Survival in the Russian Occupied Zone

Command and Organization in Resistance Underground Operations


Col. Kevin D. Stringer, PhD, U.S. Army Reserve

Download the PDF PDF

Latvian national guard soldiers

With renewed U.S. national security focus on great-power conflict and competition, specifically with peer competitors China and Russia, a comprehensive understanding of unconventional warfare and related resistance operations becomes a significant objective for U.S. special operations forces (SOF) and the broader conventional land component. The U.S. Department of Defense explains a resistance movement as “an organized effort by some portion of the civil population of a country to resist the legally established government or an occupying power and to disrupt civil order and stability.”1 A recent definition in the joint Swedish Defence University/U.S. Special Operations Command Europe Resistance Operating Concept offers a slightly different characterization for legitimate governments aiming to restore their sovereignty. The Resistance Operating Concept describes resistance as “a nation’s organized, whole-of-society effort, encompassing the full range of activities from nonviolent to violent, led by a legally established government (potentially exiled/displaced or shadow) to reestablish independence and autonomy within its sovereign territory that has been wholly or partially occupied by a foreign power.”2 Using the Swedish variant for this article, resistance capabilities provide a sovereign nation an additional element of national defense that contributes to deterrence against an adversary, imposes real costs on an occupier, and sets conditions for the liberation of occupied national territory. A strategy of resistance coupled with conventional military forces can make a nation “indigestible” in the face of an occupation.3 A significant component for successful resistance operations is a survivable and sustainable stay-behind underground network.

While underground or stay-behind resistance networks are important considerations in all theaters, the European theater, with relevant European historical examples, demonstrates the need for a threatened state to articulate a clear national purpose for its stay-behind organization and establish a structured clandestine cellular network for the survivable core of its resistance effort. Russian forces or proxies currently occupy portions of sovereign Ukraine, Georgia, and Moldova, and the threat of Russian aggression and the resulting partial occupation of territory is a real concern for any state bordering Russia. For such countries, prudent national security measures require that resistance operations be integrated into national defense planning.

A better understanding of resistance activities will assist U.S. SOF and the U.S. Army in effectively supporting threatened allies and partners against peer adversaries. Particularly for the U.S. Army, this knowledge will aid in planning for liaison and synchronization activities with allied resistance underground networks to achieve campaign and liberation objectives.

Resistance Components and the Underground or Stay-Behind Network

According to U.S. doctrine, “the primary components of the resistance model are the underground, the guerrilla or armed force, the auxiliary support to the underground and guerrilla or armed force, and the public component.”4 While all resistance actors are equally important and should be planned for, there is no neat division between these components.5 Although each can operate with a mixture of clandestine, low-visibility, covert, and overt actions given this inherent fluidity, this article concentrates on the underground due to its centrality when occupier repression is extreme.6 This emphasis supports the assumption that in any occupation scenario, Russia will have an extremely capable repressive apparatus to include advanced network penetration capabilities.7 Additionally, the underground is probably the least understood or recognized element by the current U.S. SOF and Army communities.

The underground is “a cellular covert element within unconventional warfare that is compartmentalized and conducts covert or clandestine activities in areas normally denied to the auxiliary and the guerrilla force.”8 The underground aligns closely with the concept of a stay-behind organization as promulgated in the historical examples to be examined. While U.S. doctrine discusses a broad stay-behind resistance operation as “an operation in which indigenous authorities leave personnel and resources in position before, during, and after a foreign occupation to conduct anticipated resistance activities against the occupying power,” a more narrow European perspective promulgates that “stay behind organizations are secret networks organized by a state in preparedness for resistance activities during an eventual enemy occupation.”9 Like an underground, these networks are responsible for the overall command and control (C2) of a resistance under national government control.10 According to a joint special operations report, “The main purpose of this organizational form is long-term survival in order for the movement to reach its desired political end state.”11 These networks are not guerrilla or auxiliary formations but clandestine cellular entities that would form the fluid and survivable leadership core for the other elements of resistance in an occupied zone, especially in the Baltic, Balkan, and Nordic regions.

The National Political Objective and the Command-and-Control Conundrum in Resistance Operations

Already a challenge in conventional military operations, C2 of resistance elements by national authorities in occupied territory takes on added complexity. Not only is national governance potentially dispersed between a government-in-exile, a local administration under occupation, and a shadow government, but a plethora of friendly armed formations can exist simultaneously in an enemy occupied zone—residual conventional armed forces, special operations forces, territorial defense units, police, volunteer civilian groups, and even allied military teams. To master this situation, a national authority must provide guidance on the objective of the overall resistance and decide on the right balance between centralized and decentralized C2 for its stay-behind underground network.

