Publishing Disclaimer: In all of its publications and products, Military Review presents professional information. However, the views expressed therein are those of the authors and are not necessarily those of the Army University, the Department of the Army, or any other agency of the U.S. government.

---

 

Paper and COIN

Exploiting the Enemy's Documents

 

Major Vernie Liebl, U.S. Marine Corps, Retired

Download the PDF

Most military members, especially those with operational combat experience, understand that intelligence drives operations. Unfortunately, getting good, actionable intelligence is almost always a formidable challenge, a truth borne out in our recent experience in Iraq and Afghanistan. In these two conflicts, most of the collection methods we have used—technical means such as imagery exploitation and signals intercepts—depended on the adversary being somewhat cooperative (although that adversary might not recognize it as such). For example, if signals intelligence is to work well, the enemy must employ some type of emitting or broadcasting equipment in sufficient numbers and times for meaningful intercept and analysis to be done. Likewise with imagery: the enemy must, even if he employs sophisticated camouflage, present himself at some point as a somehow identifiable member of his side. In an insurgency, however, where the enemy imitates the seemingly innocuous traveler or nomad and restricts his communications to word of mouth or passing of notes, identifying him and collecting intelligence about him become much more difficult. In such instances, human intelligence (HUMINT) may be the only effective method of gaining needed information.

Discussion about how to do HUMINT has mainly focused on extracting information from individuals by interrogation or debriefing (the former implying hostile extractions from prisoners, the latter suggesting neutral or friendly extractions from friendly forces, civilians, etc). In such cases, much of the value of the information derived depends upon the training, knowledge, ability, and stamina of the person conducting the interrogation, as well as the cooperativeness of the person being questioned.

Human intelligence can also be collected through personal tactical observation (static) or combat patrolling, with observations and reports being submitted during or after the duty period or patrol. Again, however, we need the enemy’s cooperation: he must come out of hiding and do something that we can observe.

There is one type of HUMINT, however, that does not require the enemy’s cooperation. That method is media exploitation, also referred to as document exploitation, or DOCEX.

Unfortunately, despite the real potential of obtaining intelligence information simply by reading the enemy’s paperwork, coalition forces all too often have ignored this means of collection. Sometimes they have simply overlooked exploitable information; other times, they have actively destroyed it before it could be examined. The following example is illustrative of such lamentable practices.

On 10 November 2003, U.S. forces conducted a raid into the mountains of Nuristan in Afghanistan. Their target was a small cluster of buildings, reportedly a Taliban administrative center, perched on the side of a mountain just south of the small town of Aranas. Information about the objective came from the highest levels, which meant it was not to be questioned, just acted on.

First the buildings were attacked by air, then they were assaulted and occupied by troops from the 10th Mountain Division (after a 2,000-foot uphill attack). Unusually, the raiding force included a follow-on multi-agency intelligence team. Its mission was to identify enemy casualties (by gathering DNA samples) and examine any documents or equipment that might be about.

Although the assault was vigorous, the results were disappointing: only three prisoners of questionable value were detained, and no Taliban casualties were confirmed. Moreover, the site didn’t seem to be the Taliban ops center higher level intelligence had claimed it was; in fact, it was hard to determine just what it was.

Much of the difficulty in determining the site’s nature was caused by the assault force’s lack of attention to media on the objective. Between the Soldiers’ occupation of the buildings and the intelligence team’s arrival, there was a delay of several hours. In that time, at least a third of the media, mainly loose papers and books, was blown away by high winds or burned by the troops to keep warm. (It was November and the site was in the foothills of the Hindu Kush, more than 6,000 feet high.) In fact, none of the troops picked up any of the media except to use it as kindling. To add to the problem, once the intelligence team arrived, its media collection effort was hampered by the presence of several unexploded 500-lb. bombs and the unstable nature of the ruined buildings. Animal and human waste on some of the loose papers—a not uncommon situation on such a secluded objective—also complicated the team’s exploitation effort.

The site’s apparent misidentification wasn’t the only deficiency in the imagery-derived intelligence sent to the Soldiers by higher. During its search for documents, the intelligence team discovered several discrepancies between the picture intel had painted of the complex and the actual complex. Extremely effective (and simple) camouflage and placement in the shadows of overhanging rock ledges had concealed some structures, while supposed buildings or potential bunkers turned out to be terraced farm fields or large rocks.

The eventual exploitation of the media remaining on the site was illuminating, although disheartening. Analysis indicated that the location was not a Taliban operations center, but a madrassa—an Islamic school. The largest area in which documents were eventually found was identified as the living quarters of the head of the madrassa. The materials turned out to be documents pertaining to education, including school rosters and a couple dozen Qurans. Several of the Qurans indicated that the flavor of Islam taught was Deobandi with influences from Saudi Arabian Wahhabist organizations and the Pakistani Ahl-e Hadithi (Lashkar-e Tayyiba), but there was no evidence of a military presence other than some Chinese-style (Mao) green uniforms, whose sizes indicated that they were to be worn by young boys roughly three feet tall. Whatever other clues may have existed linking the madrassa to the Taliban had literally disappeared in the wind or gone up in smoke.

