Red Teaming Criminal Insurgency


. 3 .

Signs and Indicators

For red team scenarios, analysts will need indications and warnings to program into their modeling. In the following table, we have compiled a list of signs (indicators) that can be used in red team scenarios or plugged into warnings and assessments. The first table covers a wide range for strategic indications and warning factors for both BlackFor and the cartels.

Table 1: Indications and warnings analysis for
BlackFor and Cartel Evolution scenarios.

BlackFor activity against U.S. citizens. Co-option of state, community, and corporate functions.
Black globalization. Black globalization.
Emergence of failed state or failed community within national borders. Emergence of failed state or failed community within national borders.
Links with insurgent, terrorist actors, or foreign powers. Growth of criminal subcultures.
Signs of political consciousness in criminal organizations. Signs of political consciousness in criminal organizations.
Signs of criminal adaptive ability for complex tactical operations. Signs of vigilante organizations (neighborhood militias, counter-gangs, death squads).

      In a seduction model, criminal insurgents will seek to co-opt political, government, corporate, and law enforcement military functions. In Brazil, for example, street gangs control whole sections of the police and military police. Modeling the process by which corruption, political infiltration, and seduction takes place will be crucial for red teaming criminal insurgency. A “wild card” element to toss into scenarios could be the double-cross and killing of special independent police or military units tasked to stamp out crime by cartel-controlled police forces.
      A related issue is the growth of criminal enclaves: “feral cities,” failed communities, and “no-go” zones, which provide cover, a recruiting base, and a monetary base for both criminal insurgents and terrorists. Scenarios should incorporate the growth of these small zones within the state and the central government’s response to them. In light of the recent warfare in Sao Paulo between government forces and traffickers, a scenario that should be considered is an urban siege by either criminal insurgent or government forces within a failed community or metropolis. These sieges are a kind of criminal parallel to the recent operations in Gaza. In both operations, state military and paramilitary forces attacked densely occupied urban environments to root out non-state actors.
      The growth of powerful criminal or insurgent organizations also tends to provoke a counter-reaction, with vicious vigilante forces coming into existence. In Colombia, far-right paramilitary forces and “Los Pepes” emerged as a counterweight to anti-government non-state forces and brutally crushed their adversaries, committing numerous abuses of human rights and enriching themselves in the process. In South Africa, anti-gang forces also developed into vigilante groups to dispense “justice” to slum-dwellers.23
      Black globalization breaks down order within the state, gives rise to revenue streams that the state cannot monitor, undermines legitimate enterprise, and generates a redundant and scalable material base that insurgents and terrorists can tap. In red team scenarios, analysts should look at the growth of black markets, contraband, and informal markets within a given state, especially if those markets involve a significant amount of bribery among lower-ranking government officials. Black globalization ultimately equals a source of power that can create alternate power structures, aiding the process of feudalization by creating criminal warlords.
      One of the most important aspects of the scenario model is the growth, change, and operational adaptation within the criminal organizations themselves. Cartel evolution and gang adaptation should be part of monitoring for analysts and incorporated into scenarios. These adaptations can manifest themselves in organizational structure or operational capabilities. Organizational shifts could include decentralization, territorial or market expansion, increased reach, and the ability to sustain alliances. Operational capabilities include improved tactical prowess, operational coordination, and sophisticated planning.
      The growth of a political consciousness and political objectives is also important to monitor in criminal organizations, as it usually heralds the use of instrumental violence against the state, civil society, or civilians to achieve political objectives. Sociological data about criminal subcultures can also be of use, as these cultures become spaces for oppositional identities alienated from the state. Lastly, analysts should also monitor how groups interact with other state and non-state actors. BlackFor, for example, could interface with other criminal organizations, foreign powers, or terrorist groups.
      The following table lists a series of operational indicators for criminal insurgent actors, ranging from the targeting of critical infrastructure to various forms of mobilization in both physical and information space.

Table 2: Criminal insurgency operational indicators.

Criminal targeting of critical infrastructure.
Criminal shadowing of law enforcement, government, or corporate officials.
Sign of “kill chain” formation.
Criminal cell buildup within urban regions.
Criminal tactical operations against police, military, or government personnel.

      For simulations, operational indicators in more immediate scenarios will focus on tactical and operational actions and the use of resources by criminal organizations. Important signs to watch for are criminal targeting of critical infrastructure such as power plants, refineries, and transportation systems, among others. Criminals may make a point of showing that they can disrupt ordinary life and thwart governmental power.
      Criminal insurgents will also target military, law enforcement, and government personnel. In an attrition model they will attempt to depress the morale of low-ranking personnel through attacks, raids, armed assaults, and assassinations. These will be conducted with weaponry that will often rival that available to government and law enforcement personnel. Force protection within red team scenarios is an important aspect of modeling criminal insurgency.
      Criminal action may often be presaged by extensive surveillance and/or shadowing. Unlike many terrorists, who may stand out as strangers, criminals are more likely to blend into the community, and, as a result, criminals are more likely to be able to conduct successful surveillance. In scenarios, one important counter-surveillance function is to discern who among a politician’s staff (as well as police or court clerks) may be a cartel plant.
      Mobilization is another important indicator. Irregular forces, dispersed by nature, will often form in several dimensions to carry out operations or build up strength. The same analytic indicators for the formation of terrorist “kill chains” apply. Red team scenarios should incorporate the buildup of hit cells within failed communities, large cities, and within corrupted elements of government organizations to carry out operations. Cyber-mobilization—the massing of forces in cyberspace—should also not be overlooked. [click to continue …]

Go to page 1, 2, 3, 4.

Note: If you would like to comment on this paper, please return to the first page.

  1. Daniel Nina, “Dirty Harry is back: Vigilantism in South Africa,” African Security Review, Vol. 9, No. 1, 2000. []


Terms of Use

Please read.