Since resistance is ultimately a political activity, for nations vulnerable to Russian occupation, the common political objective is undoubtedly the restoration of the status quo antebellum; that is, the reinstatement of the legitimate government with all its previously attendant powers and full sovereignty over the entirety of its national territory.12 Yet resistance alone cannot free a country. Historical examples make the strong empirical case that external intervention is necessary for liberation. This necessity implies that the resistance underground for any country occupied by Russian elements must survive long enough for NATO or coalition forces to mount a response.

For a typical resistance organization, a state will have to leverage different degrees of centralization/decentralization depending on the level involved. While a centralized C2 allows greater operational control, provides better coordination across dispersed elements, and increases alignment with pre-occupation national legal and policy frameworks for legitimacy, its construct creates high vulnerability. Adversary infiltration is the bane of any resistance movement. The adept opponent can infiltrate an overly centralized organization, map its network, and in time, destroy it. Conversely, a decentralized approach places authority and accountability, within predetermined guidance, at the local resistance commander level. With proper compartmentalization, this decentralized organizational structure hardens the underground and other resistance components against adversarial penetration and allows rapid adaptation to dynamic local conditions. The disadvantage is that resistance elements are dispersed, and national leaders, potentially in exile, cannot mass capabilities or exercise governance on resistance forces for effect. Also, there is the risk that isolated resistance units exceed authorities or pursue their own objectives. Decentralization further requires a mission command ethos and maturity among subordinate resistance leaders who both understand and can execute the intent of their governmental authorities.13

Nevertheless, U.S. doctrine has historically favored decentralized command, and, in the case of compartmented stay-behind organizations, decentralization seems to be best practice since this arrangement provides the highest degree of security.14 This C2 exploration is relevant since a distinguished unconventional warfare expert, Derek Jones, noted that theories and postulations about effective resistance organizations without leadership are based on social movement theories that are not applicable in the real world, especially against highly capable state adversaries. He argues that a certain level of centralized leadership is necessary to develop an effective strategy and to articulate a common vision.15 His perspective is reinforced by the study Undergrounds in Insurgent, Revolutionary, and Resistance Warfare, which states that an effective underground needs concerted action from a centralized but protected command, while keeping its activities decentralized for security reasons.16 In the case of those countries threatened by Russia such as the Baltic or Nordic countries, the stay-behind underground network has to find the appropriate C2 balance for survival while maintaining pressure on the occupier and setting conditions for intervening forces to liberate the occupied territory. For this objective, the underground must be clandestine and cellular but with a degree of centralized control.

Photo of the exiled Polish government in 1943

Several historical examples help to frame a possible approach. First, the Estonian Forest Brothers experiences in both the 1941 Summer War and the subsequent post-World War II resistance period (1947–1950) reflect the challenge of balancing this centralization versus decentralization conundrum as well as having a realistic view to external support and intervention. Subsequent Cold War initiatives by the Swiss, Dutch, and Norwegian governments demonstrate the potential value of cadre-based clandestine cellular stay-behind underground formations to reduce vulnerability to adversary infiltration while maintaining national control.

The Estonian Experience in the 1940s

In June 1940, the Soviet Union occupied and annexed Estonia as part of the 1939 Molotov-Ribbentrop Pact that divided Eastern Europe into German and Soviet spheres of influence. Estonians began a variety of resistance activities, and those fleeing into the countryside from Soviet internal security forces became the foundation for Forest Brothers resistance groups. These bands lacked a guiding central authority and an overall command structure, leading to weaknesses in coordination, logistics, information sharing, and unity of purpose. Yet, this decentralized structure created ambiguity and provided a natural compartmentalization, making Soviet counterresistance efforts more difficult.17 Nevertheless, with no national guidance and no hope for an external intervention, these bands could not achieve the political goal to restore Estonian national sovereignty, hence their structures only contributed to survival.

Left Quote

Resistance alone cannot free a country. Historical examples make the strong empirical case that external intervention is necessary for liberation.

