HomeAbout UsBrowse This IssueBack IssuesNews DispatchesSubscribing to Army LogisticianWriting for Army LogisticianContact UsLinks































Sustainment-Centric Intelligence

“The art of being wise,” psychologist William James once wrote, “is the art of knowing what to overlook.” The intelligence requirements of a sustainment command demand that more be done with less. The far reach of convoy missions passing through multiple and diverse battlespaces, a lack of organic intelligence collection assets, and the absence of a reliable theater-wide attack reporting system all converge to make intelligence seem like an impossible task for the frequently undermanned and untrained intelligence sections of sustainment commands. However, if a sustainment command intelligence section can develop tools that focus only on the trafficked main supply routes (MSRs) and alternate supply routes (ASRs) and depend on the battlespace owners’ intelligence sections for area analysis, it can not only meet its own unique requirements but also afford to function as a regional route analysis provider for all patrols and convoys passing through its linear-route battlespace.

Limited Resources and Unique Needs

Sustainment command intelligence sections are often overworked and undermanned. This comes as no surprise because sustainment commands are often considered the handle of the warfighter’s spear. Although maneuver commands enjoy intelligence sections staffed with analysts—enlisted Soldiers, noncommissioned officers, and officers from a variety of intelligence backgrounds—sustainment command intelligence sections are generally staffed by one or two Soldiers who focus solely on intelligence analysis. Often these Soldiers are pulled from other sections, such as the S–6 or the motor pool. Only occasionally are these analysts trained at the Army Intelligence School at Fort Huachuca, Arizona. In the course of my 15-month deployment experience in Iraq, only one of five adjacent combat sustainment support battalions (CSSBs) had Army Intelligence School-trained personnel and some fell drastically short, with no formally trained intelligence personnel at all.

The 264th CSSB intelligence section was lucky to deploy with one functional area 35D (all-source intelligence officer) lieutenant and two military occupational specialty 35F (intelligence analyst) E–3s. All three of us were doctrinally trained at the Army Intelligence School, but we faced other limitations inherent in providing intelligence support to the distribution fight. So during our 15-month deployment, we honed our section’s role down to just a few key tasks. What follows is a guide for what to focus on and what to overlook when providing for the unique intelligence needs of a sustainment command.

The distribution mission requires unique intelligence support, which is dictated by unique mission characteristics. The logistics convoy mission is fundamentally different from all other combat missions. Some convoy mission characteristics, such as geographic span, multiply and complicate intelligence requirements. Other characteristics, such as the fundamentally defensive nature of the logistics convoy and the linear nature of its area of operations, greatly simplify intelligence requirements.

Geographic Span

Sustainment commands sustain the hubs that supply the warfighters. Sustainment convoys move supplies between distant logistics bases, which are connected by MSRs and ASRs. These routes pass through many battlespaces occupied by diverse land-owning commands with varied enemy situations. The far reach of each logistics convoy mission requires intelligence analysts to track multiple evolving threats.

The intelligence analysts of conventional combat power battalions focus on their locality while higher commands are tasked with the regional picture. However, the analysts who support any sized command tasked with logistics convoy missions must track the many diverse localities that their logistics convoys pass through (see chart above). This requirement is compounded by the facts that each battlespace owner has its own way of doing things and that shared intelligence products vary in quality and format. For example, some battlespace owners maintain online archives of route assessments, while others may only provide area assessments with no specific analysis of the MSRs and ASRs running through their areas. Still others provide nothing at all. Therefore, a passive SIPRNet-browsing analysis of shared intelligence products will leave a logistics convoy mission intelligence brief riddled with gaps. (SIPRNet is the Secure Internet Protocol Router Network.)

