This publication is available at Army Knowledge Online
(https://armypubs.us.army.mil/doctrine/index.html).

To receive publishing updates, please subscribe at
http://www.apd.army.mil/AdminPubs/new_subscribe.asp

Preface

ATP 3-90.15 provides guidance on site exploitation planning factors. This guidance ensures that information and materiel collected and persons found on-site are methodically assessed and transported to the appropriate facility, such as a technical exploitation facility, captured materiel exploitation center, or military police detainee collection point.

DOD personnel who conduct, support, or participate in tactical questioning shall be trained, at a minimum, in the law of war and humane treatment standards in accordance with DODD 3115.09, Enclosure 4, paragraph 1. In addition to tactical questioning, commanders make effective use of human intelligence personnel to interrogate individuals. Only human intelligence collectors and other trained and certified DOD personnel following the guidelines, set forth in DODD 3115.09, can interrogate individuals. Integrating human intelligence collection with the search effort may result in more rapid collection of information and intelligence. (For additional information on human intelligence collection see FM 2-22.3.)

The principal audience for ATP 3-90.15 is all members of the profession of arms. Commanders and staffs of Army headquarters serving as joint task force or multinational headquarters should also refer to applicable joint or multinational doctrine. Trainers and educators throughout the Army will also use this publication.

Commanders, staffs, and subordinates will ensure their decisions and actions comply with applicable United States, international, and, in some cases, host-nation laws and regulations. Commanders will make certain their Soldiers operate in accordance with the law of war and the rules of engagement. (See FM 27-10.)

ATP 3-90.15 uses joint terms where applicable. Selected joint and Army terms and definitions appear in the glossary and the text. Terms for which ATP 3-90.15 is the proponent publication (the authority) are marked with an asterisk (*) in the glossary. Definitions for which ATP 3-90.15 is the proponent publication are identified by bold font in the text. For definitions shown in the text, the term is italicized and the number of the proponent publication follows the definition.

ATP 3-90.15 applies to the Active Army, Army National Guard/the Army National Guard of the United States, and United States Army Reserve unless otherwise stated. ATP 3-90.15 does not apply to site exploitation conducted by special operations forces.

The proponent for ATP 3-90.15 is the United States Army Combined Arms Center. The preparing agency is the United States Army Combined Arms Center, Mission Command Center of Excellence, Capabilities Development and Integration Directorate, Requirements Determination Division, Unified Exploitation Proponent. Send comments and recommendations on DA Form 2028 (Recommended Changes to Publications and Blank Forms) to Commander, United States Army Combined Arms Center and Fort Leavenworth, ATTN: ATZL-MCC-R (ATP 3-90.15), 806 Harrison Drive, Fort Leavenworth, KS 66027-2302; or by e-mail to usarmy.leavenworth.mccoe.mbx.cadd-org-mailbox@mail.mil; or submit an electronic DA Form 2028.

Introduction

ATP 3-90.15 discusses how site exploitation is planned, resourced, and implemented, and how the resultant information or intelligence is disseminated to the lowest tactical level. Soldiers conduct site exploitation with political, military, economic, and social information, infrastructure, physical environment, or time sensitivity implications to the United States. Both hasty and deliberate site exploitation are considered throughout the operations process and are executed through the exercise of mission command.

The term site exploitation has been redefined in this publication. (See chapter 1, paragraph 1-1.)

This ATP uses the generic term brigade throughout the publication to refer to Army brigade combat teams and brigades in order to recognize that site exploitation is executed by all Army brigades, not just brigade combat teams. Both the terms materiel and material are used within this publication. The terms materiel and material are often confused, but they both have distinct definitions. Materiel includes, but is not limited to, information, documents, electronic data storage multimedia, weapons, personal property, and monies associated with the threat. Material refers to a substance from which something is made or can be made, or a substance that has a particular quality.

ATP 3-90.15 has four chapters and seven appendixes.

Chapter 1 provides an introduction to site exploitation and includes the definition and description of site exploitation activities. Chapter 1 discusses tactical site exploitation and technical exploitation, site exploitation in the operational environment, and how site exploitation supports unified land operations.

Chapter 2 discusses tactical site exploitation planning considerations and the differences between hasty site exploitation and deliberate site exploitation. Chapter 2 also discusses site exploitation and the military decisionmaking process.

Chapter 3 focuses on preparations for tactical site exploitation to include importance of integrating enablers into tactical site exploitation.

Chapter 4 discusses considerations when executing tactical site exploitation. Chapter 4 also discusses techniques used during execution of tactical site exploitation.

Chapter 5 discusses site exploitation assessment techniques and measures for assessing effective site exploitation.

Appendix A provides a tactical site exploitation standing operating procedure.

Appendix B provides lists of what to include in tactical site exploitation kits.

Appendix C provides practical means and methods of evidence collection to support host-nation rule of law.

Appendix D provides sample weapons cache checklists for documenting weapons caches.

Appendix E discusses DOD forensics and the role of the forensic exploitation team.

Appendix F provides information about additional support obtained from government and military organizations when conducting site exploitation.

Appendix G describes an attack scene investigation and provides information on how to conduct an attack scene investigation.

Chapter 1

Site Exploitation

This chapter introduces site exploitation, which is composed of tactical site exploitation and technical exploitation. This chapter also discusses the five core activities of site exploitation and how site exploitation relates to the operational environment and unified land operations.

INTRODUCTION TO SITE EXPLOITATION

1-1. Site exploitation is the synchronized and integrated application of scientific and technological capabilities and enablers to answer information requirements, facilitate subsequent operations, and support host-nation rule of law.

1-2. A site is a location designated by a commander as potentially having materiel pertinent for collection and for the positive identification of persons. Site exploitation contributes to exploitation. Exploitation is 1. Taking full advantage of success in military operations, following up initial gains, and making permanent the temporary effects already created. 2. Taking full advantage of any information that has come to hand for tactical, operational, or strategic purposes. 3. An offensive operation that usually follows a successful attack and is designed to disorganize the enemy in depth (JP 2-01.3).

1-3. Site exploitation is guided by the unit’s information collection plan. (See JP 2-0 and FM 3-55 on doctrine pertaining to information collection and collection planning.) The information collection plan enables the commander to focus assets on collecting information to answer specific information requirements. When the commander designates a site for exploitation, the staff establishes an objective and specific tactical tasks of the information collection plan. The plan also ensures that the staff requests and integrates all necessary enablers before site exploitation. (For more information on staff planning see ADRP 6-0.)

1-4. Materiel is all items necessary to equip, operate, maintain, and support military activities without distinction as to its application for administrative or combat purposes (JP 4-0). Materiel includes, but is not limited to, information, documents, electronic data storage multimedia, weapons, personal property, and monies associated with a threat. A threat is any combination of actors, entities, or forces that have the capability and intent to harm United States forces, United States national interests, or the homeland (ADRP 3-0).

1-5. Materiel is characterized by its associated military application or dual-purpose nature requiring further investigation. The Soldier’s categorization of materiel is aided through their understanding of the operational environment. They use this understanding to determine if materiel has civilian, military, or dual-purpose use. Generally collected during tactical operations, captured materiel is handled using forensically sound techniques to preserve both potential intelligence and evidentiary value.

1-6. Captured materiel consists of those documents, media, equipment, or materiel in the possession of enemy forces that subsequently comes into the control of friendly forces, regardless of origin, to include U.S. or multinational documents or materials once belonging to the enemy. Captured materiel is divided into captured enemy documents and media, and captured enemy material.

1-7. Site exploitation takes advantage of forensic standards when detecting, collecting, processing, and analyzing materiel. Forensic science is the application of multidisciplinary scientific processes to establish facts (DODD 5205.15E). These facts are fused and analyzed to develop intelligence the commander and staff use to take action. Forensics is trained throughout the force generation process and reinforced during deployment to maintain forensic standards.

DISCUSSION OF TACTICAL SITE EXPLOITATION AND TECHNICAL EXPLOITATION

1-8. Site exploitation is composed of tactical site exploitation and technical exploitation. Generally, tactical site exploitation includes activities performed at or near a specific location. Technical exploitation is conducted off-site in a laboratory environment, in most cases. As technologies evolve, adding to tactical site exploitation capabilities, future Army forces can expect to perform more technically advanced core activities on-site. Site exploitation leverages multiple capabilities to varying degrees dependent on needs, location, security, training, and expertise to include—

Search techniques.

Biometrics.

Forensics.

Document and multimedia exploitation.

1-9. Tactical site exploitation is a series of methodical actions taken to ensure that materiel at the site is detected, collected, and processed. The materiel is used to answer information requirements and facilitate future operations. Presumptive analyses of materiel are conducted if trained Soldiers and the appropriate equipment are available.

1-10. Persons found on-site are often screened for the safety of the tactical site exploitation team. If available, human intelligence collectors conduct any questioning. When possible, persons at the site are biometrically enrolled using biometric collection devices. Biometrics is the process of recognizing an individual based on measurable anatomical, physiological, and behavioral characteristics (JP 2-0). Soldiers question persons on-site to obtain information needed to answer information requirements.

1-11. Units performing tactical site exploitation may be reinforced with organic enablers or augmented by theater enablers at the strategic and national level. These enablers provide capabilities not available within the tactical site exploitation element.

1-12. Tactical site exploitation consists of individual and collective tasks completed by Soldiers to establish facts. These facts provide critical information that supports the resolution of the commander’s critical information requirements. Tactical site exploitation may result from the detection of information, materiel, and persons located on the objective following an operation, such as a raid, or cordon and search.

1-13. Technical exploitation is the use of advanced processing techniques and the detailed analysis of information and materiel by technical and scientific enablers in a laboratory environment. Tactical site exploitation and technical exploitation use forensic-based procedures to ensure identification and collection tasks support the analysis and dissemination tasks. Both tactical site exploitation and technical exploitation leaders disseminate the results of their analyses to higher headquarters and the collecting unit. Technical enablers also conduct technical and scientific analysis on-site, if available.

1-14. Technical exploitation is implemented by Soldiers or civilians with specialized training and technical capabilities to process, analyze, and exploit documents, equipment, and other collected items. Technical exploitation is typically conducted off-site but occurs on-site if time, equipment, and manpower are available. Technical exploitation may occur at a forward operating base, military installation, forensics laboratory, secure site, or national-level laboratories for advanced exploitation. Technical exploitation builds understanding of threat capabilities, feeds intelligence, and supports a proactive posture to minimize, neutralize, and defeat threats. When available, over-the-shoulder reachback analysis technology is employed to expedite subject matter experts’ assistance on complex problem sets that Soldiers encounter.

1-15. Information collected from effective tactical site exploitation and technical exploitation supports follow-on operations and targeting, and enhances force protection. The systematic exploitation of information, materiel, and persons supports the full range of military operations through the development of information and intelligence, which promotes greater situational understanding.

SITE EXPLOITATION CORE ACTIVITIES

1-16. Site exploitation is composed of five core activities:

Detect.

Collect.

Process.

Analyze.

Disseminate.

1-17. Commander and staff elements use the core activities to understand, visualize, and describe site exploitation. In general, units implement the majority of site exploitation core activities on-site. The ability of the unit to use presumptive analysis tools on-site allows the commander to comprehend, decide, and react within the threat’s decision cycle. The commander balances performance of the site exploitation activities against the mission variables (mission, enemy, troops and support available, time available, civil considerations, terrain, time, and civil considerations) to determine the extent and viability of actions on the objective and beyond. Tactical site exploitation activities include those efforts necessary to complete the five core activities to the greatest extent possible within the constraints of time, personnel available, risk management, and Soldier safety.

Detection

1-18. Detection is based on a Soldiers ability to discover or notice pertinent information, materiel, or persons. Commanders and staffs develop and maintain information requirements to establish what information, materials, or persons to detect. Within the core activity of detect, Soldiers are expected to use not only recognition, but detection tools to identify the existence of information, materials, or persons perceived to have military interest. Detection involves the initial detection of information, materiel, and persons on-site through the Soldiers own experiences, knowledge, scientific protocols, and site exploitation tools. Therefore, a Soldier is expected to initially recognize the unknown and subsequently detect information, materiel, and persons from their previous experiences and use presumptive analysis.

Collect

1-19. Collection activities occur mainly at the site or on the objective. The collect activity encompasses the means to gather, protect, organize, document, and control the information and materials, and to hold persons detected at the site. During subsequent processing and analysis, secondary detection of additional information or materials may lead to additional collection.

Process

1-20. Process involves the protecting of materials and data from the point of collection and for as long as they hold intelligence or evidentiary value. Process is an activity that requires the preparation and conversion of collected information or materials into a form that is suitable for analysis. Processing is dependent on the results of detection and collection, and serves as a transitional activity in preparation for analysis.

Analyze

1-21. Any analysis of the collected information, materiel, and persons found on-site is conducted to evaluate their relationship to the site and to deduce their probable meaning. Analysis is a process of studying an object in detail for the purpose of explanation. Analyze is the action of examining an object in detail for the purpose of explanation.

1-22. Presumptive analysis is conducted to give some indication as to the identity of the materiel. These tests are by no means conclusive, and further analysis is often required at an appropriate facility. Presumptive analysis establishes that the sample is not a certain substance or the sample probably is the substance. The presumptive analysis of residue on the hands of a suspected bomb maker is realized by using an accepted chemical test known to identify explosive residue. The analysis may conclude the residue is explosive residue or probably is not explosive residue.

1-23. Soldiers conduct an automated assessment of persons on-site by using a biometrics collection device to collect biometric data, which is compared against known data. For example, using a hand-held collection device, a Soldier collects biometric data from a person to compare against an approved biometric database. This automated assessment may or may not identify that person as a person of interest, which requires the collector or leadership to make a presumptive analysis to detain or release the subject.

1-24. Technical exploitation involves the deliberate employment of the five core activities off-site, typically in a laboratory environment, either in the area of operations, in sanctuary, or outside the theater of operations. Technical exploitation applies the scientific process to detect, collect, process, and analyze information and material, followed by dissemination of the results.

1-25. In addition to the on-site analysis, detailed analysis of selected material continues off-site at technical exploitation facilities. However, technical enablers conducting analysis off-site usually have access to scientific equipment, a controlled environment, intelligence reachback capabilities, and a depth of expertise beyond those normally found at the brigade level.

Disseminate

1-26. The disseminate activity is characterized by the horizontal and vertical sharing of information and intelligence across supported and supporting organizations. The disseminate activity includes supporting knowledge management tasks. Analytical results are made available to the originating organization when site exploitation-related information and materiel are transferred to specialized agencies for analysis.

1-27. The site exploitation team uses three formats to disseminate information:

Spot report. The spot report is produced by the site exploitation team on-site. While conducting site exploitation, the unit submits situation or spot reports to the higher headquarters operations and intelligence section. The team can request support in the form of expendable supplies and equipment. The team also provides periodic feedback on site exploitation.

Significant activity report. The higher headquarters of the site exploitation team normally produces a significant activity report associated with the site. This significant activity report preserves the contextual data for assessment, links the site to other collected or analyzed information, and is disseminated to a global information pool.

Amplifying data. Upon return to its base of operations, the site exploitation team consolidates all contextual data associated with the event, including all relevant data, photographic records, and storyboard-type information. This data is linked to a significant activity report that provides an accurate after action update to the earlier significant activity report.

1-28. A presumptive analysis or assessment often results in time-sensitive information and intelligence, or is used to answer information requirements. Site exploitation results are disseminated via a situation report to facilitate immediate commander directed follow-on actions or fusion within the common operational picture. In addition, this information is passed to higher headquarters through the most direct means available. Technical exploitation facilities disseminate the results of their analysis to the widest audience to include the unit that provided the materiel.

1-29. The brigade operations and intelligence team provides additional situational understanding of the operational environment to all units operating within their area of responsibility. The brigade intelligence officer leverages the intelligence enterprise to support the brigade commander with timely and complete information and intelligence. Information and intelligence regarding the brigade area of operations is never withheld from units.

SITE EXPLOITATION CORE ACTIVITIES WORKING TOGETHER

1-30. The vignette illustrates the relationship among the five site exploitation core activities.

The 1st Platoon conducted a raid at the objective location where there was a discovery of a small slip of paper in the pocket of a person. The paper appeared to be a note that included a local phone number (detect). The platoon leader then conducted a walk-through of the site and directed a Soldier to sketch a basic map of the site. The Soldier who did the sketch transitioned to photographer, taking photographs of the site to document the initial conditions upon entry. The platoon leader briefed the Soldiers on the commander’s critical information requirement and informed them about the information found on the slip of paper. The Soldiers put on latex gloves and began a systematic search of the site. The Soldiers detected a false wall containing a sniper rifle of unknown make, model, and origin, along with a cell phone hidden under a mattress (detect).

Those Soldiers without specialized training did not attempt to collect latent prints off items that were sent for processing to the forensic expeditionary facility. As each item was collected, Soldiers photographed them, placed the items in appropriate containers, and labeled the containers using an agreed-upon standard system (included the unit, objective name, building, room, and floor numbers). The labels were affixed to the container for inventory (collect). Soldiers conducted an on-site assessment of both the cell phone and the paper for time-sensitive information (analyze). The cell phone was placed in an electromagnetic/radio frequency isolation bag in preparation for transfer to a technical exploitation facility for advanced technical analysis. The paper was packaged to protect it from damage and to preserve fingerprints or residues. Soldiers cleared the weapon and packaged the rifle to maintain the integrity of fingerprints for transfer back to a captured materiel exploitation site where it could be analyzed in a controlled environment (process).

The platoon leader provided additional situation reports to keep the company commander updated on the investigation (disseminate). The platoon sergeant observed and collected additional information that could potentially lead to the identification of those individuals associated with the objective. The information collected was documented. The information provided additional background and contextual information associated with the site. Soldiers enrolled and compared all persons associated with the objective against the theater-wide Biometrically-Enabled Watchlist using a tactical biometrics collection device (collect). One of the individuals positively matched a person on the Biometrically-Enabled Watchlist (analyze). This person was detained by military police personnel for transfer to a detainee collection point.