Right Quote

When the Soviets returned in 1944 and reoccupied Estonia, the post-World War II Forest Brothers’ movement faced the organizational dilemma of deciding between establishing a centralized or a decentralized C2 arrangement. Interestingly, Richard Saaliste, one of the prominent Forest Brothers leaders, rejected alignment with the already formed Estonian Armed Resistance Union based on its conventional organizational structure, which he viewed as premature without the prospect of Western armed intervention.18 The former condition was never met, and subsequently, Soviet internal security forces exposed the network that resulted in the destruction of the Armed Resistance Union. Saaliste instead chose a decentralized Forest Brothers organization, cellular in structure to longer endure Soviet repression, but in the end, his group also succumbed.19

A major problem for his organization was the viability of armed resistance in the absence of foreign intervention. Despite the failures of the Estonian resistance in both these periods, this vignette demonstrates the critical importance of the correct C2 and organizational design for a survivable resistance organization, especially an underground, to ensure its survivability until Allied intervention occurs.

Cold War Stay-Behind Organizations

The Cold War spawned several concepts for resistance, chief of which was the clandestine cellular stay-behind network. The impetus for these formations was the German occupation legacy of World War II, the Soviet annihilation of the Estonian and other resistance movements in Eastern Europe, and recurring Soviet aggression. This latter belligerence was manifested by the suppression of the 1956 Hungarian uprising, the 1968 Soviet-led invasion of Czechoslovakia, the 1979 Soviet assault on Afghanistan, and the 1981 martial law crackdown in Poland.20 Three countries—Switzerland, Netherlands, and Norway—provide valuable insights into these Cold War organizations.


In 1979, the Swiss government established the P-26 organization from a predecessor formation. As explained in the article “Building a Stay-Behind Resistance Organization: The Case of Cold War Switzerland Against the Soviet Union,”

Defense planners conceived of P-26 as a top-down, cadre-led structure rather than a broad, decentralized civilian resistance movement …. The government tasked P-26 with recruiting and training core personnel who could continue the fight after an occupation. The P-26 organized into three levels. The P-26 command staff consisted mainly of senior military officials on civilian contracts or secondment. On the second and core level, the cadre organization formed the secretive and well-trained nucleus of the resistance underground. This formation possessed a decentralized organizational model based upon the development of distributed clandestine cells. The third level would only have been recruited by the cadre organization if Switzerland had come under foreign occupation.21

As the foundation for an underground, the P-26 organized as a cadre-based clandestine cellular network, directed by the national government but hidden by a front company and recruited from unobtrusive members of the population with no or limited ties to the military or police. P-26 was not a military unit but a Ministry of Defense civilian entity.22 Although not tested during the Cold War, the P-26 achieved a high degree of secrecy and security throughout its existence—it remained unknown within a democratic society for over a decade and its membership remains partially obscured even today. While this level of security is laudable, this situation is not comparable to the repressive environment existing during an actual occupation against a motivated occupier.

The Netherlands

Similarly, for more than forty-five years, the Dutch government maintained a stay-behind capacity derived from its World War II experience and the perceived Soviet threat. Originally, two initiatives emerged—the first designed for intelligence collection and the second to provide the nucleus for civil resistance in an occupied Netherlands.23 Given coordination issues and friction between the two formations, the Dutch government amalgamated them and mandated a combined organization with an intelligence collection assignment and a psychological warfare mission to support the morale of the population in occupied territory. Structurally and like the Swiss, the Dutch stay-behind formation used a cadre-based clandestine cellular network design that could then set up a larger field organization in wartime. Under this construct, by 1990, the Dutch had a framework of sixty regions, managed by a thirty-person staff, with twenty-three regions assigned intelligence tasks.24 Similar to the Swiss case, the Dutch achieved organizational secrecy during a peacetime environment through a compartmentalized network approach while maintaining effective governmental control. The Dutch underground arrangement was also not tried by actual occupation.


Given Norway’s unique geopolitical position adjacent to the Soviet Union, already in 1945, Defence Minister Jens Christian Hauge expressed the need for a resistance network in the case of future enemy occupation.25 Organized under the Norwegian Intelligence Service, the stay-behind network would conduct both intelligence and sabotage operations against the Soviets. In 1952, Vilhelm Evang, head of the Norwegian Intelligence Service, articulated that “Stay Behind was first and foremost an instrument at the disposal of national governments wherever they might happen to be, and that its primary task was to form the nucleus for the recapture of temporarily lost areas.”26 Like the Swiss and the Dutch, the Norwegian stay-behind element was a cadre organization during peacetime. It operated in all relevant districts. For example, the secret organization Rocambole, established from earlier stay-behind formations, consisted of fifteen five-man groups. These teams were organized as cadre, with only the leadership receiving training in peacetime and other members nominated but dormant until crisis. Once the Soviets occupied Norwegian territory, the established skeleton would expand to a much larger clandestine cellular network.27 For almost five decades, this Cold War stay-behind network maintained a high degree of security, secrecy, and compartmentalization within a democratic society while remaining under positive government control.28 It too was never tested in the crucible of occupation.