For these reasons, sustainment command intelligence analysts must become masters of networking with fellow analysts. Face-to-face meetings with all pertinent intelligence analysts of battlespace-owning commands are preferred because the sustainment command intelligence analysts will be asking them for assistance frequently. This is the perfect opportunity for the analysts to get on the road, participate in a logistics convoy mission, and visit the intelligence analysts of battlespace-owning commands at each stop along the way. It is also the perfect opportunity for the analyst to serve as the bridge between the commander’s staff and the Soldiers on the road in order to build firsthand situational awareness.

Sustainment command intelligence analysts should rely on their battlespace-owner counterparts to be the subject-matter experts on the status of the threat in their area. Convoys rarely, if ever, deviate from the MSRs and ASRs, so sustainment command intelligence analysts can remain focused on the routes themselves. Only by maintaining this focus can an analysis complicated by the logistics convoy mission’s span of many diverse battlespaces be made a manageable task.

Offensive Posture but Defensive Nature

One unique characteristic that differentiates the sustainment mission’s intelligence requirements from those of all other combat missions is the defensive nature of logistics convoys. Although Soldiers on logistics convoys are trained to maintain an offensive posture, the convoys do not seek out and destroy threats. On the contrary, logistics convoys aim to avoid threats. This led to the eventual development of the tactical mantra, “Avoid them and see them,” referring to how our logistics convoys counter the primary threat on MSRs and ASRs—the improvised explosive device (IED).

The defensive nature of the logistics convoy mission simplifies the commander’s decision requirements. Although logistics convoys are escorted by gun trucks tasked with providing security, the convoys avoid the enemy at all costs, unlike patrols that seek out and destroy the enemy. For example, a logistics convoy will be planned to travel the route with the lowest threat at a time of day when the threat is historically at its lowest. So while intelligence analysts of battlespace-owning commands are assembling targeting packages or leafing through pages of interrogation reports, sustainment command intelligence analysts are simply figuring when and where threats are likely to occur on the routes in order to develop a plan to avoid engagements altogether.

Linear Area of Operations

Perhaps the best thing sustainment command intelligence analysts have going for them is that their areas of operations are strictly linear. Except for the rare case when a logistics convoy zigzags through the streets and alleys of a major city, a sustainment command’s battlefield consists of a straight line drawn through vast expanses of battlespace-owner territory. Like the defensive nature of logistics convoys, this unique characteristic greatly simplifies the demands on their under-resourced intelligence sections. With a purview limited to enemy activity on the routes, the section’s primary task becomes identifying attack trends along the linear spans of MSRs and ASRs in order to support plans to circumvent and counter attacks.

Sustainment-Centric Intelligence Products

According to the sustainment-centric concept of intelligence operations, analysts should focus on creating intelligence products that enable the commander and Soldiers on the road to prevent and avoid threats while depending on battlespace owners’ intelligence analysts to provide all other intelligence support. This makes the demands on the frequently under-resourced sustainment command intelligence sections manageable. However, customized tools are necessary for analysis focused strictly on the vast, linear expanses of logistics convoy areas of operations. Like all good intelligence analysis, sustainment-centric products must begin with good reporting.

The biggest obstacle to meeting a sustainment command’s unique intelligence requirements is the absence of a uniform, theater-wide enemy-activity reporting system that can provide the data needed to form a thorough route threat assessment. A few centralized databases collect enemy-activity reports, but none of the databases are uniform and theater wide, and none allow for the entry of the key pieces of data needed by sustainment command intelligence analysts.

The databases currently available include the “who, what, when, and where,” but they do not provide enough detail to support useful trend analysis. Moreover, reports are actually keyed into the system by personnel at levels of command that are too far removed from the incidents to provide accurate details. Fundamentally, the status quo for incident reporting is flawed: It is not uniform, it is not theaterwide, it does not allow for the entry of details needed for route analysis, and data are entered too many echelons above the actual unit involved in the incidents.