Once the site was fully processed, the platoon departed. Upon return to the forward operating base, the digital site sketch and manifest of all collected information and materiel was entered into the theater site exploitation database, where other friendly forces can have near real-time access to the resulting information and intelligence (disseminate).

CONSIDERATIONS FOR EFFECTIVE SITE EXPLOITATION

1-31. Certain materiel requirements and technical enablers are taken into consideration to maximize the effectiveness of site exploitation.

MISSION COMMAND WARFIGHTING FUNCTION

1-32. The mission command warfighting function includes commander tasks, staff tasks, and other tasks performed to accomplish the mission. Clear, consolidated command and control results in effective exploitation. The commander has overall authority and responsibility for site exploitation. The operations officer is the staff lead for site exploitation and is responsible for coordinating site exploitation activities with other staff elements and echelons.

PRESERVATION OF LIFE

1-33. There are two significant considerations regarding preservation of life: mitigating threats and maintaining an awareness of exploitation risks.

Maintaining Risk Awareness

1-34. Commanders and leaders at all levels are expected to know the hazards associated with site exploitation in order to weigh them against the value of the potential information gained from exploitation activities. There are often instances where collection, analysis, and processing of materiel are of paramount importance and worth the risk. The joint principles of restraint, respect, and legitimacy are considered and applied when assessing risk. (See JP 3-0.) Protection of friendly and noncombatant indigenous personnel and the humane, respectful treatment of civilians is a professional responsibility of all members of a tactical site exploitation team.

Mitigating Threats

1-35. Effective site exploitation supports the operations and intelligence processes by providing information and intelligence that can minimize and mitigate imminent and long-term threats to U.S. forces. Information and intelligence obtained as a result of site exploitation provides updated threat warnings that allow the commander to mitigate the threat.

PRESERVATION OF MATERIEL

1-36. Using proper documentation techniques and chain-of-custody procedures is crucial during the collection and processing of materiel. Materiel detected at the site is exploited using the least invasive techniques possible to ensure maximum exploitation capability.

PACE

1-37. Exploitation of materiel is done quickly, but thoroughly. Detection, collection, processing, and presumptive analysis is based on efficient methods that allow for rapid dissemination of information and intelligence. The dissemination of information and intelligence to the commander is critical for conducting a successful operation.

PRIORITIZATION

1-38. The commander decides how to prioritize exploitation activities based on the phase of operations. Potentially large volumes of materiel are assessed to identify what materiel requires further analysis. Rational prioritizing of decisions is accomplished only if the requirements and exploitation capabilities are fully understood. The finite number of collection, processing, and exploitation assets mandates the prioritization of collected materiel. Criteria used to prioritize materiel are—

Answers identified information requirements.

Examples of new technology.

Results in a friendly force fatality.

Results of presumptive testing.

INFORMATION MANAGEMENT

1-39. Information management is the function of administering an organization’s information resources. Information sharing and data archiving enhance consistent handling of knowledge acquired by one or several individuals and organizations.

INFORMATION SHARING AND DISSEMINATION

1-40. Information obtained from site exploitation provides additional information and actionable intelligence if shared to the greatest extent possible. Documents are written for release to support widest dissemination at the lowest possible classification. Dissemination requires a robust, open system structure that enables widespread information sharing. Information sharing is enhanced when it is disseminated in a standard format and vocabulary. Effective information sharing involves assigning a unique identifier, such as a case number, using standardized methods for cataloging materiel into multiple reports. This identifier is a method of providing a lifetime affiliation for tracking related materiel through a workflow. The identifier also enables coordination of current and future exploitation, analysis, and subsequent prosecution.

DATA ARCHIVING

1-41. Data at all levels is archived, which is a practice that supports ongoing and future operations. Archived data is valuable information that aids future targeting, intelligence analysis, and legal proceedings. In addition, archived data provides historical context to current and future operations, and facilitates a rapid response to critical requests for information. Standard handling and processing methods are used to manage and retain the integrity and authenticity of data. Using common information sharing tools, the archived data is also made readily accessible to partner nations.

EXPLOITATION AWARENESS

1-42. The collection and analysis of materiel having forensic value is vital to intelligence and targeting efforts, but are only useful if the materiel is recognized. Exploitation depends on Soldiers who have a fundamental awareness of the potential importance of materiel. The decision regarding what materiel to collect and exploit is based on the collection plan and any contextual significance of the items. Depending on the tactical situation, personnel may decide not to collect items assessed as having little or no value. Items of little value are left on-site, while items that pose a threat to the population or are unsafe to recover are destroyed on-site. The significance of each item collected is recorded using DA Form 4137 (Evidence/Property Custody Document), and DA Form 4002 (Evidence/Property Tag). Both forms accompany the item to the exploitation facility.

SCALABILITY AND MODULARITY

1-43. Site exploitation enabling capabilities are scalable based on the volume and complexity of the materiel and the criticality of the potential information recovered. The type of operation, location, proximity to combat operations, and availability of resources determine the extent of exploitation activities. The modular design of technical exploitation capabilities allows commanders to use and interchange elements based on the operational environment.

SITE EXPLOITATION IN THE OPERATIONAL ENVIRONMENT

1-44. Successful operations are the result of a thorough understanding of the operational environment and the composite of the conditions, circumstances, and influences that affect the employment of capabilities and the decisions of the commander. (See ADRP 3-0.) Commanders and staffs use the operational variables (political, military, economic, social, infrastructure, information, physical environment, and time), and the mission variables (mission, enemy, troops and support available, time available, civil considerations, terrain, time, and civil considerations) to analyze the operational environment. The operational environment is dynamic and constantly changing. The commander and staff maintain their understanding of the operational environment by continuously acquiring and updating information. Through this understanding, the commander and staff are able to comprehend the impact of changes relative to the ongoing operations. It is critical that commanders develop an in-depth understanding of how to use site exploitation as a tool for shaping the operational environment.

1-45. Site exploitation is consistent with the current, and projected operational environment. Commanders anticipate potential capabilities of a threat to prepare Soldiers on how to adapt to changing threats. Commanders should review the United States Army Forces Command predeployment training messages to determine if their Soldiers are prepared for a short-notice deployment.

1-46. Recent experience has shown the effectiveness of site exploitation in counterinsurgency. However, the Army prepares for future operations across the range of military operations using a postulated operational environment. Under this condition, site exploitation capabilities are designed to adapt to any military contingency. Site exploitation during major combat is just as effective in developing facts, information, and intelligence as in counterinsurgency operations. Commanders and staffs plan for the integration of site exploitation enablers while conducting the operations process. Comprehensive planning facilitates the introduction of site exploitation capabilities and enablers into military operations at the time and place of the commanders’ choosing.

1-47. Soldiers are trained to perform site exploitation in complex environments where state and non-state actors challenge the host nation and the United States. The threat can employ technological and social networking tools to enhance capabilities to organize, resist, and attack friendly forces. The use of emerging technologies and social media provides the threat with the opportunity to act within the Army’s decision cycle and challenge military capabilities.

1-48. Site exploitation is a shared task performed by tactical, operational, strategic, and national assets. The collected information is analyzed from operational and intelligence perspectives, and provides the commander with knowledge to comprehend the threat, the threat’s decision cycle, and the operational environment.

SITE EXPLOITATION IN SUPPORT OF UNIFIED LAND OPERATIONS

1-49. The role of site exploitation in unified land operations begins during the mission planning phase. Commanders provide their intent and information requirements, and the staff plans the site exploitation activities aimed at fulfilling those information requirements. Site exploitation activities are then integrated into the concept of operations and used to support information collection efforts. The operations section develops site exploitation by meeting the commander’s information requirements and collecting information on the evolving operational environment. The operations section coordinates with personnel to obtain the tools required to conduct site exploitation from echelons above corps or theater assets, as necessary.

INTELLIGENCE ANALYSIS IN SUPPORT OF SITE EXPLOITATION

1-50. Commanders make decisions based on their understanding of the environment in which they are operating. Intelligence analysis aids the commander in gaining the situational understanding necessary for decision making. Intelligence analysts are trained on a variety of analytical techniques used to make conclusions. In some cases, analyzing the complexities of the operational environment requires a diverse combination of subject matter experts, analytical processes, and culturally tailored approaches. The techniques used range from simple to extremely complex. (For more information on intelligence analysis, see ATP 2-33.4.)

1-51. Analytic techniques are important to the planning, preparation, and completion of information collection during site exploitation. There are three types of analytic techniques used in site exploitation: pattern analysis, link analysis, and network analysis.

Pattern Analysis

1-52. Pattern analysis is an analytical technique that determines possible future actions of a threat when there is little or no near real-time information available concerning threat location, disposition, movement, or objectives. There are three basic activities involved in conducting pattern analysis: determine what is known about the threat, conduct a pattern analysis of the threat’s recent activity, and determine possible threat actions.

Link Analysis

1-53. Link analysis is an analytic technique used to evaluate relationships or connections between various types of objects, including organizations and individuals who use visualization tools to organize and display data. There are three types of visualization tools used in link analysis to record and visualize information: the association matrix, the activities matrix, and the link diagram.

Network Analysis

1-54. Network analysis is the examination of dynamic, multi-link human networks characterized by varying degrees of uncertainty, such as terrorist and other irregular threat organizations usually encountered in a counterinsurgency mission.

CIVILIANS ON-SITE

1-55. Army forces anticipate and prepare for unknown encounters with threats at a site. Defeating and destroying threat forces is one way to secure a site for exploitation. Soldiers are expected to remain flexible when securing an exploitation site. Soldiers are also careful not to harm noncombatants or cause indiscriminate damage. Threat forces often defend sites tenaciously until they are eliminated. Some threats attempt to surrender, while other threats abandon the area to avoid confrontation with Army forces. As Army forces approach valuable areas of a site, threat resistance can sharply increase.

1-56. Usually, there are people at or around the location targeted for tactical site exploitation. Care is taken when working with these people in respect to their culture, in preserving information and evidence, following rules of engagement, and understanding theater policy. There are two basic groups of people associated with the site: those who are able to leave of their own free will, and those who are restricted from leaving.

1-57. Questioning in support of site exploitation involves the Soldiers asking voluntary questions of the population at and around the site. Unless otherwise stated in this publication, voluntary questioning refers to questioning in support of site exploitation. DODD 3115.09 defines captured or detained personnel as a person captured, detained, held, or otherwise under the control of DOD personnel. This does not include DOD personnel or DOD contractor personnel being held for law enforcement purposes. Personnel who fall into the category of detained or captured can only be questioned following the guidelines for tactical questioning, or by trained and certified human intelligence, counterintelligence, or law enforcement personnel. (For more information on tactical questioning, see FM 2-91.6.)

1-58. Questioning is a way to obtain the information needed to complete a capture tag and provides supporting information that clearly identifies an individual. The duration of any tactical questioning is dependent on mission, enemy, time, and terrain. During tactical questioning, the interrogator is not to persuade a detainee to talk who refuses to answer questions. Tactical questioning and interrogation is only conducted by trained and certified DOD interrogators.

1-59. FM 2-22.3 describes interrogation as the systematic effort to procure information to answer specific collection requirements by direct and indirect questioning techniques of a person who is in the custody of the forces conducting the questioning. Only highly trained personnel who are certified in interrogation methodology conduct interrogations. Interrogations are conducted in accordance with the law of war, regardless of the echelon or environment in which the human intelligence collector is operating. Applicable law and policy include U.S. law, the law of war, relevant international law to include any status of force agreements, and relevant directives including DODD 3115.09 and DODD 2310.01E. (See FM 27.10 for more information on the law of war.)

Chapter 2

Site Exploitation Planning

This chapter introduces planning concepts in site exploitation. This chapter also discusses how to integrate unique site exploitation considerations into the military decisionmaking process. Site exploitation planning considerations supplement those planning considerations already in place when conducting deliberate or time-sensitive planning.

PLANNING CONCEPTS IN SITE EXPLOITATION

2-1. Commanders and staffs use the military decisionmaking process and small-unit leaders use the troop leading procedures to plan and prepare for site exploitation. Both of these processes have universally understood procedures that apply selected concepts to site exploitation planning.

2-2. Site exploitation planning requires technical and tactical competence. Planning concepts related to site exploitation are—

Nested concepts.

Sequencing of actions and phasing.

Decisive points and objectives.

Hasty site exploitation.

Deliberate site exploitation.

NESTED CONCEPTS

2-3. Site exploitation is nested within the higher headquarters concept of operations. Commanders conducting operations that include site exploitation ensure that subordinate unit missions are integrated by task and purpose. For example, conducting a cordon and search or raid can result in information and intelligence that facilitates subsequent attacks targeting the threat network. Similarly, technical and forensic exploitation of components recovered from a cache can yield actionable intelligence that allows commanders to target the actors who make up threat networks. The commander ensures the concept of operations clearly describes the site exploitation scheme of maneuver and expresses how each element can cooperate to accomplish the mission.

SEQUENCING OF ACTIONS AND PHASING

2-4. The availability of resources, such as time, forces, and specialized assets, allows commanders to synchronize subordinate site exploitation actions in time, space, and purpose. The five core activities of site exploitation follow the general sequence of detect, collect, process, analyze, and disseminate. Planning for site exploitation requires phasing that is linked to other tactical tasks, forces available to include enablers, and the postulated threat.

2-5. Friendly forces perform sequenced or phased tactical tasks identified in the prepared operations plan. These tactical tasks include isolating, controlling, or seizing an objective. Maneuver forces conduct tactical tasks (raid, cordon and search, secure, and isolate) to protect a site before other forces begin searching and collecting materiel and holding personnel on-site. After maneuver forces complete their tasks, units such as forensic collection units, or chemical, biological, radiological, and nuclear teams, begin to perform their tasks. Specialized military intelligence collection assets available to the maneuver force commander include human intelligence teams, counterintelligence teams, and multifunctional teams. When availability of these assets are limited, commanders may sequence their support across several phases of an operation.

DECISION POINTS AND OBJECTIVES

2-6. Commanders maintain flexibility in their planning by identifying decision points that allow them to adapt to a changing operational environment. As commanders reach a decision point, they initiate a branch plan or sequel. Implementing branch plans facilitates commanders in changing the scope of the site exploitation mission, disposition, orientation, or direction of movement based on anticipated events. Examples of decision points that allow flexibility during site exploitation planning are—

Chemical, biological, radiological, nuclear, and explosive threats and hazards.

Significant environmental hazards (hazardous material or waste).

High-value individuals.

External disruptions, such as threat attacks, that require protecting the site until specialized teams arrive to neutralize or reduce the threat.

A large munitions or explosives cache.

Information, materiel, and personnel that meet the criteria for a sensitive site. A sensitive site is a geographically limited area that contains, but is not limited to, adversary information systems, war crimes sites, critical government facilities, and areas suspected of containing high value targets (JP 3-31).

HASTY SITE EXPLOITATION

2-7. A decision point can result in a hasty site exploitation. A hasty operation is an operation in which a commander directs immediately available forces using fragmentary orders to perform actions with minimal preparation, planning, and preparation time.

2-8. Commanders rely on intuitive decision making to take advantage of hasty site exploitation opportunities. A hasty site exploitation can result from an engagement in which a Soldier detects an object that answers an information requirement. In response, the commander directs a more extensive search to detect any additional information, materiel, and personnel. The length of time available to conduct a hasty site exploitation is based on any follow-on missions, the threat to friendly forces, and the size of the element required to conduct a more thorough site exploitation.

DELIBERATE SITE EXPLOITATION

2-9. A deliberate site exploitation is an operation in which a commander has a detailed understanding of the situation that allows him to visualize detailed plans, such as multiple branches and sequels. The commander task-organizes the site exploitation teams for site exploitation, to include enabler support. Extensive rehearsals are conducted before the operation to ensure that all personnel are properly trained and equipped, and know their respective roles.

2-10. A deliberate site exploitation is characterized by meticulous planning that includes effective targeting, supported by a detailed intelligence or information collection plan. Commanders and staffs apply the operations process to ensure site exploitation teams and enablers are task-organized and equipped to exploit the targeted objective.

2-11. The main difference between hasty and deliberate operations is the time available for planning and preparation. Army planners analyze the operational environment using the interrelated operational variables. This understanding of the operational variables permits the commander and staff to define their operational environment and determine whether a hasty or deliberate site exploitation is necessary.

2-12. Upon receipt of a warning order or mission, Army leaders filter relevant information, categorized by the operational variables, into categories of information used during mission analysis. The commander task-organizes forces to take advantage of unexpected site exploitation opportunities. It is imperative to integrate the site exploitation enablers into the supported organization to take advantage of specialized skill sets. Regardless of the time available, any site exploitation opportunity has the potential to yield answers to information requirements, and other relevant information. Even benign missions present unexpected opportunities. Therefore, every effort is made to maximize site exploitation within the mission constraints. Successful future targeting or prosecution of high-value targets is often determined by the amount of time the team spends on the site. (See ADRP 3-90 for more information on hasty and deliberate operations.)

INFORMATION COLLECTION

2-13. Site exploitation activities are integrated into the concept of operations and support information collection efforts. Information obtained from site exploitation is disseminated and then consolidated with other information and intelligence to broaden knowledge of a site. This broader knowledge keeps the staff informed about processes and procedures, enhances the commander and staff’s understanding of the operational environment, and helps refine the commander’s critical information requirements. Information collection efforts supported by site exploitation include—

Analyzing information requirements and intelligence gaps.

Evaluating the capacity of available site exploitation enablers that are internal and external to the organization.

Prioritizing site exploitation assets controlled by the organization for collecting information to answer the commander’s critical information requirements.

Identifying site exploitation shortfalls the unit cannot fulfill.

Requesting support from adjacent and higher headquarters to fill unresolved site exploitation requirements.

2-14. Information collection enables the commander and staff to confirm or deny assumptions made during site exploitation planning. Developing a collection plan that is prioritized by item type (digital multimedia, weapons, clothing), location, or information requirement, aids the site exploitation team in identifying high-priority items.