The “ops center” mission points to obvious problems in a coalition process that favors technological over human intelligence collection and ignores DOCEX. By way of contrast, consider the potential nuggets of information that can be gathered simply by searching clothing.

On 19 January 2004, U.S. Special Forces (SF) killed a sniper in the Bermal Valley, Paktika province, Afghanistan. Recovered from the sniper’s body were 24 pieces of paper. Unable to interpret the papers themselves, the SF unit’s intelligence section requested immediate assistance, believing that any information recovered might be time sensitive. When examined by analysts with advanced linguistic and cultural skills, the bits and pieces of media indicated that the sniper had been a Taliban religious recruit from a madrassa most likely located in North Waziristan, Pakistan. He could be identified as Taliban (and not Al-Qaeda) by the presence of a religious amulet, a taweez, that indicates Sufi influence. (Al-Qaeda views Sufism as heretical.)

The bits of paper also disclosed phone numbers and instructions, in both Urdu and Pushtu, to contact certain persons in Afghanistan and Pakistan. Analysis uncovered a network that spanned from Pakistani areas within and east of the Federally Administered Tribal Areas [FATA] to locations in the Bermal Valley. Some of the phone numbers were traced to a number of front agencies in Pakistan working in the towns of Wana, Bannu, and Tank, and the city of Karachi. Other numbers were traced to the United Arab Emirates, Saudi Arabia, and South Africa, indicating the depth of support from abroad, likely Salafist at the least, Al-Qaeda at the worst, for one lone Taliban.

In another example, DOCEX was the key to exposing an enemy support network and its supply locations. On 27 December 2003, U.S. forces from the 1st Battalion, 501st Brigade, killed several insurgents in a firefight near Khost. From these individuals, the Soldiers collected 10 documents, 1 film negative, a small amount of cash, and three types of medicinal capsules. The material, which included taweez and several night letters in Pushtu from the “Islamic Emirate of Afghanistan” (the Taliban), revealed definitively that the insurgents were Taliban. It also indicated they were coming in from Pakistan, specifically from Miram Shah, and were probably headed for Ghazni to conduct propaganda missions (distribute the night letters) and possibly an assassination or an attack, referred to in the documents as a “wedding.”

The capsules the insurgents carried also yielded intelligence. They contained the kind of over-the-counter medications (aspirin, antacids, and topical analgesics) that a foot soldier commonly uses in the field, and they had been manufactured in Pakistan or China. Along with the insurgent’s “battle-rattle” and assorted personal items such as mirrors and combs, the capsules indicated that a particular Pakistani market supplied the Taliban, with specific foreign industrial concerns possibly benefiting directly from or contributing directly to the Taliban effort in Afghanistan.

In still another example, the translation in November 2003 of a night letter obtained by a British patrol in Faryab province (a northwestern Afghan province populated primarily by Uzbeks with some Turkmen and scatterings of Pushtuns and Arabs) caused quite a stir within the U.S. intelligence community and the staff of Combined Joint Task Force 180. The letter itself contained nothing unusual, as it repeated rather conventional Taliban themes calling for jihad against the government and the Americans and warning against sending children, especially girls, to school. However, where the letter had been found provided proof of the Taliban’s effort to reestablish itself in Afghanistan beyond the Pakistani border region and the traditional Taliban stronghold in south-central Afghanistan. Prior to the document’s discovery, the largely Uzbek areas of northern Afghanistan had been considered relatively free of Taliban influence.

Interestingly, the letter had been handed over to the British patrol by Uzbek villagers. The Uzbeks distrusted the Pushtun villagers “down the way” who were sending out the letters. These Pushtuns were one of the numerous small pockets of Pushtuns who had been forcibly relocated into northern Afghanistan in the late 19th century in a Pushtunization effort by the government of Amir Abdur Rahman. This, too, was intelligence that had operational and perhaps strategic implications.

Captured media can be very complex and yield surprising information, such as some documents taken in Bamiyan province in January 2004. Bamiyan was considered quiet and peaceful by the Karzai government, so almost no coalition forces, Afghan National Police, or Army forces had been assigned there. Its inhabitants, the Hazara (ethnically Mongoloid Shi’ites) favored the Karzai government and were inhospitable to the Taliban—a reasonable attitude considering the genocidal treatment meted out to them by Pushtun Sunni Taliban forces.

Exploitation of the documents taken in Bamiyan revealed that the Iranian Embassy in Kabul and the Iranian Consulate in Herat had trained and financed some of the Hazara to combat the Taliban. Ironically, the documents were Taliban investigative reports, taken from Taliban operatives. The documents also discussed Iranian efforts to penetrate the Taliban and the Karzai government, alluded to connections between Burhanuddin Rabbani’s Jamiat Islami organization and Iranian-sponsored militant Shi’a organizations, and named some of the commercial covers or ventures used by the Iranians and their Hazara associates in Bamiyan, Takhar, and Herat provinces.