Ideally, a uniform, theater-wide standard would cater to the needs of sustainment command intelligence analysts conducting route threat analysis. Each entry in a database of attacks would include data fields such as—

  • Whether or not the attack occurred on a route
    of any kind.
  • The name of the route on which the attack occurred.
  • If the targeted unit was a logistics convoy or a patrol.
  • The specific initiator type of an IED (for example, hacksaw-blade pressure plate, Christmas tree lights, victim-operated push-button, or command wire).
  • The specific munitions or explosives type used (such as 120-millimeter artillery rounds or homemade explosives).
  • The location of an IED emplacement in the road (such as shoulder, median, or lane).
  • The order of march of the attacked vehicle.

This is not an exhaustive list of the layers of description needed for each incident, but it is a good start. A complete and exhaustive set of data fields should include mutually exclusive options for each data field so that no incident details are left open for interpretation.

The enemy-activity reporting system needs to be transformed. More data are needed in addition to the minimal “who, what, when, and where” in order to create sustainment-centric intelligence. Such a transformation would certainly consume resources, but intelligence is incredibly important to our asymmetric warfighters. Leaders should institute a reporting system that emphasizes attack-trend analysis. A reporting system and incident database as described here would greatly simplify the route threat analysis process.

Developing Our Own Warning System

In the absence of this ideal incident database, the 13th Sustainment Command (Expeditionary) G–2 section maintained its own intelligence database and provided it to analysts studying attack trends along their routes. On a daily basis, the G–2 analysts manually sorted through the previous 24 hours of enemy activity reports provided by the Combined Information Network Data Exchange (CIDNE). The analysts read each report and copied into a Microsoft Excel worksheet only those reports with narratives that explicitly identified an MSR or ASR as the location of the attack. Then they manually added many useful layers of information to the worksheet for each of the selected entries.

Essentially, the 13th Sustainment Command G–2 section manually created its own sustainment-centric database from which sustainment-centric intelligence could be derived by subordinate command intelligence analysts. This investment of considerable manpower proved extremely valuable to intelligence analysts studying attack trends on routes. Intelligence analysts used this sustainment-centric database to empirically calculate which lengths of their routes represented zones of statistically high historical enemy activity.

The process was not as complex as it sounds and represents a more accurate and evidence-based method than the classic circling of dots on a map to determine high-threat zones. As shown at left, if the rate of attacks between any two grid lines (east-west grid lines for generally north-south routes and north-south grid lines for generally east-west routes) exceeded a threshold representing a level of risk accepted by the commander, the analysts designated those grid lines as the boundaries of a threat zone. For example, the 264th CSSB commander set a threshold of two attacks per kilometer over a period of 8 weeks. The product consisted of a set of threat zones with boundaries falling on north-south grid lines for generally east-west routes or east-west grid lines for north-south routes, as illustrated below.

The decision to round the boundaries of the threat zones to kilometer grid lines made the intelligence products useful to the multitasking logistics convoy commanders, who were already busy tracking all the vehicles in their logistics convoys, communicating with higher headquarters, and scanning the road for IEDs. Having memorized just a few 2-digit eastings (east-bound route coordinates) and northings (north-bound route coordinates), the logistics convoy commanders knew exactly where to adjust their tactics, techniques, and procedures (TTP) simply by monitoring the military grid reference system (MGRS) output on their global positioning system (GPS) devices.

Elevated Threat Zones

The first inclination was to call these threat zones “named areas of interest” (NAIs), but it was later determined that the doctrinal definition of an NAI was essentially different than what had been created. Without a doctrinal term, the commander dubbed these sections of route “elevated threat zones,” or ETZs. This term had been coined by another unit to describe their “dots on a map” method, but it described our creation perfectly.

The analysts then zoomed in on each ETZ by filtering the entries of the sustainment-centric database for those attacks that occurred between the defining boundaries on the route of interest. What remained after the filter was a list of attacks that had occurred only in the defined zone of the route.