2-15. Site exploitation answers information requirements that can improve the commander’s situational understanding of the operational environment. The answered information requirements enable the commander to make better decisions, such as task-organizing the site exploitation team. Information collection tasks related to site exploitation often lead to additional hasty site exploitations. (See FM 3-55 for additional information on information collection.)

2-16. Site exploitation takes advantage of information collection opportunities provided by the site exploitation enablers. These enablers come with skillsets that allow the commander to see different perspectives regarding the materiel collected on-site. In addition, enablers often have database reachback capabilities that the commander can leverage.

INFORMATION COLLECTION AND NETWORKS

2-17. Site exploitation results in information that allows the commander and staff to identify and engage friendly, neutral, and threat networks that influence the operational environment. This information is used to develop a knowledge base of a network's relational dynamics within the context of a dynamic operational environment. For this reason, names of all individuals on-site are transmitted to the brigade targeting cell, or equivalent, for cross-referencing to existing network models. (See ATP 3-90.37.) This information enhances a commander’s knowledge base, which leads to better-informed decision making following the staff’s course of action brief.

ANALYTICAL TOOLS

2-18. Analytic tools are available to the operations and intelligence sections that allow graphic portrayal of information. Graphic portrayal is continuously refreshed, providing the commander with a way to determine the effectiveness of site exploitation. (See ATP 2-33.4 for additional information on analytical tools.)

Association Matrix

2-19. An association matrix portrays the existence of a known or suspected association between individuals. Direct associations include face-to-face meetings or telephone conversations. Cell phones, laptops, and even individuals often provide details to discovering unlikely associations that help identify sole points of failure.

Activities Matrix Analysis

2-20. An activities matrix analysis shows relationships between data sets. Relationships in large data sets are established by similarities between nodes and links in a network of people. People are identified by their participation in independent activities.

Pattern Analysis

2-21. Pattern analysis is the detection of patterns in data from the same source used to make predictions of new data. This tool supports the questions of where and when materiel is detected and collected.

Nodes and Links

2-22. Vulnerable nodes and links are identified using network analysis in coordination with targeting techniques. The staff focuses on nodes and links to develop courses of action intended to cause disruptions that force threat networks to modify their plans.

ROLES IN PLANNING SITE EXPLOITATION

2-23. Commanders visualize, describe, direct, lead, and assess operations to include the staff’s planning and orders production. Visualization includes understanding the purpose of the site exploitation and the current state of friendly forces in relationship to the threat and the environment. After visualization, commanders clarify their guidance by articulating intent, planning guidance, and information requirements. Commanders consider—

Restraint and the ethical application of land power.

Size of the security force in respect to the threat.

Anticipated amount of time a security force needs to secure the site.

Capability of the site exploitation element in relation to anticipated information, materiel, people, and cultural and natural resources at the site.

Possibility of hazardous material on the site.

Anticipated high-priority materiel found at the site.

Whether the environment is permissive or nonpermissive.

Guidance provided to subordinate leaders that includes the ethical application or restraint of lethal force. The correct decision is ethical, effective, and efficient.

2-24. Staff planning includes—

Understanding what assets are available, such as multifunctional teams, military police, engineers, or combat cameras.

Deciding on a hasty or deliberate site exploitation based on mission analysis.

Calculation of time on the objective to execute detect, process, and collect tasks.

Understanding available capabilities and limitations to frame courses of action, which assists the commander and staff in determining what assets match the mission requirements.

2-25. The staff assists the commander with decision making and developing effective plans and orders. The staff initially performs mission analysis to develop the information the commander requires to evaluate the current situation and mission. (See ADRP 5-0 for more information on mission analysis.) The staff performs critical tasks while planning near-term or future activities:

Develop and maintain the running estimate.

Identify specified and implied tasks completed when conducting site exploitation activities.

Identify site exploitation constraints.

Calculate the time on the objective required to complete site exploitation and security tasks.

Perform intelligence preparation of the battlefield tailored to site exploitation.

Formulate a concept of operations and a concept of support in line with the commander’s intent.

Develop the scheme of maneuver to support site exploitation.

Prepare, authenticate, and distribute the site exploitation portion of the plan or order, appendixes, and estimates.

2-26. Specified coordinating and special staff officers provide their recommendations to the commander and operations officer on site exploitation-related capabilities of their supporting organizations to include—

Capabilities and limitations of specialized assets such as chemical, biological, radiological, and nuclear units, explosive ordnance disposal units, and technical intelligence units.

Document and multimedia exploitation availability to support site exploitation activities.

Availability of human intelligence collection capabilities.

Site exploitation capabilities of host-nation authorities or multinational military partners.

Rules of engagement and site exploitation collection requirements.

Site exploitation capabilities and availability of organic forces, enablers, and external support.

Availability of reachback analytic capability to regional expeditionary forensic sites, document and multimedia exploitation, and strategic and national laboratories.

2-27. Search advisors and coordinators are not recognized positions within the brigade’s modified table of organization and equipment. Organizations designate search advisors and coordinators as additional duty positions to support site exploitation. Available specialized assets support the commander with limited collection training for organic forces and provide augmentation to site exploitation. Search training is sometimes available during home-station training lanes and predeployment exercises.

SITE EXPLOITATION AND THE MILITARY DECISIONMAKING PROCESS

2-28. The staff integrates site exploitation activities upon receipt of a mission. Site exploitation activities are assessed during mission analysis and course of action development.

RECEIPT OF MISSION

2-29. Site exploitation planning is initiated in anticipation or receipt of a mission, as a branch or sequel to an ongoing operation, as part of a base order, or as part of a unit standing operating procedure. Information gained from site exploitation can lead to a follow-on operation. Site exploitation supports the commander’s decision-making process by providing information needed to satisfy information requirements. The staff adjusts the collection plan if the information requirements are not satisfied, which often leads to further site exploitation.

Running Estimates

2-30. Before conducting mission analysis, the staff evaluates and updates the running estimate based on new information, the status of friendly forces, and resources available. The staff maintains a running estimate throughout the operations process. The running estimate assesses the availability of equipment, such as tactical biometric collection devices, biometric identity management tools, remote detection assets, and language translation tools. Running estimates provide the status or availability of—

Trained organic tactical support element teams (predeployment guidance is referred to, if available, for size and training requirements).

Document and multimedia exploitation assets.

Technical intelligence teams.

Multifunctional teams.

Explosive ordnance disposal.

Forensic exploitation teams.

Military working dog teams.

Military police.

Criminal investigation division special agents.

Female engagement teams.

Host-nation law enforcement officials and investigators.

Environmental assets.

Linguists.

Forensic laboratories and facilities.

Initial assessment.

2-31. Initial assessment focuses on time constraints. Time constraints significantly influence site exploitation planning because of the perishable nature of the information or intelligence that initiated the site exploitation mission. The commander and staff are required to receive and develop information quickly in order to disrupt the threat’s decision cycle.

2-32. Assessment is continuous; it precedes and guides every operations process activity and concludes each operation or phase of an operation. Assessment activities consists of, but are not limited to monitoring the current situation to collect relevant information, evaluating progress toward attaining end state conditions, achieving objectives, and performing tasks, and recommending or directing action for improvement.

Initial Guidance

2-33. The commander provides initial guidance that outlines multiple factors (initial guidance is not the same as the commander’s initial planning guidance, which occurs during mission analysis). The initial guidance provides the operational timeline and initial information requirements.

2-34. Commanders develop their initial guidance based on initial visualization. As commanders visualize the site exploitation mission, they provide guidance to the staff, while allowing opportunities to explore different options, based on the time available for planning. Initial guidance focuses on information collection considerations required to develop courses of action to meet the desired end state.

MISSION ANALYSIS

2-35. The commander and staff conduct mission analysis to better visualize the operation. The process and products derived from mission analysis aids commanders in refining their situational understanding.

Analyze the Higher Headquarters Order

2-36. The commander and staff analyze the higher headquarters order and guidance, which helps them determine how site exploitation activities are nested within the higher headquarters mission, commander’s intent, and concept of the operation. The staff determines how site exploitation supports the higher headquarters’ operational and strategic objectives.

Conduct Initial Intelligence Preparation of the Battlefield

2-37. The entire staff, led by the senior intelligence officer staff, develops intelligence preparation of the battlefield products to assist the commander in identifying all aspects of the area of interest that affect mission accomplishment. The intelligence preparation of the battlefield process is collaborative in nature; it requires information from all staff elements and some subordinate units.

2-38. The results and products of the intelligence preparation of the battlefield process are used in site exploitation planning to identify gaps in information pertinent to initial information collection and site exploitation planning and to identify limitations or requirements regarding size of buildings, number of rooms, scale and security of an area, and any environmentally significant aspects. Site exploitation is often conducted in proximity to a civilian population and infrastructure. Site exploitation can interfere with a population’s daily routine. Therefore, any negative responses to site exploitation are taken into consideration. The staff reviews and assesses the impact of the site exploitation on civil considerations (areas, structures, capabilities, organizations, people, and events) during planning.

2-39. Results and products of the intelligence preparation of the battlefield process are also used to analyze recent threat tactics, techniques, and procedures in relationship to the effects on the battlefield, and then determine what tactics, techniques, and procedures are used by the threat. Site exploitation considerations include the threat’s use of women and children as couriers, false walls in buildings, or storing weapons and materiel inside buried containers. Intelligence preparation of the battlefield is also useful in determining the threat’s reaction to the site exploitation, which is critical to determining friendly courses of action that prevent damage to the site’s contents.

Determine Specified, Implied, and Essential Tasks

2-40. Site exploitation is sometimes a specified task in the higher headquarters’ operation order. Specified tasks related to site exploitation can include—

Capturing high-value individuals.

Searching an area, building, persons, or vehicles.

Processing persons and materiel according to standards.

Reviewing information requirements.

2-41. Site exploitation is a combined arms mission. The requirement to collect materiel, answer information requirements, conduct on-site analysis, and develop the information gained is implied in all operations when not directed as a specified task. Site exploitation includes implied tasks, such as evidence preservation, biometric enrollment, and forensic collection, which are supporting tasks needed to meet the purpose of the operation.

2-42. Site exploitation tasks are designated as essential tasks by the commander. Essential tasks are always included in the mission statement. Examples of mission statements related to site exploitation are—

On order, conduct site exploitation to locate materiel related to improvise explosive devices for technical analysis.

On order, conduct site exploitation to gain information supporting operational objectives.

REVIEW AVAILABLE ASSETS

2-43. Planning involves analyzing the organizational structure and supporting assets (direct and general) available to perform the task. Site exploitation requires a clear understanding of the personnel available, their level of training, and in what capacity they can support site exploitation tasks. Maneuver Soldiers trained in search tasks provide a different level of capability than an engineer squad trained in specialized search techniques and equipment. Identified environmental concerns often require personnel trained in environmental issues and hazardous material tactics, techniques, and procedures.

2-44. Additionally, equipment available (biometric identification tools, void anomaly detectors, or ground-penetrating radar) influences course of action development. Commanders consider the time available for site exploitation planning and the time sensitivity of the collected information, materiel, and detained personnel. The availability of supporting agencies that provide technical analysis, forensic collection, and can render-safe capabilities also influence site exploitation planning and course of action development. Commanders, coordinating staffs, and liaison officers identify capabilities and limitations of the assets associated with their respective area of expertise. Commanders also need to know about exploitation-specific information systems and which are the quickest for receiving feedback.

Specialized Support Assets for Tactical Site Exploitation

2-45. The brigade may request specialized support assets for tactical site exploitation. There are some Army assets commanders prefer for task-organizing tactical site exploitation teams. Although, commanders also create ad hoc organizations based on their specific mission and operational environment.

2-46. The mission variables drive the staff’s planning at the tactical level. At the battalion level, there are limited organic resources available to the unit to accomplish tactical site exploitation. Brigade and higher-level assets often assist in tactical site exploitation. As the site complexity and potential for intelligence increases, specialized teams and other assets are required to assist or take over the site exploitation, while the battalion assets provide security.

2-47. Platoon, company, and battalion Soldiers on the objective conduct a basic search of the site. The technical nature of the site’s materiel drives the requirement for specialized site exploitation capabilities and corresponds with an increase in the amount of time on the objective. Military working dog teams, explosive ordnance disposal experts, human intelligence teams, document and multimedia exploitation enablers augment the unit or take control of tactical site exploitation based on the complexity of the site. Sensitive sites, such as weapons of mass destruction or mass grave sites, require specialty teams with unique capabilities and are usually beyond the normal scope or capabilities of the battalion or brigade based on organic assets and time available.

Brigade Support Assets for Tactical Site Exploitation

2-48. The brigade has organic assets tasked to conduct tactical site exploitation missions. The commander and staff use risk management techniques to determine the risk of using organic specialized assets with limited availability to support tactical site exploitation missions. The brigade staff then receives additional guidance from the commander on how to mitigate risks by integrating other factors such as external assets, time, and training into the tactical site exploitation.

2-49. A brigade’s site exploitation team is augmented with external enablers. Site exploitation teams exploiting sites containing hazardous or sensitive materiel often require specialized strategic or national assets to reduce the risks. For example, a mission to exploit a bomb maker’s workshop requires augmentation from the explosive ordnance disposal team to render any devices as safe before starting the tactical site exploitation.

2-50. Time is always a significant factor when conducting tactical site exploitation with organic assets. The use of specialized assets for brief periods for determining a site's potential to yield valuable information is unlikely to degrade the capabilities of the brigade. However, using theater, national, or strategic assets for an extended period of time, requires additional planning to manage scarce resources.

ENABLING CAPABILITIES THAT SUPPORT TACTICAL SITE EXPLOITATION

2-51. Enabling capabilities provide technical information to commanders, intelligence staffs, force protection providers, and multinational partners to achieve tactical, operational, and strategic objectives. Enabling capabilities support technical exploitation, including outputs such as pattern analysis, high-value targeting, technical intelligence, network analysis, movement analysis, judicial proceedings, identification of persons, and the confirmation of claimed identities.

TRANSPORTATION

2-52. Successful site exploitation is dependent on the safe and timely movement of materiel to technical exploitation facilities, and the transfer of persons of interest from the point of contact to a detainee collection point or holding area. Government and commercial resources are used for movement depending on the nature of the materiel and desired speed. At times, materiel shipments require prioritized handling, necessitating the use of non-routine transportation methods. Each transportation movement, transmittal of information, and transfer of persons of interest is documented using standard procedures to ensure compliance with legal and intelligence requirements. Movement of some information requires the use of unclassified or classified communications networks to prevent unauthorized disclosure of the contents and the type of transportation mode used.

LATENT PRINT EXAMINATION

2-53. Latent prints, such as the palms and fingers, are collected during tactical site exploitation, before or subsequent to document and multimedia translation and throughout other technical exploitation activities. Although the word latent means hidden or invisible, the term latent prints refers to any impression left by friction of ridge skin on a surface, regardless of whether it is visible or invisible at the time.

2-54. Latent print examination compares unknown biometric attributes to reference data maintained in authoritative repositories. The sophistication of latent print processing increases from its capture at an exploitation site through advanced technical exploitation. Unknown prints are compared to known prints by certified fingerprint and biometric experts or by automated databases. This process strips away an individual’s anonymity to support the targeting working group.

BIOMETRIC-ENABLED WATCHLIST AND REGIONAL BIOMETRIC DATA SETS

2-55. Soldiers designated to conduct on-site biometric collections download the latest Biometric-Enabled Watchlist and biometric databases to their biometric collection devices before site exploitation missions. This enabling capability allows collectors to identify or enroll subjects who were encountered or detained on-site.

DEOXYRIBONUCLEIC ACID ANALYSIS

2-56. Deoxyribonucleic acid (DNA) is the unique genetic material present in the cells of all living organisms. DNA is collected on-site using specialized collection tools, and is analyzed off-site at a forensic laboratory. The DNA profiles produced from analyzing collected samples is compared to previously produced DNA profiles, which biologically links people to objects and events. When compared with other information and intelligence, DNA is used to identify networks and support targeting.

FIREARMS AND TOOL MARK EXAMINATION

2-57. Forensic firearms and tool mark examination applies scientific practices to the examination of firearms, ammunition components, gunshot residue, bullet trajectories, and related materiel to determine the relationship of a firearm or tool to a person or event. This process is applied to standard and improvised weapons, where the information is used to determine weapon capabilities and country of origin.

ELECTRONIC EXPLOITATION

2-58. Electronic exploitation specialists characterize electronic components and conduct reverse engineering of electronic devices to assess trends, produce electronic profiles, study electronic and mechanical construction, identify transmission and reception frequencies, isolate voltages and codes, and develop any countermeasures. Electronic exploitation specialists conduct electronic profiling and disseminate technical information to commanders, intelligence staffs, force protection providers, and multinational partners. This information is used to achieve tactical, operational, and strategic objectives.

MECHANICAL EXPLOITATION

2-59. Mechanical exploitation focuses on the mechanical components of materiel such as mechanical switches and relays, and other similar items. Mechanical exploitation is accomplished in conjunction with electronic and explosive materiel, and other types of technical exploitation. The resulting information provides technical intelligence that is further analyzed. Analysis only has value if it is disseminated to the widest audience.

EXPLOSIVE MATERIEL EXPLOITATION

2-60. The technical exploitation of explosive material focuses on presumptive, confirmatory, and unambiguous testing on-site and at technical laboratories. Explosive material exploitation includes identification of charges and precursor elements, and often involves trace analysis of explosive residue.

DOCUMENT AND MULTIMEDIA EXPLOITATION

2-61. Document and multimedia exploitation is the processing, translation, analysis, and dissemination of collected hardcopy documents and multimedia. However, certain document and multimedia exploitation materials are withheld from dissemination to protect sensitive information, sources, and methods. Document and multimedia exploitation includes any information storage multimedia and the means by which it was created to include written, mechanical, chemical, electronic, optical, or magnetic form. Technological advances in recent years have recognized three document and multimedia exploitation components: document exploitation, multimedia exploitation, and cell phone exploitation.