Just how much information can be gained through DOCEX is apparent in one more example: the delivery of two letters by a foreign visitor to the commander of Forward Operating Base Kandahar in early 2004. The letters, in Urdu, were extremely informative.

Analysis showed the letters had been designed for a Pakistani audience, specifically for people attending mosques and madrassas. Meant to introduce the Taliban and to elicit aid and support from the Pakistanis, they lauded the Taliban as defenders of the faithful and the poor while depicting Americans, Jews, Indians, and UN personnel in the same light as communists and warlords. They called for Jihad and a return to Taliban rule that would reinstate Sharia (Islamic law), the perfection of Islamic rule, in Afghanistan. Sharia would solve all of Afghanistan’s problems, just as it had before the American invasion. A list followed detailing casualties inflicted by the Soviets in the 1980s, the number of Soviets driven out in the late 1980s, and the number of deaths the populace suffered during the warlord era.

Clearly affiliating Osama bin Laden with the Taliban, the letters worked by invoking Pushtun cultural norms: sanctuary/hospitality (for Osama), honor (which demanded that Osama be defended), and antipathy for Hindus and Persians (Shi’a heretics). They also sounded several staple themes, such as the 1998 Clinton-era cruise missile attacks and calls for an Islamic revival (establishment of a Dar al-Islam) and resurrection of the Caliphate.

In addition to such propaganda, the letters contained an appeal for donations and a prioritized list of the Taliban’s needs. Leading the list was cash, followed by warm clothing, food, and medical supplies. Interestingly, last on the list was support for the families of the dead, something usually omitted as it is assumed to occur automatically. This could have been interpreted in several ways: that Taliban casualties were heavier than had been anticipated and thus funds were inadequate; that there was less support for the Taliban than coalition intelligence assumed, and therefore families were not garnering the levels of sympathy and support expected; or that more Afghan refugee families had fled to Pakistan than was estimated, swamping the already overstressed and inadequate Pakistani refugee support services. The last supposition would account for the inclusion of educational material on the list (to restock madrassas and possibly to meet an expected influx of new, illiterate recruits to Taliban-controlled or sympathetic madrassas). The appeal for aid ended by asking the hearer to send money to a specific bank account care of the Taliban Islamic Movement Central Office (HQ), Karachi. The writers even promised to supply a receipt.

Apparently, these two letters had been circulated widely within Pakistani mosques (most likely by the Taliban-associated Jamiat-e Islamic Ulema, or Assembly of Islamic Clergy, a Pakistani-based Deobandist religious organization). As such, they pointed to the possible presence within Pakistan of a widespread and apparently effective Taliban logistical structure.

All of the above examples show that DOCEX can produce actionable intelligence and help commanders develop the situational awareness they must have in an insurgency environment. While the vignettes have been drawn from Afghanistan, the observations regarding DOCEX apply equally to Iraq or elsewhere. For example, information collected from various items of medical equipment at Asmara hospitals in Eritrea in 2005 indicated the extensive and unexpected presence of Cuban medical personnel.

It goes almost without saying that not all recorded media is paper; in fact, much of it is now computer hard-drives, CD/DVDs, tape cassettes, and old tape recordings. The challenge sometimes is not to assess the information, but to find the correct equipment to view it. In Baghdad, one entire Iraq Survey Group mission was conducted merely to find an obsolete machine of Russian manufacture that could play what turned out to be an old Czechoslovakian Army chemical training video.

As we continue to fight the long war, such painstaking media collection and exploitation must become an integral part of all our combat efforts in Iraq, Afghanistan, and wherever else U.S. forces are deployed. Even within the HUMINT field of which it is a part, DOCEX is frequently an afterthought; it is underfunded and understaffed. Despite the truly heroic efforts of a few within the intelligence community, media collection is rarely emphasized. This writer personally witnessed U.S. Soldiers traipsing through papers blowing around destroyed sites, never once deigning to pick up the material (Kandahar and Nuristan provinces). When confronted, the Soldiers said that investigating such stuff was not part of the package of Soldier skills they had been taught at basic training, nor had it been addressed prior to deployment. This lack of DOCEX awareness is sometimes corrected by aggressive, situationally aware commanders, and the Marines and Special Operations Forces appear to be trained up, but our forces need to be universally cognizant of the importance of document recovery and exploitation.

With any kind of intelligence in any kind of war, it is rare to get the golden nugget of information that will win a battle. Clearly, however, much useful intelligence information may be out there blowing about the battlespace, waiting only to be picked up and sent to analysts who can make it talk. If we are to succeed in Afghanistan and Iraq, we need to start picking up the seemingly inconsequential media we find on battlefields. We absolutely must begin taking document exploitation seriously.

---

 

 

Back to Top

September-October 2007