The analysts could then pursue trends through the layers of data for each entry provided by the 13th Sustainment Command’s G–2 analysts. For example, some ETZs exhibited day-of-week trends while some exhibited trends in IED initiator types. These trends changed over time, and of course, they changed from location to location as the routes cut through many diverse battlespaces—each with a unique enemy situation. Most ETZs exhibited a low variation in attack times, meaning that they had discernable “hot” times, although a few did not.

With these products, the 264th CSSB commander exercised his tactical counter-IED philosophy: “Avoid them and see them.” The commander’s staff planned convoy times around the hot times to avoid them. The next step was to see them.

The 264th CSSB fusion cell developed a three-pronged approach to the “see them” counter-IED philosophy. First, we ensured maximum vehicle lighting for night missions. Second, the fusion cell recommended slowing vehicular speed to aid in spotting IED indicators when passing through ETZs. Logistics convoys were monitored on the Blue Force Tracker to track their compliance with the mandated speed limits. Third, the intelligence analysts identified trends in IED indicators in each ETZ and developed appropriate counter-IED TTP with the operations section. Intelligence analysts dissemintated trend analyses of all IED indicators. The location of the ETZs would be presented to the Soldiers during mission preparation and during missions. To make the statistics meaningful for the Soldiers, the analysts searched the battlespace owners’ explosive ordnance disposal report archives for pictures of typical IED attacks for each ETZ. This showed the Soldiers exactly what IED indicators to watch for, thus arming the Soldiers with the knowledge they needed to “see them” before they encountered them.

The result was a set of PowerPoint slides depicting a map of routes, overlaid with the ETZs represented as boxes and with boundaries falling on rounded kilometer grid lines. (See figure above.) Subsequent slides showed each ETZ individually on a larger scale. Each ETZ slide presented graphs of the hourly attack frequency and attack type frequency as well as a verbal analysis of common attack trends not captured in the graphs, for example, “IEDs wrapped in black plastic bags.” (See figure below.) These slides were bound in trail books, which logistics convoy commanders signed out to study during the mission planning phase of their convoys. To make the information even easier for the Soldiers to access during the mission, the ETZ overlays were transferred to Blue Force Tracker overlays and electronically pushed to each vehicle before the mission. This final stage of dissemination provided real-time access to the intelligence analysts’ empirical analyses of historical attack trends.

Regional Intelligence Provider

By staying focused on the routes and leaving the rest to the battlespace-owner’s intelligence analysts, sustainment command intelligence analysts become the “wise men” of the roads. The intelligence section of any given sustainment command can use symbiotic relationships with its battlespace-owner counterparts as leverage points to transform from an under-resourced and over-tasked intelligence section to a regional route-intelligence provider.

This transformation requires the development of customized tools and a disciplined focus on the routes. The sustainment command intelligence analysts must resist pursuing other intelligence endeavors. Instead, they must rely on their battlespace-owner partners for other area analyses. In return, their partners can afford to focus on the intelligence requirements of maneuver missions and get their route intelligence from the regional route intelligence providers in sustainment commands. That is the art of being wise.

This article provides a general outline for doing more with less. The project here is to focus sustainment command intelligence analysts on what matters to logistics convoys and encourage a sharing relationship among all analysts in the intelligence community. The tools developed by the 13th Sustainment Command (Expeditionary) G–2 section were time consuming and were only temporary fixes. There remains a long-term need for top-down support for a theater-wide reporting system that meets the needs of both maneuver command intelligence analysts and sustainment command intelligence analysts. This would require a serious overhaul of the reporting system and an in-depth expert study that is far beyond the scope of this article. Such a transformation would certainly eliminate some of the many enemy activity reporting systems currently in use and pay huge dividends to the intelligence community.

Captain Gregory “Nick” Larkin is the assistant staff intelligence officer of the 82d Sustainment Brigade at Fort Bragg, North Carolina. He holds a B.S. degree in psychology from Purdue Universtiy and a B.S. degree in international relations from the United States Naval Academy. An interservice transfer, he is a graduate of the Military Intelligence Officer Basic Course, Airborne School, and Ranger School.