2-62. Document and multimedia exploitation operations identify information of value in captured documents and multimedia, provide timely and relevant information to commanders, support the intelligence and operational decision-making process, and support judicial proceedings through application of preservation and chain-of-custody procedures. (See ATP 2-91.8 for more information on document and media exploitation.)

CHEMICAL, BIOLOGICAL, RADIOLOGICAL, AND NUCLEAR MATERIAL EXPLOITATION

2-63. Operations involving the exploitation of chemical, biological, radiological, and nuclear material requires specialized national and strategic resources in addition to augmentation from theater chemical, biological, radiological, and nuclear assets.

OTHER MATERIEL EXPLOITATION

2-64. Soldiers are expected to have the ability to closely examine and analyze all materiel deemed as having possible intelligence value. Other materials such as hair and textile fibers, fabrics, and cordage, are often recovered during site exploitation and are subjected to trace analysis. Trace analysis is the examination and comparison of small particles by a variety of forensic disciplines.

DETERMINE CONSTRAINTS

2-65. A constraint is a restriction placed on the command by a higher command. A constraint dictates an action or inaction, thus restricting the freedom of action a subordinate commander has when planning. Examples of constraints for site exploitation planning include, but are not limited to, rules of engagement, search restrictions relating to males or females, and rules for the use of force. Constraints affect courses of action development of both the parent unit and subordinate elements. Constraints are considered as tasks and included in the coordinating instructions in operations orders to account for the impact on site exploitation planning and execution.

IDENTIFY CRITICAL FACTS AND ASSUMPTIONS

2-66. Facts are verifiable information that form the foundation for the development of solutions. For planning, an assumption is information accepted as potentially true in the absence of fact and is essential to continued planning. The commander and staff attempt to confirm or deny the validity of assumptions. For planning purposes, assumptions are treated as facts. Examples of assumptions having the potential to impact site exploitation are—

Booby traps will be present on the site.

The threat will attempt to conceal its identity.

The building will contain hidden compartments.

Persons or materiel on-site may have intelligence and prosecutorial value.

ASSESS RISKS

2-67. Leaders at all echelons conduct risk assessments before each tactical site exploitation or technical exploitation. A risk assessment increases the staff’s awareness of anticipated or unknown risks. Risk assessment also allows for planning measures that mitigate the risk to the Soldier. Leaders on-site use risk assessment to avoid or mitigate hazards and risks. The goal of risk management is to implement controls that remove hazards or reduces the residual risk to an acceptable level.

RISK AWARENESS

2-68. Commanders and leaders at all levels need to know the hazards associated with site exploitation. Risk awareness allows commanders and leaders to weigh hazards against the anticipated value of the information gained from site exploitation. There are instances where the collection, handling, and processing of materiel is of paramount importance and can potentially place Soldiers at risk. Commanders and leaders minimize risk to Soldiers by establishing mitigation measures and safety guidelines before conducting tactical site exploitation.

THREAT MITIGATION

2-69. An effective site exploitation supports the operations and intelligence cycles by minimizing and mitigating imminent and long-term threats to Soldiers and their associated equipment. Information resulting from site exploitation activities is disseminated to issue threat warnings to the force.

PERFORM RISK MANAGEMENT

2-70. Risk management integration occurs during the operations process and is typically managed by the unit’s protection officer or operations officer. Risk management, as discussed in ATP 5-19, involves identifying, assessing, and controlling risk by balancing it with mission benefits. The commander and staff assess two kinds of risk: tactical and accidental. Tactical risks relate to those risks posed by the threat, such as booby-trapped doors, improvised explosive devices, and sniper fire. Accidental risks encompass all other risks, such as the risk posed by the presence of civilians or limited visibility.

DETERMINE THE COMMANDER’S CRITICAL INFORMATION REQUIREMENTS

2-71. The commander’s critical information requirements and other information requirements help focus the staff’s planning efforts. The commander’s critical information requirements are usually time-sensitive, especially when related to site exploitation. The commander’s critical information requirements are specific enough to assist the staff in understanding what personnel and equipment are required for site exploitation.

2-72. Staffs identify priority intelligence requirements to gain additional information about the threat and the operational environment. Lessons learned from recent operations show that intelligence about civil considerations is as critical as intelligence about the threat. For example, priority information requirements related to a building considered for site exploitation answer the questions:

What is the floor plan for the building?

Where are the booby traps or explosive hazards along the route to the building?

Where are the booby traps or explosive hazards in the building?

What is the civilian presence in the building?

What is the attitude of the local populace towards friendly forces?

What environmental hazards are present that can adversely affect the health and well-being of the Soldiers conducting the site exploitation?

2-73. Friendly forces’ information requirements identify information about the mission, troops and support available, and time available for friendly forces that the commander considers as the most important. Friendly forces information requirements related to site exploitation answer the questions:

What is the status of the cordon force?

What is the location of the weapons intelligence team?

What is the response time for the quick reaction force and explosive ordnance disposal?

Where are the local law enforcement facilities?

What are the essential elements of friendly information?

2-74. An essential element of friendly information is a critical aspect of a friendly operation that, if known by the threat, can subsequently compromise, lead to failure, or limit success of the operation. Essential elements of friendly information are always protected from threat detection. Examples of essential elements of friendly information for site exploitation are remote detection, collection, and technical exploitation capabilities.

DEVELOP THE INFORMATION COLLECTION PLAN

2-75. The information collection plan links the collection effort to the commander’s information requirements. Often, time constraints shape the need for information. Within a site, identifying areas of interest helps establish the scope of the collection effort. Considerations may include the scale and complexity of the site, confirmation or exclusion of the presence of weapons of mass destruction, booby traps, hostile forces, or civilians. The information collection plan articulates the last time information is of value to the search element to prioritize the collection effort.

WRITE THE RESTATED MISSION

2-76. At times, site exploitation is the primary task of a unit or element and is a supporting task to the overall unit commander’s mission. When site exploitation is a critical task, it is in the unit’s mission statement either as the primary task or as an on-order mission after the completion of the primary enabling task. As the primary essential task, the mission statement can read as “Not later than 220600Z Nov 14, 1st Brigade conducts site exploitation of the suspected improvised explosive device factory on objective Raiders to facilitate the analysis of the information, materiel, and persons located at the factory.” As a subsequent or on-order essential task, the mission statement can read as “Not later than 190500Z Oct 14, B Troop conducts a raid on objective Tiger to capture the high-value individuals conducting sniper attacks on multinational forces. On order, conduct site exploitation on objective Tiger to collect information for subsequent intelligence analysis and prosecution.”

DEVELOP COURSES OF ACTION

2-77. Whether site exploitation is the primary mission, or planned as a subsequent or secondary task, courses of action development for site exploitation follows the same considerations outlined in ADRP 5-0. When developing courses of action, the commander and staff array their forces and task-organize assets to perform specific site exploitation tasks.

2-78. Enablers are sometimes required to augment the site exploitation element to provide specialized capabilities to the site exploitation team. When establishing the support relationships, commanders consider the supporting distance and prioritization of use for specialized supporting agencies. These specialized agencies include explosive ordnance disposal teams; technical intelligence teams; technical exploitation collection teams; chemical, biological, radiological, and nuclear units; military working dogs; and expeditionary forensic laboratories.

2-79. When time is limited, the staff war-games site exploitation to focus on specific actions and outcomes. The staff war-games site exploitation actions on-site to act against the postulated threat and the known or assumed information, materiel, and persons contained on the site; to assess the time-distance relationships to specialized technical exploitation assets; and to identify subsequent actions, such as site disposition requirements or sequels, driven by information gained from successful site exploitation.

Chapter 3

Tactical Site Exploitation Preparation

This chapter discusses preparation techniques used for tactical site exploitation and describes the benefits of information collection and the integration of enablers when preparing for tactical site exploitation.

PREPARING FOR TACTICAL SITE EXPLOITATION OVERVIEW

3-1. Preparation consists of those activities performed by units and Soldiers to improve their ability to execute an operation (ADP 5-0). Preparation includes, but is not limited to, information collection and coordination, such as reconnaissance and surveillance; plan refinement through rehearsals; and integration of enablers. Tactical site exploitation follows these same preparation requirements regardless of the mission source.

PREPARING FOR TACTICAL SITE EXPLOITATION

3-2. Directed reconnaissance is one way of collecting information that supports tactical site exploitation by answering information requirements, confirming or denying the existence of a threat, and potentially providing intelligence. During the military decisionmaking process, the staff provides the commander with the initial information collection plan and the appropriate reconnaissance tasks. The information requirements, initially determined upon receipt of the mission, drive the collection effort. As the information collection plan is developed and completed, the focus of the collection effort can change according to the commander’s assessment of the situation, which then requires subsequent changes to the information collection plan. Reconnaissance helps commanders to determine the best opportunity to complete tactical site exploitation based on criteria.

3-3. The commander conducts surveillance to systematically observe an area in order to collect information. Surveillance provides information that supports the decision points for initiating exploitation-related actions, such as a cordon and search operation. The staff determines mission-specific surveillance requirements and adds them to the information collection plan.

3-4. The complexity of tactical site exploitation and the volume of linked events and resources requires directed rehearsals to ensure proper coordination. Commanders conduct rehearsals to ensure subordinates understand their role in the tactical site exploitation in relation to other elements. Tactical site exploitation tasks that require rehearsals include—

Establishment of site security.

Establishment of initial protection and control points within the search area.

Coordination with host-nation police or persons in a position of authority.

Documenting search and collection results.

Questioning of women and children based on intelligence and local customs.

Biometric enrollment.

Evidence handling procedures.

Transfer or handover of personnel and materiel.

Search techniques.

3-5. Rehearsals allow synchronization of the site exploitation team and the enablers. Early contact with outside agencies is beneficial to the initial planning of the tactical site exploitation and provides an understanding of enabler capabilities. Tactical site exploitation often involves outside agencies that are unfamiliar with the unit’s standing operating procedures. Rehearsals also clarify and synchronize actions on the objective for external enablers, providing them with a better way of understanding their role in tactical site exploitation.

3-6. When a higher headquarters assigns a mission to a subordinate organization, the staff initiates parallel planning and preparation using the commander’s guidance. Parallel planning takes place at various levels before planning is complete to begin initial preparations as soon as possible. Commanders begin to plan a tactical site exploitation upon receipt of a mission from higher headquarters in anticipation of receiving a new mission or as derived from an ongoing operation.

3-7. All company-sized elements operating outside of a secure area have personnel trained on basic tactical site exploitation in order to execute a hasty tactical site exploitation. Site exploitation teams are selected from a company-sized element and often reside within the company area or at the brigade level. Locating the site exploitation team at the brigade facilitates continued training and integration with organic brigade assets.

3-8. There are two categories of enablers used who can assist the site exploitation team. Externally resourced enablers are assigned to site exploitation teams in a direct support role. Receiving commanders integrate these enablers into their site exploitation teams or use them to support subordinate units to complete a specific function during the tactical site exploitation. Examples of externally resourced enablers are combat cameras, explosive ordnance disposal, and military working dogs. Internally sourced enablers are assigned from a unit's organic manpower to assist the commander and staff to plan, integrate, synchronize, and coordinate tactical site exploitation efforts, which includes the use of externally sourced enablers within the unit. Examples of internally sourced enablers are human intelligence teams, engineers, and female engagement teams.

3-9. Successful implementation of a tactical site exploitation plan requires clear delineation of task authority and responsibility. Tactical site exploitation is a team effort overseen by the team leader, the assistant team leader, the search team, and specialized staff persons. Because all personnel wear personal protection equipment while conducting site exploitation, the site exploitation team leader determines and plans what protective gear is worn when conducting the tactical site exploitation.

Chapter 4

Tactical Site Exploitation Execution

This chapter discusses considerations to make while executing tactical site exploitation. This chapter also describes techniques involved in the execution of tactical site exploitation, including techniques used for off-site technical exploitation.

TACTICAL SITE EXPLOITATION CONSIDERATIONS

4-1. Tactical site exploitation often requires the use of specially trained and equipped enablers to process materiel, information, and personnel and to analyze and disseminate information at the site. These specialized enablers assist the site exploitation team by determining the significance and priority of handling of materiel collected on-site. While this procedure is generally non-invasive, detailed descriptions of all collected items are recorded and processed for further analysis. More invasive procedures are used to ensure the safety of the site exploitation personnel and to implement additional force protection measures. A preliminary analysis using presumptive testing methods occurs if time and resources are available. The results of the preliminary analysis are reported immediately via the operations and intelligence channels. Immediate dissemination provides the commander with an updated site exploitation assessment.

4-2. Tactical site exploitation enabling capabilities are scalable based on the volume and complexity of the materiel and the criticality of the potential information collected on-site. The type of operation, location, and proximity to combat operations, and the availability of resources influences the extent of exploitation activities. Site exploitation teams and their corresponding capabilities are modular, allowing commanders to use elements based on the operational environment, need, availability, and time available.

4-3. Units with a site exploitation mission know the tasks involved to effectively conduct tactical site exploitation. A skilled unit yields an effective and thorough exploitation of the site by conducting an initial non-intrusive examination to extract information of immediate intelligence value. A skilled unit is able to assess and record the tactical context in which items were collected and then prioritize and determine the need for exploitation at a higher level. Units also coordinate proper transportation of materiel collected. Units need to recognize new threat techniques or first-seen items of high value for technical interest.

4-4. Outputs of tactical site exploitation include, but are not limited to feedback, materiel collected, and handling of individuals. Feedback includes information regarding tactical threat tactics, techniques, and procedures to the tactical command using the operations and intelligence network. Materiel collected is exploited through tactical site exploitation and is handled in a forensically sound manner and, if time permits, follows the chain-of-custody protocols according to AR 195-5. Information derived from individuals (for example, pocket contents or biometric enrollment) provides additional information that is otherwise overlooked if not done correctly. The handling of individuals is, at all times, conducted in a humane manner, with respect, and in accordance with international law. The physical condition of individuals is documented in writing and by photographic means as soon as possible.

4-5. Properly documented materiel can provide information, intelligence, and evidence needed to interdict the threat. Target sets and techniques are redefined using the information and intelligence gained through documented materiel from the tactical site exploitation. Material and information documented is also used to link biometric data collected from the individuals who are present, at, or near the location of the site exploitation.

TACTICAL SITE EXPLOITATION TECHNIQUES

4-6. The general sequence of tactical site exploitation tasks overlaps based on the tactical site exploitation team size and proficiency. Predeployment training guidance, if provided, contains information on team size and training requirements. While security forces provide a secure working environment, the site exploitation team is searching, detecting, and collecting information and materiel, to include questioning persons of interest. On-site presumptive analysis drives the collection of additional materiel and the questioning of persons of interest to satisfy information requirements.

4-7. Assessment is continuous throughout tactical site exploitation. In some instances, a leader’s assessment of a site’s status or potential to answer information requirements changes before all actions are completed. When the leader determines a site is no longer exploitable, the commander ceases that operation and transfers control of the site to the appropriate entity.

LOCATE THE SITE

4-8. Soldiers locate or confirm the location of the site exploitation through movement and maneuver. Typically, the site exploitation team receives an accurate location or description of the site. In cases where the available information is vague, the maneuver force locates the targeted site through tactical operations by employing systematic search techniques commensurate with the situation. In some instances, a unit discovers an additional site that appears to support information requirements, while accomplishing another tactical mission. Units obtain initial confirmation of the site’s location using unmanned aerial systems, geospatial intelligence, signals intelligence, human intelligence, or other technical means.

PROTECT THE SITE

4-9. Leaders establish and maintain protection of the site throughout the execution of the tactical site exploitation. The security element designated to protect the site prevents interference with the search element. Elements responsible for protection of the site normally perform seize, secure, cordon, control, contain, isolate, or clear tasks. Units apply the appropriate tactical methods such as inner and outer cordons, or a combination of methods and tasks, to control the site for subsequent exploitation.

4-10. Units often encounter complex sites where it is tactically imprudent to secure or clear an area without expert assistance, such as when a unit encounters a building suspected of containing biological warfare agents or high-value threat personnel. Expert assistance includes explosive ordnance disposal teams, military working dog teams, and chemical, biological, radiological, and nuclear teams.

4-11. The security element isolates and seeks technical advice from subject matter experts before declaring the site free of hazards and safe for the tactical site exploitation team. Once the specialized teams confirm the site is ready for exploitation, the security element employs appropriate internal security procedures, removing identified threat personnel and clearing hazards. Security forces then control access to the site to prevent loss and destruction of any information or materiel, and secure all individuals the search element wants to evaluate on-site.

4-12. The security force becomes the actual authority upon taking control of the site. As such, the security force needs to consider entry and traffic control points and internal population control measures to ensure the security and safety of themselves and the population. Some sites require an extensive period for exploitation. The initial security forces are relieved for subsequent operations by other units that continue site security for an extended period of time.

ACTIONS ON THE OBJECTIVE

4-13. Tasks performed during tactical site exploitation are—

Collect forensic data.

Deoxyribonucleic acid (DNA) collection.

Serology.

Firearms and tool mark collection.

Latent prints.

Questioned documents.

Drug chemistry.

Trace materials.

Forensic pathology.

Forensic anthropology.

Forensic toxicology.

DNA analysis to identify human remains.

Digital and multimedia exploitation (computer and electronic devices, audio forensics, and image and video analysis).

Conduct voluntary questioning using direct questions.

Human intelligence collectors, if available, conduct detailed questioning on-site.

Analysis of the tactics, techniques, and procedures the used by the threat at the exploitation site.

CONDUCT A SEARCH

4-14. Soldiers conduct visual and equipment-aided site searches. When conducting a site search, teams ensure all visible contents of the site are observed by the Soldiers. The commander’s primary reasons for conducting a site search include—

Mitigating risk by using risk management tools.

Using systematic search procedures to ensure that all information, materiel, and persons of value are detected and documented.

Minimizing the time on-site in relation to security considerations.

Minimizing the destruction of property.

Properly using an interpreter.

4-15. Tactical site exploitation teams thoroughly document the site and its contents before conducting invasive searches and collection activities. Complete documentation includes written or oral descriptions, sketches, photographs, or video recordings. This documentation creates a record of the starting point for search actions. A search supports host-nation or international authorities by removing threats to security. Forces engaged in search operations need to take appropriate actions in accordance with international and national laws to maintain legitimacy.

4-16. Leaders question persons of interest on-site to obtain information that can help focus the search effort. Conversely, a search facilitates a line of questioning based on the items identified during the search. When time is short, Soldiers quickly screen individuals to prioritize individuals who need detailed questioning.

4-17. Collecting and analyzing items having forensic value is vital to intelligence and targeting efforts, but is only useful if the value of the materiel is recognized. Exploitation depends on individuals who have a fundamental awareness of the importance of the information available from the items collected on-site. The decision regarding what materiel to collect and exploit is based on the contextual significance of the items. Depending on the tactical situation, leaders prioritize the type of materiel to collect. Items assessed as having little or no value are not collected. Items that pose a threat to the population or are unsafe to recover are destroyed on-site. A description of the significance of each item collected accompanies the item to an exploitation facility.

SEIZURE CRITERIA

4-18. Seizure criteria focuses on the commander’s critical information requirements and other information requirements listed in the collection plan. The intent of a tactical site exploitation is to seize only items that answer information requirements or are associated with the threat. Seizure criteria includes all threat force-related propaganda such as leaflets, books, and pamphlets; a check for pre-set or last station accessed on radios, televisions, and other devices; information providing further insight into the identification and affiliation of suspect personnel such as passports, letters, pictures, and phonebooks; known or suspected weapons used in threat activity against coalition personnel or are excessive in nature beyond the use of personal protection (see theater guidance); and equipment and materiel used in the manufacture of various booby traps, explosive hazards, improvised explosive devices, explosives, and initiation devices.

4-19. Soldiers on-site have a clear understanding of the commander’s critical information requirements and the information collection plan so materiel and persons of interest are detected, collected, processed, and transferred to technical exploitation sites for thorough processing and analysis. Information, materiel, and persons are not seized unless there is reasonable suspicion or probable cause or that the items were used by threat forces. Reasonable suspicion implies that any reasonable person would suspect (feels uncertainty or doubt) that the information, materiel, and persons have been or will be involved in threat activity. Probable cause implies that a reasonable person would believe (consider as true) that the information, materiel, and persons have been or will be involved in threat activity. The determination of probable cause is completely subjective. This decision is a matter of professional judgment, based on the information known at the time and the competence and character of the decision maker. If the materiel has no value to the threat, it is returned once it is analyzed. This task is more difficult when the materiel has a dual-purpose use, such as nitrogen-based fertilizer.

PRIORITIZE INFORMATION, MATERIEL, AND PERSONS

4-20. Units identify, collect, and preserve information and materiel to answer information requirements. Tactical site exploitation teams follow systematic procedures to gather, safeguard, and maintain items for analysis. Persons of interest are segregated and safeguarded until a decision is made about their status. Once the information, materiel, and persons are prioritized and processed, commanders transfer control of the information and materiel to the appropriate technical exploitation facility for in-depth analysis.

4-21. Soldiers conduct tasks for prioritizing information and materiel, and for safeguarding persons on-site. These tasks include—

Collecting and processing potentially valuable information and materiel.

Controlling the populace in a location to provide both safety and privacy from tactical site exploitation activities.

Processing the site and the collected information and materiel.

Managing individuals who are persons of interest or high-value targets in accordance with theater policy.

Transferring control of the site to the appropriate military or host-nation authority upon completion of the tactical site exploitation.

4-22. Search teams document the contents of a site before collecting anything. Documentation is an ongoing task during collection efforts. Documentation includes photographs and video or audio recordings. Soldiers strictly adhere to procedures that ensure accurate documentation, including the use of appropriate multimedia and official forms. Theater guidance directs the use of specific forms and identifies which critical data fields to complete. During a speedy collection, a commander may have to sacrifice accuracy. However, choosing speed over accurate documentation of information, materiel, and persons can result in items that are not properly analyzed or non-admissible during attribution.

4-23. Search teams maintain the integrity of information, materiel, and persons for further analysis. Tactics, techniques, and procedures, unit standing operating procedures, rules of engagement, and host-nation requirements are used as guidance to accurately assess and describe collected information. Preliminary assessments identify materiel or information of potential value requiring a valid chain of custody for evidentiary assessment in a technical exploitation facility. For example, an unknown improvised explosive device design is transferred to a technical exploitation facility for technical categorization.

4-24. The site exploitation team collects computers, compact discs, digital video discs, cell phones, and other electronic equipment or multimedia in accordance with pre-existing information requirements. Specially trained and equipped multimedia exploitation enablers are requested to recover critical data on-site. The rapid extraction of data from multimedia storage devices such as hard drives, secure data memory devices, and external storage devices, contain time-sensitive information. Digital and multimedia items have latent biometric data such as fingerprints or DNA on the surfaces that positively identify users of electronic devices. Electronic devices are high-value items based on their potential forensic value.

4-25. Improper site exploitation activities result in—:

Incomplete information and materiel collection, which causes the threat to remain anonymous.

Incomplete documentation, which leads to information and materiel that has no association with a site or person.

Incomplete or inaccurate chain of custody.

Incomplete searches resulting in overlooked critical information.

Failure to respect the indigenous people, their property, and their culture resulting in alienation of the population and a loss of trust.

Incomplete collection efforts unlikely to produce actionable information and intelligence.

Poorly executed tactical site exploitation that can have negative operational and strategic effects.

Poorly documented records in connection with a suspect individual resulting in the inability to prosecute them under host-nation rule of law.

PERSONNEL SEARCHES AND VOLUNTARY QUESTIONING

4-26. Persons found on-site are consolidated at a safe location, out of public view. This location is either inside or outside of a structure. All persons are searched and segregated to prohibit them from communicating. Males do not search females except as a last resort when no other means are available. Individuals are searched for weapons and potentially exploitable material, to include pocket litter. Pocket litter includes a receipt or simple scrap of paper with a telephone number. All individuals, regardless of age and gender, are capable of carrying improvised explosive devices or other hazardous items. Individuals deemed as possible threats are flex-cuffed or properly secured for their own safety and the safety of others. All persons on-site are enrolled in the biometric database in accordance with theater policy.

4-27. All captured or detained personnel are treated humanely at all times and in accordance with DODD 3115.09 and DODD 2310.1E. No person in the custody or under the control of DOD, regardless of nationality or physical location, shall be subject to cruel, inhuman, or degrading treatment or punishment as defined in U.S. law, including the Detainee Treatment Act of 2005.

4-28. The voluntary questioning of individuals on-site includes collecting any information needed to complete the enrollment form on the tactical biometric collection device. The team leader moves between the search teams and Soldiers to share information and refine the questioning. All persons found on-site are subject to questioning. The questioning stops immediately if the person objects or refuses to respond.

4-29. High-value individuals found on-site are addressed by the human intelligence collection team, allowing the site exploitation team to continue with their tasks. Human intelligence collectors are specially trained in tactical questioning. (For more information on tactical questioning, see FM 2-91.6.)

4-30. The lead Soldier tasked with questioning persons asks simple, direct questions and rehearses before engaging in questioning. The lead Soldier briefs the interpreter on the questions asked and any performance expectations before conducting the questioning. The interpreter translates all words exactly as they are communicated by the lead Soldier conducting the questioning. The Soldier controls the pace and records the individual’s translated comments using a digital recording device, if available. Another acceptable technique is having the lead Soldier conduct the questioning while a second Soldier records the exchange of information.

4-31. All individuals are treated professionally and questioned in a firm but calm manner. Persons found on-site are not subjected to any mistreatment, threats, intimidation or other coercive behaviors. Soldiers ask persons their name, association with other individuals on-site, residence, and reasons for being on-site.

ASSESSMENT

4-32. Assessment measures the progress in executing site exploitation using site exploitation core activities. Assessment starts at the site by determining which materiel, documents, and persons hold forensic and exploitation value. The assessment continues each time an individual handles or examines the materiel. The prioritization or need to distribute the materiel to specific facilities is determined at this time.

4-33. In general, units prioritize information, materiel, and persons for collection based on their information value, time sensitivity, and perishability. Collection priorities include those items that pose an immediate threat to the tactical site exploitation team such as weapons, munitions, and hazardous materials; items that impede the overall search; and items that immediately answer the commander’s critical information requirements.

4-34. The assessment process continuously evaluates the ways in which tactical site exploitation team evacuates information, materiel, and persons. Planning and preparation for tactical site exploitation includes guidance on how the team moves to the objective and how to egress and evacuate collected information, materiel, and persons. A dismounted patrol is sometimes limited to what they are able to carry due to an item’s weight or size. On some occasions, the distance to move an item is too great. Movement constraints often require the tactical site exploitation team to reduce the size of collected items or to extract an item’s key components. For example, when a team opts to remove the hard drive from a desktop computer rather than trying to pack and move the entire machine.

4-35. If a dismounted team discovers they are not able to move an item believed to contain critical information, the team leader calls the higher headquarters for guidance. If the information is verifiable, the team secures the site and remains in place until additional support arrives.

4-36. The time allocated to tactical site exploitation is an important consideration during planning and preparation. The size, complexity, and potential contents of a site directly influence the time required to perform a thorough tactical site exploitation. In a deliberate, intelligence-driven operation, planners allocate required time and resources to carry out the mission. In a hasty site exploitation, mission variables sometimes limit the amount of time on the site, in which case, the team leader adjusts the time to complete tasks based on time available.

PRESERVATION OF SITE AND MATERIEL

4-37. Preservation refers to protecting a site and its contents from damage, loss, or change. In general, the degree of preservation required depends on several considerations. These considerations include the purpose of the operation, sensitivity of the site, and significance of the site. The standard for preserving a site’s contents is highest when those contents facilitate a criminal prosecution. Any materiel related to criminal prosecution is maintained in accordance with AR 195-5. When conducting stability operations, supporting war crimes courts and tribunals is an inherent task in establishing civil control.

4-38. Preservation requirements are defined in theater guidance, the technical exploitation facilities, or host-nation rule of law. Throughout execution, commanders ensure exploitation forces follow procedures precisely to preserve items discovered during tactical site exploitation. The search element takes precautions to preserve potential evidence in its original state until it is transferred to the appropriate entity.

TRANSFER CONTROL OF THE SITE

4-39. Site transfer is a planned and orderly handover to another security force or host-nation authority. The site exploitation leader transfers control of the site after processing materiel and releasing any individuals to the military police for relocation to a detainee collection point. Commanders assess the site’s condition before determining how and when to transfer the site. Before transfer of a site, commanders take into consideration monetary reparations related to damage caused by tactical site exploitation teams, the requirements of ongoing operations such as tempo or immediate threat to tactical site exploitation teams, and threats or hazards posed to civilians or military forces during the tactical site exploitation.

4-40. Although the minimum amount of force is used to accomplish the mission, property damage can still occur. If tactical site exploitation teams have changed, removed, or damaged any private or host-nation property, commanders have to consider the legal implications. Tactical site exploitation forces document damage to ensure property owners have the opportunity to resolve their claims through legal means. Commanders include host-nation and local authorities to gain a collective understanding on what remediation is expected. A damage assessment is provided to the judge advocate general and civil affairs operations center immediately following the mission.

4-41. A site does not always yield intelligence or show evidence of threat activity. In such cases, a commander can transfer the site back to the legal occupant or host-nation personnel. Tactical site exploitation forces make every attempt to return the site in its original state when time and resources permit. In limited circumstances, the commander can abandon the site, depending on immediate operational requirements.

4-42. Explosive ordnance disposal units are required to render the site safe or dispose of any explosive hazards, including improvised explosive devices and home-made explosives. If possible, explosive ordnance disposal Soldiers remove all explosive material from the site and manually destroy the explosives away from the exploitation site.

4-43. A unit that initiates a tactical site exploitation are sometimes required to hand over the tactical site exploitation mission to another organization. In this case, the on-site commander conducts a thorough mission briefing to the Soldiers involved to ensure continuity of the operation. Information, materiel, and any persons of interest are transferred to the gaining unit using protocols to maintain chain of custody.

PRELIMINARY ANALYSIS

4-44. In the context of the tactical site exploitation, screening, processing, and preliminary analysis of information, materiel, and persons refers to the use of non-invasive biometric and forensic tools, such as tactical biometric collection devices. These tools are used to enroll and identify individuals listed on the theater biometrically-enabled watch list.

4-45. Soldiers use presumptive analysis tools to analyze the information, materiel, and persons on-site. The results of the preliminary analysis help the commander decide the appropriate disposition for information, materiel, and personnel selected for detailed technical analysis. Commanders can recommend the transfer of selected items to a technical exploitation facility located outside the theater of operations.

4-46. Tactical site exploitation teams use presumptive analysis of information, materiel, and persons on-site to answer information requirements. Soldiers immediately disseminate and track on-site information that is time sensitive or contributes to planning or decision making.

4-47. Augmentation from specialized assets enhances on-site analysis and development of information and intelligence on-site. A tactical site exploitation team is augmented with technical intelligence teams, trained post-blast analysis explosive ordnance disposal personnel, and human intelligence collection teams authorized to conduct tactical questioning.

TRANSFER OF INFORMATION, MATERIEL, AND PERSONS

4-48. Soldiers transfer information, materiel, and persons having possible intelligence value to initial collection points identified in the theater guidance. They are then transferred to the appropriate technical exploitation facility. Higher headquarters establishes an initial collection point, such as a captured materiel exploitation center, to process and prioritize captured threat items. The initial collection points serve as a distribution point to support the transfer of the information and materiel to operational, strategic, or national technical exploitation facilities. The interim collection point functions as the entry point for any persons of interest. Any persons of interest are transferred to the detainee collection point in accordance with theater guidance.

4-49. Brigades establish standing operating procedures to describe transfer and storage procedures. Documenting the transfer of custody and transferring associated personal effects and collected materiel supports detailed technical analysis leading to the production of information and intelligence.

REPORTING TECHNIQUES

4-50. Conducting materiel turnover and processing based on the objective permits a thorough examination of collected items before transfer to another organization. There are certain techniques used to validate that items were collected and transferred properly. Collection bags are inspected by designated personnel to ensure that correct markings are placed on bags by filling out DD Form 2745 (Enemy Prisoner of War [EPW] Capture Tag). All materiel is placed in a secure collection point in the company headquarters. If available, the company intelligence support teams provide company-level collection and processing of intelligence; provide assessments and predictive analysis to company commanders; recommend disposition and transfer of information, materiel, and persons; reviews and signs chain of custody form, DA Form 4137; and upload and compare biometric enrollments and identifications to the authoritative biometric database immediately upon return from the objective.

4-51. Property that is too large to move or cannot be moved, such as an inoperable vehicle, is photographed. The photographs are attached to DA Form 4137. Explosives and improvised explosive devices are transferred to explosive ordnance disposal personnel for transportation and disposition. Typically, the materiel remains in explosive ordnance disposal team custody for reporting and exploitation purposes. Explosive ordnance disposal personnel disseminate technical and tactical intelligence, including photographs and reports, related to the captured explosives, munitions, and improvised explosive device components to all units. If improvised explosive device components are required for evidence, the explosive ordnance disposal unit ensures that all components are rendered safe before handing them over to the appropriate agency.

TACTICAL SITE EXPLOITATION REPORT

4-52. A patrol reporting format is used to standardize reporting. The patrol report is a historical document used as a planning tool to inform subsequent operations. Data fields on the patrol report includes, at a minimum, a summary of the operation, overhead imagery of the objective if available, photograph and sketch of the objective, photographs of persons of interest on the objective, photographs of personnel left on the objective, photographs of seized items, photographs of persons of interest with seized and contraband items, and anything of possible intelligence value seized on the objective.

TECHNICAL EXPLOITATION TECHNIQUES

4-53. Technical exploitation is the rapid processing of collected materiel and information, including secondary collection, and the analysis and dissemination of information away from the immediate point of capture. Processing associated with technical exploitation is conducted by functional experts with specialized training and equipment. Technical exploitation focuses on analysis and dissemination of collected information and materiel to provide intelligence to the commander and staff.

4-54. Technical exploitation is normally conducted in a laboratory environment with organic technical and forensic capabilities. Conducting rapid confirmatory forensic assessments requires a laboratory facility that is effectively equipped and staffed. Technical exploitation facilities require the capability of conducting rapid technical examination of materiel, documents, and multimedia within the theater of operations.

4-55. The Army’s forensic technical exploitation capability is provided by the Defense Forensics Science Center Forensics Exploitation Directorate. The Defense Forensics Science Center Forensics Exploitation Directorate provides regionally deployed forensics labs and forensic reachback support for technical exploitation. Reachback to other national and strategic technical exploitation resources occur as the need arises.

4-56. The Navy develops the technology and information necessary to support joint service explosive ordnance disposal forces. The Navy also provides rapidly deployable combined explosives exploitation cells and foreign military acquisition platoons for worldwide response.

4-57. The combined explosives exploitation cells and foreign military acquisition platoon are tasked to:

Provide in-theater site exploitation of explosive incidents including tactical characterization of the incident site.

Recognize, preserve, and collect items of intelligence or exploitation value.

Neutralize remaining explosive hazards.

Operate in conjunction with joint and interagency partners.

Conduct technical exploitation and analysis.

Enable the forensics exploitation and analysis of explosive hazards, explosive ordnance, and related components.

Produce detailed informational and intelligence reports used for rapid development of countermeasure tactics, techniques, and procedures, counterbomber targeting packages, and prosecution support packages.

Provides in-theater identification, acquisition, and exploitation of foreign explosives and explosive ordnance.