In retrospect, these three historical cases from the Cold War provide credible reasons to evaluate a cadre-based clandestine cellular network as the design of choice for a planned stay-behind organization within a national defense plan. This arrangement allows for state directed planning and preparation in peacetime while providing a potentially survivable and sustainable construct in an occupation scenario. Additionally, with a carefully orchestrated information release, public knowledge of such planning can contribute to deterrence and impact adversary risk calculations.

Challenges and Open Issues

While a hierarchically directed clandestine cellular network may be the best C2 arrangement for underground resistance operations as part of precrisis national defense planning against a foe with extreme repressive capabilities, network vulnerabilities may still exist. In reflecting on Middle Eastern counterinsurgency experience and its application to nonstate actors, a sovereign state should assume a Russian adversary will target the mid-level network operatives in all the resistance components—planners, financiers, trainers, recruiters, and cell leaders.29 With this situation in mind, the organizational designers must build survivability, redundancy, and protection into the overall resistance, especially in the stay-behind underground network. Best practice would indicate that in peacetime during national defense planning, C2 can be centralized and well controlled. When the occupation occurs, resistance organizations must change to a less centralized but directed cellular network structure in order to avoid adversarial penetration, co-option, or destruction.30 While a cadre-based clandestine cellular stay-behind formation provides a solution, there are several challenges to be resolved and further researched.

Photo of Lithuanian resistance fighters

First, there is a lack of expertise in establishing such organizations, and NATO and coalition counternetwork experience against al-Qaida, the Taliban, and the Islamic State undergrounds may not directly translate into setting up a survivable clandestine cellular stay-behind network against Russia. Second, the historical vignettes provided by Switzerland, the Netherlands, and Norway offer a potential path for exploration, but these undergrounds were never tested under live conditions during the Cold War. Third, the primacy of the underground in resistance operations may apply well in the unique geographical and demographical conditions of the Baltics and Nordics, but a more holistic view to resistance may be necessary in other locations like Georgia, Poland, Romania, and Ukraine.

Finally, if a relevant state establishes a clandestine cellular stay-behind formation as part of its national defense planning, then some thought needs to be given to connecting this organization to the broader resistance potential of the population. A sovereign government intending to harness this inherent resistance energy in a loyal population must provide broad guidance on civil resistance and preparedness to the national citizenry prior to an actual occupation and link it to the stay-behind underground. An excellent example of this preparation is the Swedish government’s official pamphlet titled If Crisis or War Comes, which it has distributed to the entire population. Within this document, the government explicitly directs that “if Sweden is attacked by another country, we will never give up. All information to the effect that resistance is to cease is false.”31 The next step is melding this effort to provide an amplifying effect to the clandestine cellular stay-behind organization to impose costs on an invader and win time until occupied territory can be liberated. In the end, the more that U.S. SOF and the U.S. Army understand about the complexities of resistance and the broader unconventional warfare realm, the greater effect they will have in supporting threatened allies and partners in peacetime preparation, during competition, and potentially in conflict.


