list of information you should collect about adversarial groups (yes, it’s a modified SALT/SALUTE report):

Size.  How large or small is this gang reported to be?

Activities.  In what activities do they engage?  If they only rob stores, then your home may be safe.  If they only rob homes, then you should take additional measures to deter the threat.

Locations. Is the gang active in a neighboring subdivision or your own?  Either way, are their targets moving close or further from your home?

Times. Do they attack mainly at night, early in the morning, etc?

Equipment.  Do they use baseball bats and crowbars or do they have small arms?

Tactics and Options.

Gather information on how the Leroy Jenkins Gang carries out its robberies or raids.  That’s an intelligence gap so collect that information.  In this example scenario, the LJG begins well into the early hours of the morning, drives a truck into the driveway of the target home and breaks into two groups of five.  The first five have previously identified a side door or window closest to the stairs and master bedroom, which they break down to gain entry and clear the top floor.  Simultaneously, the other five kick in the back door or window and secure the basement and/or middle floor.  Speed, surprise, and violence of action.  The LJG then steals precious metals and jewelry, weapons, maybe some miscellaneous gear, and forces the husband/father to open the safe; in all, they’re out in ten minutes or less with no shots fired.  A second vehicle is waiting on a different road nearby the house to exfiltrate one team and the gear, while the initial vehicle collects the remaining members and leaves.

If the above scenario has happened more than once, isn’t this a critical piece of information? About how long did each robbery take?  What does the attacker do if the attack fails or they take fire?  Do they engage with overwhelming firepower (~9:1) or do they break contact with what they have and retreat?  Once we have the tactical actions – the lowest common denominator – of these attacks, we add them to the list of tactics and options.

One step further, were two robberies conducted simultaneously in one night and, if so, based on the doctrine of the LJG, can we assess that the two robberies were affiliated?  Can we assess that the LJG has grown, that it has expanded its capability to conduct multiple attacks in one night; or that it’s operating in conjunction with a separate but affiliated gang?  If there’s a second, unaffiliated gang then we need to go back to the beginning of Evaluate the Threat and formulate a doctrine for the second group.

FM 34-130 goes into identifying High Value Targets, which represents a more offensive nature of IPB.  We’ll cover this part of the step in a totally separate post.

Identify Threat Capabilities.

What are the exact demonstrated capabilities the LJG?  We’ve seen they’re capable of mounting two simultaneous robberies in one night.  We’ve seen that the LJG has grown to at least 20 members and can wait as little as ‘x’ days before conducting another robbery.  We’ve seen that the LJG can infiltrate  an objective with 10 members in one vehicle and exfiltrate those members using two vehicles.  We’ve seen that the LJG can rob a home in ten minutes or less and has the capability of forced entry into homes.

If the LJG has pushed in multiple empty garage doors to initiate a robbery and have stolen firearms from each home, then we can then say they likely have a surveillance and reconnaissance capability.

Additional Considerations.

If LJG members were conducting robberies unarmed or largely unarmed, and a local gun store was robbed the previous night; then my assumption would be that the LJG is now heavily armed.  If confirmed, then they have new capabilities and their previously used TTPs will change.

If five members of the LJG were arrested, then my assumption would be that their operational tempo would slow.  If they conducted two robberies per week, then it might be a week or two before they can recruit new members and start conducting robberies again.  They might cease operations in Neighbortown and start operations in Nearbytown where the environment is more permeable, less defensible, and/or has a smaller law enforcement footprint.

If the LJG continues to operate in the uncovered backs of trucks, they might be adverse to operating during inclement or very cold weather.  If they conduct operations one night before or one night after a heavy rain, you could make a note in their doctrine.

If the LJG was in a large firefight and expended a lot of ammunition, when and what was their next action?  If they immediately continued armed operations, one could assume that they have an adequate supply of ammo.  If they began to conduct robberies where not all members had firearms, one could assume they were now running short on ammunition.  (Of course, we can’t make judgements based on one event, but these are the types of questions we should be answering when conducting intelligence analysis.)

The list of additional considerations is as long as you want to make it, but is potentially endless.  I can’t cover every single scenario; and each scenario may mean something entirely different that what I’ve written above.  Use your best judgement.


The Leroy Jenkins Gang is just a very simple example to demonstrate how to evaluate a threat.  In reality, situations could be much more complex, especially when taking into account both zombies, stormtroopers, and/or multiple criminal elements.  Again, if you have any questions or comments, please leave a comment or email me and I will do my best to answer.

Part Five is Determining Threat Courses of Action. New parts in this series are published on Mondays.

Comments are closed.

%d bloggers like this: