Small Wars Journal

Assessing and Targeting Illicit Funding in Conflict Ecosystems

Share this Post

Assessing and Targeting Illicit Funding in Conflict Ecosystems

Irregular Warfare Correlations

by Brigadier General David L. Grange and J.T. Patten

Assessing and Targeting Illicit Funding in Conflict Ecosystems (Full PDF Article)

In December 2008, the Deputy Secretary of Defense issued a "Directive-Type Memorandum" whose subject was a DoD Counter-Threat Finance (CTF) Policy that included priority purposes to counter financing used by illicit trafficking networks in support of adversaries' activities, which may negatively affect U.S. interests. Countering threat finance included memorandum policy to deny, disrupt, destroy, degrade, and defeat these adversarial networks with many "counters" relying on tactics, techniques, and procedures (TTPs) that follow Irregular Warfare concepts. Targeting and assessing the greater illicit funding mechanism within conflict ecosystems demands the same below-the-waterline tacit knowledge, situational understanding, and intelligence creation that most complex and unconventional operations require while keeping local populations out of the fray.

CTF and other Irregular Warfare efforts need an accurate contextual assessment identifying the nature of specific activity and the culture of the various ethnic groups involved to precisely apply the use of force or countermeasures while gaining (and retaining) legitimacy in the eyes of the civilian population. This requires understanding and circumstantial application of history, society, economic infrastructure/ecosystems, local/regional politics, tribes and clans or social ties, and legal structures. Combining typical joint-oriented preparation of the environment/battle-space with CTF doctrine details will require going beyond the capabilities in traditional financing theory and forensic techniques of transactional dates, amounts, sources of transactions, and personalities involved to more accurately identify, detect, predict, target, and actively interdict threat, terrorist, and / or illicit criminal finance activities.

By employing a hybrid of IW, CTF, and shared operating concepts, intelligence and forensic investigative strategies can become complimentary at the joint and interagency community of interest levels. Based on the illicit groups or actions involved and those government agencies covering them, a Whole of Government (or beyond) network of efforts will improve support to operational strategies at ground level up to the prosecution needs at the Justice level. From this community of purpose standpoint, Zones of Influence can be better established to contest the space that is utilized by criminal and adversarial purposes.

Assessing and Targeting Illicit Funding in Conflict Ecosystems (Full PDF Article)

About the Author(s)


Outlaw 7 (not verified)

Thu, 05/06/2010 - 2:26am

Based on the following set of defintions I would in fact challenge the assumptions of the article in a number of ways.

Ecology of an Insurgency:

The scientific study of the way that living "organisms" in this case "organism" is defined as an insurgency cell, group, or organization interact with their environment and predators (the counter insurgent).

Ecosystem of an Insurgency:

An insurgent ecosystem is a system whose members (members defined as being either an insurgent group or groups) benefit from each other's participation via symbiotic (mutually beneficial and self-sustaining) relationships.

The main goal of an insurgency ecosystem is to generate common ventures. It forms when many small and potentially diverse (origin, tribe, religious belief, etc.) insurgent groups join together to fight a common predator (the counter-insurgent or state).

Insurgent ecosystems attract and retain members (groups) due to network effects:

• The benefits of the ecosystem (shared ventures) are so great that groups wont leave it (although temporary departures to avoid targeted pressure from counter-insurgents are possible).
• The ecosystems features (i.e. immediate access to shared resources) make it easy for new groups to form and participate.
• The growth of the ecosystem results in an exponential increase in benefits (i.e. more segmentation and specialization) for all of the member groups. IE Attacks by one group creates opportunities for other groups. The buying of resources (ie small arms, explosives) creates a market for groups to sell into and makes it easier for other groups to get access to the resources.
• An ecosystem can have groups directly fighting each other through direct battles - but it can also have indirect fighting (or competition) between groups for access to resources (people, money, strategy etc).

Once an ecosystem is established in a particular region/area, it becomes very difficult for the counter insurgent to eliminate it. The presence of multiple groups means that the counter insurgent must divide its efforts. Operationally, a focus on one group leaves other groups to operate freely and success against one group yields very little overall benefit. Removing leadership does not mean that the group will cease to exist. The leadership may be replaced by other parts from the same group or other groups. Or a new group will move into the space left open by old group. Strategically, the diversity of the groups in the ecosystem (different reasons for fighting) means that it isnt possible to address a single set of issues or grievances at the national level that would reverse the insurgency (via negotiated settlement, repatriation, etc.).

Now taking the following statments out of the article I would challenge the fact that the Carnegie Mellon 2001 model in fact can do what the autor asserts it can do as it is a basic 1D social analysis tool based on straight forward advanced math-not quantum physics.

To then disrupt the patterns, the next step is to synthesize and coordinate joint operational activities around (based on a model of Destabilizing Networks Carnegie Mellon University, 2001):
1. The basic components that account for the networks structure (e.g. - the number and types of sub-groups, or the number of triads, stars, and the extent of reciprocity)
2. The central tendency and similar or differing ideology within a set of networks, and the networks that are anomalous when contrasted with the other networks in the set.
3. Critical differences between two or more sets of networks.
4. Which components in the network are structured significantly differently from the rest of the overall network
5. How cells contribute or control behavior, emotion, or attitudes of individual members
6. What makes some groups hostile to one another and others neutral or civil
7. Whether the existing network is coherent (i.e. - What is the likelihood that there are key missing nodes or relations?)

Currently the only research and research tool capable of doing this is the research published in Nature magazine in Dec 2009 concerning the Common Ecology Quantifies Human Insurgency. While some challenged the math no one challenged the results and when the results were challenged and asked then what model explains the results-there are no answers.

I would in fact argue the CM model cannot provide any answers to the above listed points as it is a social network analysis tool and not a tool to answer what a thinking, acting, and communicating insurgent is doing in it's own ecosystem as well as interacting with others in the same ecosystem. As far as I know the model was not ecology focused using 11 different insurgencies over a six year period.

Referencing the same argument with this para out of the article;
Affirmative action or more nebulous social network attacks can be directed at the individual level, process chokepoint, or group affiliations and is constructed with actors social culture in mind based on continuous understanding of the battle-space and financial ecosystem appreciation. Creating virus-like spreadable disruptors that can damage hard to reach social networks from within are among the few effective ways to cripple or minimize threat finance closed-network activity and minimize the adjoining illicit system activities (credibility, recruitment, motivation, procurement, sanctuary, and funds), if we cannot penetrate the cells directly.

I would argue that the Carneigie Mellon model from 2001 is in fact incapable of depicting how the rumor is flowing through the ecosystem, what is the actual impact on the individual group member, impact on the overall group, and impact on the actual overall ecosystem and as well impacts on actual attacks.

What is now needed is a very open and frank discussion of ecosystem based research on insurgencies that allows one to finally predict COAs on actvities directed against the ecology of and ecosystem of an insurgency--again based on the above defintions not the multitude of defintions for ecosystem/ecology alluded to by a number of authors.

Anonymous (not verified)

Thu, 05/06/2010 - 1:43am

JT Patten:

Why is it that CTF is just now being talked about and not back in 2004?

Can it be a drive by the defense contracting world ie Booz Allen to expand the number of analyst positions in the various organizations---where is the doctrinal workup and where are the TTPs in place? Or is it a way of giving Dept of Treasury/DoS a feeling they are in the "game".

First it was stopping the halawa's, then insurgencies fed off of oil/weapons/money smuggling, ransom work leading to millions, then defense contractor fraud and abuse, then military and government corruption and now the drug world of raising, taxing, smuggling, and selling of illegal drugs ie opium and MJ.

A recent drug research article indicated a massive opium surge is currently going on in Helmand province---just how in the heck is that if not interdicted going to shorten the funding to the Taliban and related groups?

Why is it that we are always ignoring articles written a way, way long time ago? Based on the concept of open source warfare and the idea of open source finacing of insurgencies---just where was the idea of CTF in 2004?

Treasury was definitely in Iraq in 2004/2005, but hey they did not want to even come out of Baghdad to interview insurgents that were talking about their financing--so why the emphasis now?

Why do we have to constantly reinvent the wheel?

To argue the world of TS/SCI resticts talking about it when in fact about 80% of actionable financial intelligence is available from open source if one is willing to read any number of sources on a daily basis.

JT--comment please to this article as it goes to the heart of CTF.

Friday, 22 October 2004
The long history of warfare is dominated by military entrepreneurs. That dominance was overturned only recently (within an historical context) with the rise of the nation-state and its ideologically motivated armies. However, the trend is going in the other direction, and quickly. Military entrepreneurship is again on the rise. We can see the adoption of military entrepreneurs by the coalition in Iraq. Private military companies (PMCs) field the second largest military force in Iraq, after the US -- the UK is a distant third.

This shift towards military entrepreneurship is even more pronounced in the insurgency in Iraq. Almost all of the guerrillas we are currently fighting were formed through this process. This should come as no surprise to readers of history (and particularly readers of this author, since it appeared here first). Arab warfare, until late in this century, was driven entirely by entrepreneurship. For example: Lawrence of Arabia, the father of modern guerrilla warfare, used combinations of direct payments and the promise of loot to build his forces. Faith played a major part, but it was almost always secondary.

Recent reports confirm from the US military analysts confirm the financial nature of the open source bazaar in Iraq:

•"Unlimited amounts" of violence capital for guerrilla entrepreneurs is flowing into Iraq from ex-Baathists, relatives of Saddam Hussein, Saudi sources, and bin Laden. Given global guerrilla ROIs (returns on investment) of up to 100,000 x, this should be cause for alarm.

•Loot from convoy hijackings, theft of oil through bunkering, and ransoms play a major part of the motivation for attacks. Fully 80% of the attacks fall into this category.

•A granular competitive market. There are over 50 guerrilla groups active in Iraq. The sheer diversity of the effort indicates a process that is very similar to historical patterns of Arab warfare.

•Price schedules for attacks. The going rate for placing an IED is $100-$300 (more for an RPG attack).

A New Dynamic
The financial dynamic we see in action in Iraq is a hallmark of global guerrilla warfare. It also creates its own dynamic. The destruction of the pillars of globalization through attacks on systems (both infrastructure and markets) serve to keep Iraq a failed state. As a failed state, Iraq is unable to provide economic alternatives to the insurgency. Further, even though Iraq is a failed state, it is awash in money. Fortunes will be made through the perpetuation of its chaos (as we see with the Narco warlords in Afghanistan, who combined generate $2.5 billion a year in revenue).

Given this trend line, we will likely see more advanced forms of this in the future, particularly market-derived financing. Guerrilla entrepreneurs will use prior knowledge of attacks to generate revenue from global financial markets (NOTE: this fits the strategy of fourth generation warfare -- it turns the strength of an enemy into a weakness). These efforts will include:

•Assaults on individual corporations (more here and here). Attacks on resources (particularly oil infrastructure) will influence the oil market. Billions could be made through this process.

•Attacks on oil infrastructure. Global guerrilla methods make it possible for the rise of a "Shadow OPEC" and all the financial leverage that entails.

•Taking states hostage.Global financial markets control the world. States exist to compete within them (the US does too, but it often doesn't acknowledge the fact). If a state underpreforms it is harshly punished regardless of the reasons. It is likely we will see a nation state targeted/threatened with infrastructure disruption unless they make a large ransom payment. States are willing to pay (the recent payment by Italy for the release of hostages is an example). Many aren't, but after some well orchestrated examples, they will likely to reverse that stance.

J.T. Patten (not verified)

Tue, 05/04/2010 - 11:55am

JEB, very true about the shortcomings in the article. This was intentional. The objective was to keep thinking and discussion going in the area, but not to share the answers openly in public when the nature of those disruptive activities occur at the TS/SCI levels. We can't give ALL our tricks away in OPEN-SOURCE.

Also, your point on the environmental situation is spot on. No activity exists in a vaccuum. All second and third order effects must be considered for intented and unintended consequences. CTF indeed is just one layer and one tool. When enacted with other complimentary actions--simultaneously when possible---to maximize effects. Thanks for the comments.

J E B (not verified)

Wed, 02/10/2010 - 11:04am


It is good to see that counter-threat finance is gaining visibility as an integral aspect of the irregular warfare and DIME doctrine. Your thoughts on CTFs relationships and similarities to other social network examples were spot on. I would add that counter-terrorism and counter-narcotics are also hugely similar organizations as much in common with CTF as Counter-IED; and while succinct, they use similar competencies.

You also are correct in pointing out that the role the Defense Department would play would be largely different than the role of the Justice and Treasury Departments, but would involve the same kind of knowledge, skills and abilities.

However, this monograph overlooks one important aspect of the CTF policy: when a network is taken down, with what alternative do <i>WE</i> replace the aforementioned illicit network? Terrorist (or insurgent) attacks are the ends, finance is the means. It is satisfying, but woefully inadequate to be content with detecting then denying our adversary with the means to carry out its activity. That adversary will eventually find means from other sources. Ask any Justice agent, DEA or FBI; taking down one individual or group will never destroy the network. The inherent nature of incomplete information in intelligence or investigation guarantees that.

Additionally, if we risk shifting the illicit finance network, not destroying it. As we congratulate ourselves for taking down one network, a new network that studies and absorbs the lessons learned from the old, stands up to take over. Usually, it is more robust and more cautious. Take away the drug trade, and Taliban will increase gem and timber smuggling. Take away remittances originating from the South Asian Diaspora, and insurgents will extract more extortion "taxes" from the local populace.

Further, it overlooks the problems inherent in those environments where illicit finance requires a CTF strategy. In places suggested by the authors, Iraq, Afghanistan and the Horn of Africa [and some parts of Pakistan], illicit finance is <i>THE</i> major vehicle for funding <i>because licit financial venues failed</i>. There is no other recourse for Individuals and groups in those regions. Additionally, the local populace and the illicit traders either actively or complacently support the power structures active in the region; those power structures, either state or non-state, support the illicit activity. In turn, all groups profit [to varying degrees]. Also, if the trade or activity is lucrative enough, there will be replacements willing to take the risks. If it wasnt, the activity wouldnt exist in the first place.

The goal of counter threat finance should not be set at "destroying the adversary". This is especially true when a new adversary is created via our actions against the old. In Major General Flynns latest report on how to fix intelligence in Afghanistan, he points out how were focused on creating a hostile environment for the insurgents/terrorists at the expense of determining how to create a safe environment for the population, whom we are trying to cajole to our side.

Thus CTF should not provide a way to "destroy" the adversarys funding streams, but to "counter" the conditions that promulgate the system created by the adversary to fund its activity.

Thanks for your thoughts and your time



This initiative is common-sense to any grunt on the ground in Iraq from 2003-present. We assumed that we had these functions.

Is this something that we want DoD to manage and control? I thought that's why we had the Department of Treasury, Department of Justice, and FBI.

Following the money SHOULD be the first step in any venture into CT or COIN.


Major Mike Few