  1. Field Manual 1-02, Operational Terms (Washington, DC: U.S. Government Publishing Office [GPO], November 2019), 1-89.
  2. Otto C. Fiala, Resistance Operating Concept (Stockholm: Swedish Defence University, 2019), 15, accessed 6 January 2021,; After Action Report (Krakow, Poland: U.S. Special Operations Command Europe Multinational Resistance Writing Workshop, 26–27 April 2016).
  3. A. Wes Mitchell, “The Case for Deterrence by Denial,” The American Interest, 12 August 2015, 4.
  4. Army Techniques Publication (ATP) 3-18.1, Special Forces Unconventional Warfare (Washington, DC: U.S. GPO, March 2019), 2-11.
  5. Jeff Hasler, “The SORO Resistance Pyramid Challenged: Critical Observations and Questions on a Classic,” Special Warfare 30, no. 3 (2017): 10–27.
  6. Ibid., 25; ATP 3-18.1, Special Forces Unconventional Warfare, 2-11.
  7. David Kilcullen, “The Evolution of Unconventional Warfare,” Scandinavian Journal of Military Studies 2, no. 1 (June 2019): 63.
  8. Army Doctrine Publication (ADP) 3-05, Special Operations (Washington, DC: U.S. GPO, 31 July 2019), 2-10.
  9. ATP 3-18.1, Special Forces Unconventional Warfare, Z-1; Leopoldo Nuti and Olav Riste, introduction to “Special Section: Preparing for a Soviet Occupation: The Strategy of Stay Behind,” Journal of Strategic Studies 30, no. 7 (December 2007): 929.
  10. Derek Jones, Understanding the Form, Function, and Logic of Clandestine Insurgent and Terrorist Networks: The First Step in Effective Counternetwork Operations, JSOU Report 12-3 (Tampa, FL: Joint Special Operations University [JSOU] Press, 2012), 13.
  11. Ibid., 61.
  12. Fiala, Resistance Operating Concept, 19.
  13. ADP 6-0, Mission Command (Washington, DC: U.S. GPO, 2014).
  14. ATP 3-18.1, Special Forces Unconventional Warfare, Z-2.
  15. Jones, Understanding the Form, Function, and Logic, 24.
  16. Paul J. Tompkins Jr., Undergrounds in Insurgent, Revolutionary, and Resistance Warfare (Fort Bragg, NC: United States Army Special Operations Command and Johns Hopkins University National Security Analysis Department, 2013), 12–13.
  17. Olavi Punga, “Estonia’s Forest Brothers in 1941: Goals, Capabilities, and Outcomes,” Combating Terrorism Exchange 3, no. 3 (August 2013): 30–38.
  18. Martin Herem, “The Strategy and Activity of the Forest Brothers: 1947-1950,” Combatting Terrorism Exchange 3, no. 3 (August 2013): 39–53.
  19. Ibid.
  20. Olav Riste, “‘Stay Behind’: A Clandestine Cold War Phenomenon,” Journal of Cold War Studies 16, no. 4 (Fall 2014): 59.
  21. Kevin D. Stringer, “Building a Stay-Behind Resistance Organization: The Case of Cold War Switzerland Against the Soviet Union,” Joint Force Quarterly 85 (2nd Quarter 2017): 109–14.
  22. Titus J. Meier, Widerstandsvorbereitungen für den Besetzungsfall: Die Schweiz im Kalten Krieg [Resistance preparations for the occupation: Switzerland in the Cold War] (Zurich: NZZ Libro, 2018), 251, 264–71; Stringer, “Building a Stay-Behind Resistance Organization,” 112.
  23. Riste, “‘Stay Behind’: A Clandestine Cold War Phenomenon,” 43–44.
  24. Dick Engelen, “Lessons Learned: The Dutch ‘Stay-Behind’ Organization 1945–1992,” Journal of Strategic Studies 30, no. 6 (2007): 981–96.
  25. Riste, “‘Stay Behind’: A Clandestine Cold War Phenomenon,” 47.
  26. Olav Riste, The Norwegian Intelligence Service: 1945–1970 (New York: Routledge, 2013), 43.
  27. Olav Riste, “With an Eye to History: The Origins and Development of ‘Stay-Behind’ in Norway,” Journal of Strategic Studies 30, no. 6 (2007): 1011.
  28. Fiala, Resistance Operating Concept, 184.
  29. David Kilcullen, Counterinsurgency (Oxford, UK: Oxford University Press, 2010) 220–21.
  30. Paul Tompkins and Chuck Crosset, Casebook on Insurgency and Revolutionary Warfare Volume II: 1962-2009 (Fort Bragg, NC: U.S. Army Special Operations Command), 673–74.
  31. If Crisis or War Comes (Karlstad, SE: Swedish Civil Contingencies Agency, May 2018), 12.


Col. Kevin D. Stringer, U.S. Army Reserve, is a Eurasian foreign area officer and strategist assigned to U.S. Special Operations Command Europe. He is currently a faculty member at the U.S. Army War College. He holds a BS from the U.S. Military Academy at West Point, an MA from Boston University, an MSS from the U.S. Army War College, and a PhD from the University of Zurich. As a civilian professor at the University of Northwestern Switzerland, affiliated faculty at the Military Academy of Lithuania, and a Fellow at the Centre for International and Defence Policy, Queens University, his research interests are special operations, unconventional warfare, and multinational operations.


Back to Top

July-August 2021