Packages items for shipment to U.S. locations for further exploitation and rapid development of explosive ordnance procedures.

4-58. Materiel received at a technical exploitation facility is assessed upon arrival to verify its safety, determine priority, and to establish the exploitation protocol (required procedures and order). Materiel is photographed and assessed to document its original composition. This assessment allows a prioritization of resources needed to effectively and thoroughly process the materiel. Assessment also determines the need to use national or strategic capabilities when information and materiel requires multiple types of exploitation, such as document interpretation and analysis, and forensic analysis.

4-59. Ideally, the technical exploitation facility includes or is co-located with an intelligence and targeting analytic capability whenever possible to facilitate dynamic targeting and time-sensitive, follow-on operations. If an organic or attached analytic capability is unavailable, external analytic assets are pre-arranged and coordinated through the intelligence staff.

4-60. Disposition and further handling of materiel is consistent with theater and national policies synchronized within the operational command by the intelligence staff. Depending on the significance of the materiel; the effectiveness, completeness, and resource availability at the technical exploitation facility; and the availability of national and strategic exploitation capabilities, the technical exploitation facility manager determines the need for disposing, archiving, temporary or indefinitely storing, or forwarding materiel for further exploitation and analysis. Some types of materiel requires automatic forwarding to national and strategic technical exploitation facilities based on subject, construction techniques, or other criteria.

4-61. Technical exploitation facilities provide timely feedback to site exploitation collection units and the collection capabilities that contributed to the findings. Specifically, technical exploitation facilities provide feedback on the quality of materiel received for exploitation and the techniques that assist tactical site exploitation teams in the preservation of materiel.

INFORMATION OBTAINED FROM TECHNICAL EXPLOITATION

4-62. Technical exploitation personnel conduct detailed technical assessments of device capabilities to determine any new developments. Additionally, technical exploitation personnel examine and compare similarities in the design and construction of devices and materiel to support analysis of threat trends and materiel sourcing efforts. Technical exploitation results are combined with other information to support the development and dissemination of—

Theater threat frequencies table.

Biometric or forensically-enabled intelligence reports and other information and intelligence for the theater or tactical commander.

The Biometric-Enabled Watchlist.

Be-on-the-lookout reports.

Targeting support packages.

Prosecution support packages for judicial proceedings.

Threat awareness reports.

New threat technologies or methods reports.

4-63. If the collected items represent new threat techniques and capabilities or otherwise warrant additional exploitation to answer informational gaps, a more detailed examination and analysis is performed within the technical exploitation facility or forwarded to a national and strategic level facility. The forwarded case materiel is prioritized based on force protection and the need for timeliness and answering the information requirements. Following final technical exploitation analysis, disposition and further handling instructions accompany each item.

ENVIRONMENTAL CONSIDERATIONS FOR SITE EXPLOITATION

4-64. Environmental considerations have several implications for site exploitation. These considerations affect all levels of war. Commanders and staffs consider how missions affect the environment. Environmental damage is an inescapable consequence of combat operations. However, military technology has made it possible to minimize the collateral damage from legitimate military operations. It is imperative that organizations develop additional environmental procedures to support site exploitation. Forces practice routine environmental protection measures during or after operations. Environmental protection measures include conducting remediation operations after the discovery of toxic industrial chemicals and integrating force health protection considerations in densely populated areas impacted by tactical site exploitation. Other environmental protection measures include responding to environmental terrorism or sabotage while working within limitations brought about by environmental considerations. Forces also attempt to remedy adverse environmental impacts as a part of the exit strategy and give support for chemical, biological, radiological, and nuclear requirements.

4-65. Site exploitation teams conducting tactical site exploitation at locations with chemical, biological, radiological, and nuclear material need proper technical assets to conduct assessments. These assessments determine the types of materiel present at the site and the types of capabilities needed for rendering the materiel safe and disposing of contaminated materiel found on-site.

4-66. Tactical site exploitation locations having chemical, biological, radiological, and nuclear material that may or may not be weapons of mass destruction can qualify as a sensitive site. Commanders ensure forces at these locations have the technical knowledge and tactical skills to conduct detection and decontamination of persons and equipment, including the transfer of the materials to a secure location. If security support is not immediately available, the initial forces conducting tactical site exploitation are required to protect the site from threat attempts and recapturing or removing valuable items or individuals.

4-67. The collection of environmental samples such as soil, water, and air is conducted by chemical, biological, radiological, and nuclear personnel; damage control personnel; medical personnel to include public health officers, bio-environmental engineering officers, and preventive medicine detachment personnel; and other specially trained personnel.

DISSEMINATION OF INFORMATION AND INTELLIGENCE

4-68. Dissemination involves distributing relevant information from one person or place to another in a usable form. In the context of tactical site exploitation, Soldiers perform actions to disseminate information and intelligence. These actions include establishing connectivity with intelligence organizations and sharing data, information, and intelligence through appropriate channels.

4-69. Various organizations, such as forensic facilities, document and multimedia exploitation teams, and technical intelligence elements convert collected information into useable information that is shared and analyzed to develop intelligence.

ESTABLISHING CONNECTIVITY

4-70. Effective dissemination requires connectivity with supporting intelligence organizations. Brigades establish access to databases and information portals that facilitate self-service of information requirements by commanders and staffs. The staffs follow up with supporting agencies to capitalize on the information processed from tactical operations.

4-71. A national forensics database provides a bridge that allows systems with different purposes to work together. The Harmony database is the national intelligence database for foreign document and multimedia exploitation and translations management. It is the single, comprehensive bibliographic reference for all available primary source for foreign technical and military documents and their translations. Harmony database support is available to all units that have access to the secret internet protocol router network and joint worldwide intelligence communications networks. Through a common database, multiple applications can simultaneously use the same data for different purposes at different echelons.

SHARING OF INTELLIGENCE DATA THROUGH APPROPRIATE CHANNELS

4-72. Commanders do not assume that dissemination of analyzed information is automatic. Brigades and subordinate organizations submit requests for information or coordinate with liaison personnel to obtain information from or to share information with various intelligence resources and higher headquarters.

4-73. Most intelligence is distributed at multiple security levels using the Distributed Common Ground System–Army, the Army’s mission command intelligence network. Initial intelligence reports flow through the maneuver intelligence staff officer or assistant chief of staff, intelligence, or other reporting channels. Other intelligence channels include a joint captured materiel exploitation center, interagency networks, and intelligence networks in the continental United States.

4-74. Common databases provide powerful tools for transforming data into the information and knowledge required for decisions. Information in a database is stored, organized, and queried to support further analysis based on models reflecting commanders’ decision-making needs. For example, software applications compare data collected from a series of improvised explosive device detonations to determine similarities between events to identify commonalities to support link and pattern analysis.

Chapter 5

Site Exploitation Assessment

This chapter discusses site exploitation assessment techniques and the assessment criteria used to measure the effectiveness of site exploitation.

ASSESSMENT TECHNIQUES

5-1. Meeting the commander’s objectives requires more than task accomplishment; it requires a methodology for assessing progress toward an objective. The results of site exploitation is continuously assessed to optimize the site exploitation team’s effectiveness and to satisfy the commander’s critical information requirements. Site exploitation does not have a finite beginning and end. A successful site exploitation is one that results in the identification of key nodes targeted for further exploitation, such as high-value targets, finances, and sources of materiel.

5-2. In conventional warfare, success is quantifiable and is stated in the commander’s intent. Battle damage assessment, as part of the targeting process, is the only function necessary for determining if an end state is achieved. In irregular warfare, it is difficult to recognize and measure success. Threat networks thrive because of conditions that support their existence and their operations. For example, some threats are supported and concealed by a local populace. However, efficient use of site exploitation can deny a threat anonymity and the ability to blend into society.

5-3. Site exploitation is not complete once information, materiel, and persons is collected. Technical exploitation personnel continue to analyze the information and materiel using scientific and forensically sound procedures to produce additional information and intelligence. This information and intelligence developed through technical exploitation is provided as feedback to those units that contributed to the site exploitation. Feedback gives commanders the ability to better assess their information requirements, allowing them to adjust their collection plans accordingly. Link and pattern analysis uses this feedback to discern connections among activities that can result in site exploitation.

ASSESSMENT CRITERIA

5-4. Measures of performance are criteria used to assess friendly actions tied to measuring task accomplishment. They are a primary element of battle tracking and are associated with objectives rather than end state conditions. An example of a measure of performance is the capture of a high-value target on the Biometric-Enabled Watchlist.

5-5. Measures of effectiveness use empirical criteria to assess changes in system behavior, capability, or an operational environment tied to measuring an end state, achievement of an objective, or creation of an effect. Measures of effectiveness assess end state conditions. Examples of measures of effectiveness is a decrease in insurgent improvised explosive device activity or increase in the disruption of bomb-making activities resulting from tactical site exploitation.

MEASURES OF EFFECTIVENESS

5-6. The intent in developing measures of effectiveness is to identify indicators confirming that Army site exploitation is producing desired effects. Measures of effectiveness indicators are the observable, measurable system behaviors or capabilities that provide the data required to conduct measures of effectiveness trend analysis. These indicators are tied to nodes that focus intelligence, surveillance, and reconnaissance planning. When developed, measures of effectiveness indicators provide the appropriate guidelines for developing intelligence collection activity and form the basis for an effects assessment collection plan.

5-7. Indicators of success help commanders and staffs determine if they are taking the proper actions to attack threat networks. For example, a reduction in the number of threat attacks is a straightforward indicator of success. However, a greater willingness of local elders to work with the government is an example of a subjective assessment that requires professional military judgment. On one hand, it indicates the success of infrastructure projects that benefit a community, but it can also demonstrate that the threat is exerting less control and fear over the population.

5-8. Other indicators of success in disrupting a threat network is a reduction in a certain type of improvised explosive device or use of a certain tactic by the threat. These indicators show that the commander’s actions have an effect on the threat network. When threat networks adjust their tactics in response to match the Army’s tactics, it is considered an indication that the Army’s tactics had an effect on the threat. The primary challenge is to remain a step ahead of the threat.

Appendix A

Tactical Site Exploitation Standing Operating Procedure

This appendix provides an example of a tactical site exploitation standing operating procedure. It is not prescriptive in nature but is guidance that can be modified as necessary to fit the needs of Soldiers conducting tactical site exploitation.

TACTICAL SITE EXPLOITATION STANDING OPERATING PROCEDURE OVERVIEW

A-1. Tactical site exploitation is the methodical process of searching, documenting, gathering, and transporting items of intelligence or evidentiary value from a targeted location for use in operations, questioning, identifying persons of interest, or the judicial process. Tactical site exploitation is executed in support of, or in parallel with direct action, cordon and search, vehicle checkpoint and interdiction operations, raids, high-value individual or high-value target capture, and other missions and operations.

A-2. This standing operating procedure serves as a guide for Soldiers conducting tactical site exploitation. Soldiers are expected to understand and familiarize themselves with procedures and contents of the standing operating procedure to remain current with all new and revised procedures. This standing operating procedure does not contain distinct instructions for every situation encountered in the field; however, it does provide guidance on the most common practices of tactical site exploitation.

TACTICAL SITE EXPLOITATION TEAM COMPOSITION AND RESPONSIBILITIES

Note. Refer to United States Army Forces Command or geographic combatant commander predeployment guidance for team composition, individual responsibilities, and training requirements.

A-3. The team leader has overall control of the tactical site exploitation team and site. The team leader—

Designates the materiel consolidation point.

Establishes the start point for exploitation, and initiates and monitors tactical site exploitation.

Enforces standing operating procedures.

Determines priority of search.

Designates locations for questioning, subject holding area, and biometric collections area.

Conducts initial walk-through of the site.

Establishes the consolidation point.

Receives, screens, and inspects materiel for proper markings.

Numbers rooms in a clockwise manner, starting with the first floor.

Informs the on-scene commander of tactical site exploitation results.

Assists in tactical site exploitation once the sketch of the target is complete.

Ensures a final sweep is conducted on-site to prevent loss of any items of potential value.

Moves tactical site exploitation materiel to the predetermined consolidation point.

A-4. The assistant team leader typically has the same skills as the team leader. The assistant team leader—

Assists the team leader.

Conducts an inventory of the site exploitation kit and coordinates for the replacement of any items expended.

Conducts rehearsals.

Conducts mission pre-execution checks.

Ensures biometric devices contain the latest Biometrically-Enabled Watchlist and regional watch lists.

Conducts the initial walk-through.

Establishes the collection point.

Briefs the team leader.

Assists the searchers and recorders.

Supervises the biometrics collection team.

Conducts a quality check on all materials gathered.

Prepares all collected materiel for transfer.

Attends the after action review with the battalion or brigade intelligence staff officer and site exploitation team.

Ensures post-mission up-load of collected biometric enrollments.

Completes DA Form 4137.

Refits the site exploitation kit as needed.

Performs quality control checks on the chain of custody documents.

Ensures the chain of custody is maintained until the materiel is transferred to another custodian.

A-5. The security element operates in coordination with the questioning team to maintain positive control of persons of interest. The security element—

Establishes control of individuals on the objective.

Establishes and documents where persons of interest were located on the objective.

Ensures all individuals are properly searched, photographed, and processed for biometric enrollment.

Accounts and issues receipts for all personal property.

A-6. The search team is responsible for collecting and documenting information, materials, and persons of interest discovered at the site. The search team—

Conducts a systematic detailed search.

Immediately alerts the team leader of any booby traps.

Meticulously catalogs information and materials.

Wears gloves while searching.

Searches the interior and exterior of the site.

Bags and properly marks gathered materiel.

Consolidates and organizes collected materiel at the collection point.

Marks room entrances after the search.

Turns in collected materiel to the team leader.

A-7. The photographer is responsible for taking archival quality photographs of the tactical site exploitation. The photographer—

Ensures photographs are taken before materiel is moved.

Takes panoramic pictures of the building and rooms searched.

Keeps a log of photographs and locations of items photographed.

Takes photographs of individuals with the collected items associated to them.

Performs the sketcher’s duties when a sketcher is not assigned.

Downloads photographs immediately upon return from the tactical site exploitation.

Disseminates photographs using the operations and intelligence networks.

A-8. The sketcher is responsible for drafting sketches of the tactical site exploitation. The sketcher—

Ensures sketches are completed before materiel is moved.

Draws detailed sketches of the buildings and rooms searched.

Identifies the locations of materiel as found.

Digitizes sketches upon return from the tactical site exploitation.

Disseminates sketches using the operations and intelligence networks.

A-9. The questioning team conducts all questioning, allowing the team leader to focus on the overall mission of the tactical site exploitation. The questioning team consists of a questioning team leader, questioning assistant, recorder, and interpreter. The questioning team is responsible for—

Conducting questioning of all persons of interest.

Documenting and reporting the results of questioning in accordance with the rules of engagement, theater policy, and unit standing operating procedures.

PLAN AND PREPARE TECHNIQUES

A-10. The identification of items of intelligence value is accomplished early in the planning process. A list of items of intelligence value is posted at the briefing location in a prominent location so that the list is observed by the Soldiers conducting the tactical site exploitation. Items of intelligence value include—

Videos or photographs of the target layout before the start of the search.

Components such as the objective name, military grid reference system location, latitude, longitude, district, city, and landmarks.

Pre-site exploitation intelligence.

Layout of the target site.

A-11. The pre-search brief includes—

An information collection plan with information requirements.

The resources necessary to achieve the objectives.

The objectives of the search.

The personnel involved in the operation on the objective.

A-12. The briefing covers—

Known intelligence of the site.

Purpose of the exploitation.

Type of exploitation, either hasty or deliberate.

Targets for potential prosecution.

Items expected to be found.

Known or expected hazards.

Location of the consolidation point for collected information and materiel.

Assignment of personnel to individual teams.

Routes and alternate routes, radio frequencies, and emergency procedures.

TACTICAL SITE EXPLOITATION EXECUTION

A-13. Actions on the objective include—

Responding to the tactical site exploitation objective and establishing an inner and outer cordon.

Entries made with the assistance of host-nation personnel, if available.

Persons searched, safeguarded, and assessed for security reasons, until their status is determined.

A hasty search conducted by the security team for any threats to the site exploitation team.

Initiation of the exploitation process by the tactical site exploitation team.

Assessment and prioritization of search areas by the team leader.

Photographs of the location and numbering the rooms before the search.

A search conducted by team members according to the tactical site exploitation plan.

Photographing materiel in place as found, noting locations of materiel on the sketch.

The transfer of collected materiel to a consolidation point for inventory.

Notifying the team leader once a search of an area is completed to monitor the progress of the search.

Communication from the team leader on any findings with the questioning team so a relevant line of questioning is maintained.

Photographing the subjects associated with the materiel once the search of the area is completed.

Collecting and packaging materiel separately.

Completing a DA Form 4137 for all items collected.

Documenting and positively identifying persons found on-site.

Comparing collected biometric data with information stored on the biometric device and the Biometrically-Enabled Watchlist.

Handling persons of interest in accordance with regulations, policies, and standing operating procedures.

POST-TACTICAL SITE EXPLOITATION ACTIVITIES

A-14. An inventory containing detailed descriptions of the information, materiel, chain of custody, and all transfer documents is completed at the conclusion of the tactical site exploitation. This knowledge gained from the inventory facilitates subsequent analysis and follow-on requests for information. The team—

Holds a tactical debrief and after action review.

Takes pictures of actions on the site.

Conducts a narrative debrief of actions on the site.

Compiles a list of names of all persons found at the site.

Creates a diagram or sketch of all structures with the location of items found.

Inventories and replaces all tactical site exploitation kit items expended.

Uploads biometric data collected at the site into the biometric database.

PHOTOGRAPHY TECHNIQUES

A-15. Photographs document the existence of information, material, or people discovered at the site. Pictures document the existence of an item and provide additional context about the location, condition, orientation, and the appearance of the item when it was found. An item’s properties can change between the time the item was collected, the time it was analyzed, and the time it is used to support criminal prosecution. These changes are sometimes the result of mishandling, but, in most cases, are the effects of time and the environment. Because of these potential changes, a photographic record of each item is made at the time of discovery and collection.

A-16. The contents of a site are photographed before any items are moved. Photographs support subsequent forensic analysis and the potential use of collected items as evidence in host-nation judicial proceedings. The value of an object as evidence is not only based on what it is, but is also based on where it was found and the way it was positioned. Removing evidence before it is photographed reduces its forensic value.

A-17. The first set of photographs establishes the view of the site. These photographs consist of a 360-degree exposure taken at the center of the area or room. The exposure consists of several photographs made of the area or room’s perimeter. The photographer turns slightly, standing in place, while taking a photograph after each slight turn until the entire area or room is photographed.

A-18. Additional photographs are taken from each corner of the area or room. This process works well for a room with four corners without hidden areas or obstructions, or for outdoor sites where most of the subject matter is towards the center of the site. When an area is photographed, it is imperative that the photographer does not include coalition forces in the pictures. Photographs containing coalition forces are unusable in host-nation court proceedings.

A-19. All items found at the site are photographed with and without a measuring device to provide scale. These photographs are taken on-site exactly as the item was found. If time is limited, materiel is photographed without a measuring device at the site, but is later photographed with a measuring device at a more secure area, before transfer occurs. Items of interest that are not moveable are photographed with and without a measuring device.

A-20. Photographs are taken directly overhead at a 90-degree angle to provide accurate dimensions of an item. The photographer can take additional photographs from different angles to provide better context. The objective of the photographer is to substantiate the existence of the item at the site in the photograph.

A-21. At a site containing persons of interest and related items, the persons of interest are photographed with the items in such a way where both are identifiable. These photographs are of importance when both the items and photographs are used as evidence in host-nation court judicial proceedings. Coalition personnel are not included in these photographs in any way, to include boots or shadows. Crowds, passersby, and curious onlookers are not photographed so that they are not associated with various sites. The presence of an onlooker at multiple sites is a potential indicator of complicity in the activity in question.

A-22. Non-coalition fatalities are documented in photographs for identification purposes. Preferably, the person’s head, face, and neck are photographed. If the person is a high-value or important suspect, additional guidance and support may be required. Once photographs are taken, the subject is biometrically enrolled to support positive identification of the remains.

A-23. The last photographs are taken at the end of the tactical site exploitation. These photographs establish the final state of the site. The photographs may establish any damage that occurred during the exploitation for establishing any reparations. Photographs taken after the search should not include other Soldiers.

A-24. In summary, photographs capture all aspects of the tactical site exploitation. There are additional guidelines to follow when photographing for tactical site exploitation:

The site is photographed before tactical site exploitation to document the condition of the site as found.

A common procedure, that is also a best practice, is photographing the site in all four cardinal directions, north, south, east, and west.

Individuals associated with the site are photographed on-site.

Information, materiel, and potential evidence is photographed in place as it was discovered.

Persons of interest are photographed with any identification documents next to their face.

Group photos are taken of persons of interest on-site, including family members.

Information and materiel having undetermined or unknown value is photographed anyway.

The camera is held steady to obtain clear photographs.

Using a flash can wash out the item or subject in the photograph.

Photographs are logged in a field notebook and numbered according to the photograph number count on the camera. The same number is used on the sketch.

SKETCH TECHNIQUES

A-25. Sketches are made to correspond with photographs of a site and graphically document the site’s layout. Sketches include—

Buildings, areas, and vehicles.

Locations of where information, materiel, and persons were found at the site.

Locations of events.

Rooms, doorways, entryways, stairs, hidden compartments or caches, and storage areas.

Room numbers used during the site exploitation, numbered clockwise.

A legend identifying sketch features such as landmarks, cities, villages, roads, and structures. The legend also defines abbreviations, and letter or number designations used in the sketch.

An arrow indicating north.

Geospatial location of the site (military grid reference system or global positioning system coordinates).

Date and time the site exploitation occurred.

The sketch artist’s name and unit.

Distances and measurements documented in meters.

A-26. Sketches are sometimes redrawn using specialized computer programs. These computer programs are used to merge sketches with photographs to add clarity. (See figure A-1.)

SEARCH TECHNIQUES

Note. An explosive ordnance disposal element clears any explosives in or around the site before the search team starts search activities.

A-27. Guidelines for searches include—

Preplan the objective and the search itself.

Plan the search and review the search plan.

Ensure security of the objective.

Coordinate with host-nation security forces and police.

Avoid unnecessary destruction of the household.

Avoid contamination or destruction of forensic or captured materiel.

A-28. The four main objectives of the search team include—

Methodical and systematic search.

Meticulous cataloging of all materiel.

Proper collection and packaging of materiel.

Organized and documented materiel collected at the consolidation point.

A-29. There are several search patterns. The search pattern conducted depends on the site location. A spiral search begins in the geographic center of an area and is worked in a spiral pattern toward the outside of the perimeter. A spiral search is appropriate for large, outdoor scenes with few obstacles. A line or strip search covers large areas in a short amount of time. This pattern has searchers moving forward across a line to cover the target area. A zone or quadrant search is used when searching well-defined, geospatially-limited areas. This pattern is often used for searching buildings room by room or vehicles, where the area is divided into small, well-defined zones. A grid search is commonly used in a contained outdoor area. The area is divided into grid squares and sketched before the search. Searchers begin in the center of the square and search each grid thoroughly before moving to the next grid. A grid search has searchers walk back and forth along a line, following the cardinal directions up and down the location, then turning and walking an intersecting path back and forth over a specified area. A grid search provides ample coverage and a higher probability of discovering materiel but is more time consuming. (See figure A-2.)

A-30. When planning a search, the search team clears out a point in the middle of the lowest floor of a structure. The tactical site exploitation assistant team leader establishes a consolidation point at this location. The tactical site exploitation team leader then numbers and names each room beginning with the closest room on the left, and continues to label and number each room in a clockwise direction. Room numbers often begin with the first main room closest to the entryway. (See figure A-3 on page A-8.)

A-31. Each person on the search team puts on latex gloves before entering the search area. When searching a room, the search team starts in the middle of the room, working in a clockwise direction searching from ceiling to floor. After each room is cleared, the team leader is notified as to who will mark the room. The team then clears the next room in the same manner as the first.

A-32. Offices, bedrooms, and storage areas often contain more items of value than any other room in a structure. The recorder or photographer records the location of items as they are found before they are moved to the collection point. During a hasty search, objects are photographed in place and then rapidly collected. Additional resources are available to allow the search to proceed at a quick pace. A safe location is established to separate and package items using the photographs taken of each item in place as a reference.

CACHE SITE SEARCH TECHNIQUES

WARNING

A known cache site is not entered until it is neutralized of all explosive hazards. The site is always assumed to be booby trapped. Explosive ordnance personnel are the only ones who can render explosive devices and ordnance as safe.

A-33. A cache is a storage area that contains documents, discs, tapes, weapons, explosives, or ammunition. There are three basic cache sites:

Long-term cache sites are usually located away from the improvised explosive device sites and are only known by a few people.

Transit or bomb-making factory sites are 1.24 to 1.86 miles (2 to 3 kilometers) from the site of the planned attack.

Short-term sites are located within minutes from the contact point.

A-34. Characteristics of a cache include—

Available.

Accessible.

Concealed.

Non-attributable.

Locatable by day or night.

A-35. Actions of a cache search include—

Prioritize.

Mark points.

Work in pairs.

Record, photograph, and sketch.

Use available equipment.

A-36. There are seven phases of a cache search:

Establish a collection point.

Select reference points from collection point.

Walk the boundary.

Search reference points.

Search the boundary.

Search open areas.

As items are discovered, items are recorded, collected, packaged, and inventoried appropriately.

SITE SECURITY

A-37. Soldiers conducting a site exploitation initially focus on assessing and prioritizing immediate or potential dangers and take actions to ensure that persons at the site, including Soldiers and civilians, are safe. Soldiers request additional resources, when required, and establish and maintain control of the situation. They also identify, secure, and segregate friendly, threat, and unknown persons found on-site, as well as witnesses to an event or incident. The site exploitation team takes actions to ensure the site is protected by taking control measures such as restricting foot or vehicle travel through the area, and emplacing ropes, tapes, signs, and guards to limit access to the site.

WARNING

Areas containing, or suspected to contain, chemical, biological, radiological, and nuclear materials or explosives are first secured and left for technical experts to process (chemical, biological, radiological, and nuclear, explosive ordnance disposal elements). Hazardous materials include unexploded ordnance or stockpiles of ammunition and explosives. Post-blast sites also require specialized training and expertise to safely and effectively process. In contingency environments, command guidance, policy, and procedures are followed when determining the appropriate actions for these types of sites.

A-38. All personnel who are not essential to processing a site, such as unit leadership, remain outside the established cordon area so they do not contaminate or destroy information and materiel. The team leader briefs leadership outside the site. Operations involving chemical, biological, radiological, and nuclear material and explosives, regardless of the environment, require specially trained hazardous material, chemical, biological, radiological, and nuclear engineers or explosive ordnance disposal personnel to control the inner cordon until the area is rendered safe.

A-39. At large or complex sites, a deliberate, systematic search of the site to detect, collect, and document identified information, materiel, and persons is conducted as a deliberate mission, with leadership and unit capabilities appropriate for the size and scope of the mission. During execution of site exploitation, the leadership remains cognizant of responses to, and observations of the event. Leaders observe the physical characteristics of the site and the actions and behaviors of individuals that appear odd or out of place. The behavior and the general demeanor of any persons found at the site are observed. These observations help in building contextual understanding for the site exploitation team and the analysts.

KEY ON-SITE ACTIVITIES

A-40. Site processing requires specific on-site activities. While each site exploitation is different, key activities commonly exist for most sites. These activities require a senior person responsible for overseeing the operation, security, and site assessment; specified holding or screening areas; a documented chronology of events from arrival to departure from the site; a prioritized site search; complete site documentation; and preparation of the required reports. During contingency operations, the senior on-site; team, squad, or platoon leader; company commander; or designated site exploitation team leader oversees on-site activities. When providing support to host-nation law enforcement, activities are overseen by the senior host-nation law enforcement personnel, who are assisted and advised by U.S. personnel.

A-41. The leader designates an individual to search the site for items of military interest. This individual also keeps notes of where the items are found, packages and labels materiel, and initiates a chain-of-custody document. A recorder documents the chronology of events and all persons entering or leaving the site. A photographer takes photographs of the site’s exterior and interior, and the information and materiel discovered at the site. All materiel is photographed before it is disturbed. A sketcher is present at the site to sketch all major elements, such as furniture, trees, shrubs, water bodies, or any other major features in and around the site. All critical materiel is included in the sketch, depicting its exact location and orientation when it was found. Photographs complement the site sketch. The recorder keeps notes that are referred to for accurate recollection of details.

SITE PROCESSING

A-42. The site exploitation team generally follows similar guidelines for processing each site. Relevant guidelines are applied in sequence. These guidelines include—

Observation. An initial walk-through is performed as well as a search for items of value. However, items are not disturbed.

Recording. The site is documented using photographs, sketches, and notes.

Preservation. Proper containers and chain-of-custody documents are used to preserve items.

Processing and collection. Latent prints and trace materials are processed and collected, properly packaged, tagged, and stored.

Transport. Collected materiel and paperwork are moved to the appropriate lab or analytical element as soon as practical.

INITIAL WALK-THROUGH

A-43. The leader is responsible for conducting the initial walk-through. The walk-through is conducted by a Soldier trained and experienced in site exploitation. The initial walk-through is typically conducted before the start of any deliberate search and collection effort. A deliberate search and collection of information, materiel, and persons is done upon completion of the initial walk-through. The site exploitation personnel establish an entry control point, number rooms when searching a building, search the site, collect information and materiel, ensure that administrative documentation and packaging is to standard and prepare collected materiel for transfer. If the site is large or complex and additional personnel are available, the site exploitation activities are broken down further. For instance, the recorder’s responsibility is distributed to photographers, sketchers, and note takers. A small team searches and collects information and materiel, rather than one person. Only one person is designated to complete forms to maintain consistency. When conducting a walk-through, the safety of on-site personnel is of primary importance. Special attention is placed on identifying potential hazards. Next, the individual conducting the walk-through focuses on identifying information and materiel of interest and prioritizing collection efforts. Additional considerations during the initial walk-through include—

Establishing the location for a collection point.

Determining whether the initial cordon requires expansion to protect materiel or provide hazard mitigation.

Identifying equipment or special skills outside the capabilities of the team that are required to process the site.

Determining the best search method for the site.

Identifying fragile materiel during the initial walk-through or protecting fragile materiel from environmental conditions or inadvertent destruction by team members.

Determining the items that are safe to collect and those that require on-site processing before collection such as latent prints or trace materiel.

Determining the need for markers (for example, large numbers on tent-shaped markers placed adjacent to detected materiel).

Determining the need for digital still or video photography for briefing the team and documenting the condition of the site as found.

Annotating initial observations for use when briefing the team.

COLLECTION POINT

A-44. A collection point ensures that materiel is properly collected, packaged, documented, and consolidated before transfer. The collection point is positioned near the site entrance, in an accessible and visible location, and out of the way of site-processing activities. If the collection point is established inside a building being searched, the building is completely searched and cleared before establishing the collection point. The collection point is established before materiel arrives from other areas.

A-45. The collection point serves as an area to screen, organize, and mark materiel. This materiel is marked by attaching a self-adhesive DA Form 4002. Each item or container is marked at the earliest opportunity. The DA Form 4002 is attached directly to the item or container, or to a blank tag attached to the item. Each item is individually marked for future identification. If available, the white tag space on the plastic bag can replace the adhesive label.

A-46. Once materiel is tagged, chain-of-custody documentation is initiated. This documentation includes a list of collected items and designates when, where, and who collected the items. Additional information includes description of the items; serial numbers of weapons, computers, and cell phones; and any other identifying characteristics. Presumptive descriptions are avoided. For example, a watch is not described as a gold watch if the composition of the watch is unknown; instead, the watch is describe as gold in color.

A-47. DA Form 4137 is typed or printed in ink. A quality control is conducted to ensure that collected items are properly packaged, marked, and documented. Containers are marked with the initials of the collector, along with the time, date, and location of collection. The information and materiel is then prepared for transfer. The original DA Form 4137 and three copies are completed and updated when the materiel changes custody. A completed DA Form 4002 accompanies the DA Form 4137. DD Form 2922 (Forensic Laboratory Examination Request) initiates the laboratory request, if required.

FINAL WALK-THROUGH ACTIVITIES

A-48. After processing a site, a final walk-through occurs to ensure that all pertinent information and materiel are collected. Team members conduct a review to confirm reports and documentation are complete. Disposable supplies, used personal protective equipment, and other trash are properly disposed.

A-49. As appropriate, the senior military commander determines if additional briefings and notifications are required. The site disposition is also determined at this time. Certain crime scenes remain under law enforcement control until they are released either by law enforcement at the conclusion of the investigation or by the appropriate legal authority following judicial proceedings. In contingency environments, the decision to retain site control or to return it to the control of the owners is made by the commander responsible for the area of operations.

HASTY VERSUS DELIBERATE SITE EXPLOITATION

A-50. Collection of materiel is conducted in conjunction with hasty or deliberate site exploitations. Hasty site exploitation is typically conducted in time-constrained environments, especially when the threat is high. Hasty site exploitation is conducted on an objective or at a site that provides military forces an immediate and timely opportunity to exploit threat information. Hasty site exploitation is conducted by a functional unit such as an infantry platoon or engineer squad, or as part of a combined arms team. Hasty site exploitation is included as a contingency operation in most operations plans and orders.

A-51. Hasty site exploitation is warranted in many instances. A hasty site exploitation is conducted as an immediate response to a serious event or attack, as with the explosion of an improvised explosive device or sniper attack. Hasty site exploitation occurs when there is a discovery of a weapons cache or discovery of a threat command and control node or headquarters. A hasty tactical site exploitation can follow a raid or an assault to collect information, personnel, or materiel. A tip from an informant regarding threat activity, personnel, or material can result in a hasty site exploitation. Hasty site exploitation is also conducted when evidence of the existence of a previously unknown site is discovered.

A-52. Deliberate site exploitation occurs when there is sufficient time available and the conditions are conducive to secure the site. Deliberate site exploitation is suitable when deliberate planning and rehearsals occur and when conditions allow dedicated site exploitation assets to the site. Deliberate site exploitation typically involves a combined arms operation that employs functional enablers from numerous sources.

A-53. When information or material relevant to a commander’s critical information requirements is identified, a hasty site exploitation can evolve into a deliberate site exploitation. Deliberate site exploitation teams consist of technical and functional experts who enhance the team’s ability to conduct site exploitation. The technical capabilities required for deliberate site exploitation are based on the type of site and the material at the site. The ability to include specialized assets as part of the site exploitation team expedites the collection effort and the subsequent analysis of information and materiel collected for exploitation.

FORENSIC MATERIEL

A-54. Soldiers conducting site exploitation primarily work with physical materiel. Information and items linked to threat operations or personnel are considered forensic materiel and collected on-site. Analysis of forensic materiel establishes facts that prove or disprove links to persons or events. Examples of forensic materiel are fingerprints, deoxyribonucleic acid (DNA), blood, tool markings, electronics, electronic media, explosive materiel, explosive residue, weapons, manuals, documents, illicit drugs, currency, or footprints.

A-55. The technical exploitation of forensic materiel creates information and intelligence. The analyzed information and intelligence obtained from forensic materiel supports the host-nation judicial processes. When possible, forensic materiel supporting host-nation prosecution is designated as unclassified. Forensic analysis leads to continued targeting actions. Results of forensic analysis helps in yielding supporting information used for detaining unknown individuals and as evidence at U.S. or host-nation prosecutions. Forensic analysis is an integral activity that answers information requirements. Facts, information, and intelligence resulting from forensic analysis provides critical information that supports the military decisionmaking process and enables subsequent tactical site exploitations.

A-56. Appropriate handling techniques prevent damage or contamination to forensic materiel during the collection process. Latex gloves are worn during handling of forensic materiel. A DA Form 4137 accompanies each piece of forensic materiel collected. Soldiers collecting the forensic materiel process the materiel to keep the number of people handling forensic materiel at a minimum. Soldiers that handle forensic materiel are identified in the chain of custody section on DA Form 4137. This information differentiates Soldiers from threat personnel who have also handled the items.

A-57. Common mistakes in the collection, documentation, and chain of custody procedures of forensic materiel include—

Lack of usable photographs or diagrams.

Diagrams that do not match photographs.

Statements with insufficient detail.

Contamination of the site resulting from using improper procedures.

No grid or location of site documented in sketches or photographs.

Improper packaging of materiel.

COLLECTION ACTIVITIES

A-58. Collection is the process of recovering materiel from a site. During site exploitation, contextual information and materiel is recorded, documented, and inventoried within environmental and threat constraints. When directed, an unbroken and documented chain of custody is maintained for any materiel collected.

A-59. Each site is unique. Leaders evaluate each site individually and conduct collection efforts based on the characteristics of the site, threat, or hazards; policies and directives; and other considerations specific to the site. The site exploitation team leader coordinates directly with the on-site commander to determine and request any additional support requirements.

A-60. Collection of materials and information and forensic analysis, as overall capabilities, are divided into on-site and off-site collection activities. On-site collection activities include the recognition, preservation, and collection of threat-associated information, materiel, and identification and possible detention of individuals found on-site. Depending on the mission and the environment, these activities are augmented by enablers such as explosive ordnance disposal, military working dogs, military police investigators, biometrics collection assets, technical intelligence personnel, human intelligence Soldiers, emergency response teams, and other operational assets.

A-61. On-site collection activities recognize information, materials, and persons having value to the military. Task-organized battalion site exploitation teams, emergency response teams, and Soldiers are trained to identify materials and data having the potential for answering information requirements. Soldier actions also include preservation, the practice of protecting collected materiel and information. Preservation associated with site exploitation includes securing and protecting sites where latent or other trace materiel is often present but not readily identifiable. Collected items are protected and preserved by using available, reasonable measures, such as marking, packaging, and tracking to prevent contamination, loss, or alteration of items. These measures include establishing cordons and entry control measures, and providing long-term physical protection to the site.

A-62. Off-site activities involve technical exploitation of collected materiel to include the processing, storing, and analysis of collected items, and the production and dissemination of site exploitation reports. Collection of items designated for transfer off-site require proper packaging and transport to an adequate storage area or location where a more complete analysis is performed. Information resulting from off-site activities is used to support follow-on activities. Depending on the mission and the environment, follow-on activities are conducted by Soldiers, law enforcement investigators, forensic analysts, host-nation police, and military intelligence analysts.

A-63. Storage of collected materiel and associated information is maintained until it is adjudicated or no longer needed, or when associated host-nation judicial proceedings or tactical operations no longer require the items. Storage mediums used are adequate for the preservation of perishable materiel and prevent degradation to the maximum extent possible. Policies and procedures relevant to missions or activities dictate proper disposition of materiel.

A-64. Analysis of materiel involves technical examinations at laboratories and includes analysis by certified forensic analysts or other trained personnel. Initial analysis and presumptive testing begins on-site and involves recognition of materials, documentation, assessment of contextual information, and the use of deployable site exploitation kits and test kits. More complex analysis occurs off-site. After laboratory analysis is completed, the results are documented and cataloged, and the appropriate reports are produced. These reports and other resulting products are shared according to policies and procedures relevant to the unit, mission, and the operational area.

A-65. Dissemination of site exploitation reports enables receiving units to integrate the resulting facts, information, and intelligence into running estimates, which support the targeting, intelligence, and operations processes, as well as enhance the commander and staff’s understanding of the situation.

CONTAMINATION

A-66. In any site exploitation, the validity of information obtained from materiel and subsequent analysis is compromised if the materiel is not protected from contamination and if the chain of custody is not maintained. Materiel is properly collected, handled, and stored to maintain its integrity for subsequent use, such as when the materiel and results of the analysis are used as evidence to support host-nation rule of law. Materiel collected and processed during military operations is often required as evidence to prosecute war criminals, terrorists, or other threat elements conducting hostile activities against U.S. forces and multinational and host-nation partners.

A-67. Contamination of materiel occurs from human contact through fingerprints, hairs, or saliva, or from cross contamination between other materiel. Soldiers avoid contamination by taking proper precautions. Personal protective equipment, especially gloves, reduce the risk of individuals causing contamination to collected material. A new pair of gloves is worn before handling each item. Material is handled on corners, edges, or rough surfaces to avoid disturbing fingerprints. Extreme care taken when using instruments, such as tweezers, to prevent possible destruction or alteration of the physical characteristics of the item. Tweezers are used to handle and collect sharp glass, metal objects, and metal fragments for safety and to prevent disturbing fingerprints left on the items. Tweezers are also used to collect glass or fibers. Instruments are sterilized before they are used to collect items.

A-68. Items packaged separately maintain the integrity of materiel and protect items from physical breakage, contamination, and bacterial growth. Items are wrapped in paper or other material to cushion sharp edges or other protrusions. Wrapped items are placed in paper bags and packaged in appropriate containers, such as clean bags, boxes, envelopes, or cans. Improvised packaging is only used if it is free of contaminants. For example, using ammunition cans for storing guns or spent shell casings can transfer residue to the weapon. Using suitcases for clothing can cross contaminate DNA from hairs, fingernails, skin cells, or other contaminants. Writing directly on collected items can also result in contamination. Collectors do not talk, cough, or sneeze around unsealed items to avoid cross contamination.

COLLECTION TECHNIQUES

A-69. The collection of materiel on-site is prioritized and conducted according to the characteristics of the site, type of event, threat or hazards associated with the site, and environmental considerations. Some materiel is not easily identified or is not easily collected. Not all materiel is obvious or visible to the collector. For some types of materiel, additional measures aid in identifying, collecting, and preserving items for further evaluation and aid in forensic analysis or host-nation legal proceedings. Certain material is not visible until it is further processed, such as latent prints and bloodstains. Trace material is only visible using specific techniques and equipment. Some materials are not visible because they are hidden by other objects. Materiel that dictates the need for further processing or the use of special techniques includes—

Latent prints (fingerprints, palm prints, and footprints).

Trace material (minute fragments of physical material such as hairs, fibers, glass, metal, or paint often transferred from one medium to another by physical contact).

Impressions (footwear, tire tracks, and tool marks).

Biological materials (blood, skin cells, hair, saliva, and plant material).

Electronics and electronic media.

Weapons and firearms.

Chemicals.

Tobacco products and matches.

Soils and minerals.

Tools.

Building materials.

Paint.

Drugs and narcotics.

Wires, ropes, and cords.

Tape.

Paper, documents, and drawings.

Latent Prints

A-70. Latent prints are found on nearly any surface. Any object touched by an individual has the potential of bearing latent prints. Latent prints are found on porous or nonporous surfaces. Porous surfaces include cardboard, paper, and unfinished wood. Latent prints are difficult to extract from porous materials. When collecting latent prints, the entire piece of material containing the print is packaged and transported to a technical exploitation laboratory for print development by chemical or other means.

A-71. Latent prints are easier to obtain from nonporous material, such as glass, metals, finished wood, or plastics. Nonporous surfaces also include textured surfaces, such as vinyl, appliances, computers, or vehicle interiors. Prints are detectable on some objects, such as handheld mirrors or drinking glasses, which are collected and analyzed off-site. For items with nonporous surfaces that are too large to move or collect, print powder and tape is used to lift the latent print.

A-72. There are several methods used to locate latent prints. Closely examining the surface of an item can reveal prints visible to the naked eye. Scanning a surface with a flashlight held oblique, or almost parallel, is also an effective method for locating prints. Trained Soldiers can use cyanoacrylate fumes to lift prints off nonporous materials. The fumes react with the oils from a person’s fingers left behind on an object. Items believed to have fingerprints that are not easy to detect are collected for analysis off-site.

A-73. Once a print is located, its location and condition are recorded. This information is included in any sketches of the scene. The latent print is photographed at midrange and close-range and at close-range with a scale identifier, such as a ruler. The photograph of the fingerprint at close range is taken so that the fingerprint fills the frame. The use of an oblique light is sometimes necessary to clearly photograph a fingerprint.

Trace Material

A-74. Trace material is minute quantities of material found on other items or persons. Trace material consists of hairs, fibers, powder, or other residues. These small quantities of material are difficult to locate and extract. At times, large objects are collected and taken to a laboratory where trace material is extracted. When trace material is located at a site, the location of the material is documented and photographed before it is collected.

A-75. First, the area suspected of containing trace material is examined to determine what is visible to the naked eye. Oblique lighting enhances the likelihood of finding trace material. Darkening the room while using oblique lighting is another technique to enhance the visibility of trace material. Clean paper placed beneath materiel during the packing process collects fallen trace material.

A-76. Gloves are always worn when trace material is collected. Rubber-tipped or plastic tweezers are used to collect hair and fibers. Low-tack tape serves to collect other residues. The sticky portion of adhesive notepads is a field-expedient method. Clean paper made into a druggist fold holds trace materiel. A druggist fold consists of folding over one third of one end of a piece of paper, then folding over one third of the other end of the paper. This process is repeated with the other two sides of the paper, creating nine squares when the paper is unfolded. The material is placed into the center square and the paper refolded on the creases. The two outside edges of the paper tuck into an envelope to contain the material. Once the material is folded into the paper, it is sealed and marked appropriately. Biological material, such as hair and fibers, are not packaged in plastic bags because plastic does not allow the moisture contained within these materials to dissipate, which results in an increase of mold growth.

Impressions

A-77. Impressions are left behind as two-dimensional or three-dimensional impressions. Two-dimensional impressions are found on flat, hard surfaces, while three-dimensional impressions are left in material that is soft and gives way under pressure. Impressions result from footwear, tire tracks, or tool marks.

A-78. After locating an impression, and before processing, the location and the condition of the item is documented. Sketches include a description of the location of items. Photographs of the impression include midrange, close-range, and close-range with a scale. Two-dimensional impressions are lifted using powder and fingerprint tape. If the impression is larger than the width of the tape, the tape is layered with a one-fourth inch or more overlap to fit over the impression. The lifted impression is placed on a clean sheet of paper and then packaged for transport.

A-79. For three-dimensional impressions, the entire item containing the impression is collected, if possible. For example, a tool mark on a doorframe is collected by removing the damaged section of the doorframe. When an item containing a three-dimensional impression is not obtainable, a casting or photograph of the impression is made. The photographs are taken from various angles to capture all the characteristics of the impression. Flash photography obtains adequate detail in darkness or when shadows are present.

Biological Materials

A-80. All biological materials discovered at a site are treated as biohazards and handled with caution. Latex, nitrile, or other nonporous polymer gloves are worn when packaging biological material. New gloves are worn after handling each item to avoid cross contamination. Personal protective equipment such as eye protection, surgical masks, and full-body protective covering are recommended in addition to gloves. All items are documented before they are collected. Documentation includes photographing the items in their original location. If sketches are made, the locations of the biological materials are included.

A-81. Items such as clothing that contain blood, urine, or other biological material are allowed to dry and then packaged separately in clean paper or cardboard packing material. Body fluids are collected with a swab, then allowed to air dry, and packaged in a paper envelope. The swab is kept refrigerated, but not kept below the point of freezing.

A-82. Clean, sterile swabs or swatches collect blood or other fluid samples. Dried blood or other suspect stains are moistened slightly with clean water and rubbed with a swab or swatch used to gather the sample. Samples need to air dry before they are stored in containers. Containers are made of dry, breathable materials such as paper or cardboard. Dry samples are placed inside a paper bag or clean paper, and then wrapped in another layer of clean paper before they are packaged.

Electronics and Electronic Media

A-83. Digital video discs and compact discs are photographed in place and included in any sketches. Digital video discs and compact discs are handled on the edges to avoid disturbing fingerprints or trace material. They are then packaged in paper compact disk envelops before they are placed in a cardboard box. Tape is not used to label digital video discs or compact discs because the adhesive can damage the data on the discs. Digital video discs and compact discs are stored vertical so only the edges touch the sides of the box.

A-84. Computers, laptops, digital cameras, and other electronic devices are photographed in place and added to any sketches. Personal digital assistant devices and cell phones remain charged if possible. Electronics are unplugged from an electrical outlet but not powered off. Batteries are removed if a laptop does not power down. Software and other peripheral items are also collected.

A-85. Electronics are packaged in anti-static or Faraday collection bags to prevent corrupting or damaging them. Electronic components are transferred to an appropriate facility for follow-on analysis by trained personnel. Only trained personnel analyze computers, smart phones, tablets, computers, or personal data assistance devices on-site. These devices can contain viruses or malicious software that irreversibly corrupt or destroy the data on the device.

A-86. Electronic devices are packaged in butcher paper. Tape is in contact only with the butcher paper and is not directly placed on the computer tower or laptop. Digital electronic items can have tracking capability used by criminal or threat elements. Therefore, electronic devices are placed in cardboard boxes and transported for analysis by trained personnel as quickly as possible to expedite exploitation, mitigate corruption of data, and to reduce tracking threats.

A-87. Trained personnel use a cellular exploitation kit to extract data from cell phones. Once data is extracted, the phone is packaged and stored appropriately. Compact or digital video discs, thumb drives, external hard drives, and digital camera secure digital cards are packaged and transferred to an appropriate facility for subsequent analysis by trained personnel.

Weapons and Firearms

A-88. Firearms are photographed in place to document the position of their safeties, selector lever, and hammer, when possible. This information is also indicated on sketches. Weapons are rendered safe by removing all ammunition. The ammunition is saved for use in comparison analysis and to obtain finger prints. Ammunition from loaded magazines is not removed. Firearms are handled only on rough surfaces to prevent damage to other latent prints or trace material. The manufacturer, model, serial numbers, or other markings are documented. Firearms are packaged in a cardboard box or wrapped in paper. Ammunition is packaged in the same manner as firearms, but the ammunition is wrapped separately from the weapon. Weapons are properly cleared before packaging. Weapons that are not cleared are conspicuously marked, both on the weapon and the external packaging.

A-89. Gunshot residue is often left on the shooter and the target after a weapon is discharged. Gunshot residue remains on the shooter’s body (especially hands and face) for up to six hours. To preserve gunshot residue, paper bags are taped over the shooters hands until they are swabbed. A chemical testing agent is used to detect gunshot residue.

Chemicals

A-90. Chemical, biological, radiological, and nuclear hazards are not collected unless necessary. Trained chemical, biological, radiological, and nuclear or hazardous materials personnel can provide safety guidance. Hazardous materials are photographed in place and added to sketches. Chemicals are never mixed together. Less than 0.067 to 0.101 ounces (2 to 3 milliliters) of chemical sample is placed into a sealed glass container, preferably with a polytetrafluoroethylene-lined cap. When collection is required, only trained personnel are used to properly collect and package chemicals.

Tobacco Products and Matches

A-91. Tobacco products are examined for DNA, saliva, latent prints, lip-gloss, or lipstick. Matches are also examined for fingerprints and other trace material recoverable in a laboratory. Items are placed in a clean envelope or a druggist fold, sealed, and then placed in a metal container. A clean glass jar or metal container is suitable for field expediency.

Soils and Minerals

A-92. At least one-half cup per sample is collected when obtaining soil and minerals obtained from an outside area. Carpet and other flooring, shovels and other tools, and a vehicle interior, to include the accelerator, clutch, trunk, and vehicle carpet are all examined for soil samples. The samples are placed in a small vial, jar, or clean metal can. A clean glass jar or metal container is suitable for field expediency.

Tools

A-93. Tools are photographed in place and added to sketches. Tools are placed in cardboard boxes so that the working surface of the tool is protected. Tool marks are also photographed and added to sketches. Items containing the tool marks are collected, if possible. However, if the tool mark is part of a larger item, such as a door, window frame, or fence, the portion of the item with the tool mark is removed. The items are cushioned with paper towels or cotton and placed in a cardboard box. A clean cardboard box is suitable for field expediency.

Building Materials

A-94. Samples of materials containing the residue of building materials such as insulation, wood, shingles, or ceiling tiles, are collected. As much of the damaged area or residue is collected as possible. Trace material is packaged by putting it in a padded hard container or a druggist fold. Larger samples are wrapped in clean paper and placed in a clean cardboard box. Clean toilet paper or paper towels are suitable for use as field expedient packaging materials.

Paint

A-95. Wet paint is not collected until it is dry. Paint samples are scraped or cut from the surface. Paint chips equal to the size of a nickel are collected from the top layer of the original surface of the painted object. Paint samples include a full layer of paint, to include the top layer through the surface. Small chips are scraped into a druggist fold and then placed in a larger envelope. If paint chips are not obtainable from an item, the entire substrate is seized. Paint chips are labeled with the sample color and the layers of liquid within the sample.

Drugs and Narcotics

A-96. Drugs and narcotics are photographed and sketched in place. Clandestine drug laboratories are not processed because they can contain extremely dangerous chemicals and booby traps. Any site that contains large amounts of drugs or narcotics often have additional items related to that activity, including currency, weapons, business logs, written records, and computers containing associated digital records. Pills are counted and placed in plastic or glass jars or pillboxes. Pill types are packaged separately. Biological substances, such as plant material, are not packaged into plastic bags. Biological substances contain moisture, which can cause mold to grow if not packaged in breathable containers.

Wires, Ropes, and Cords

A-97. Wires, ropes, and cords are photographed in place when possible and added to sketches. Smooth materials, such as plastic, are searched for possible latent prints. Woven materials, or those items with rough surfaces, are examined for trace materials. Wires, ropes, and cords are never touched with bare hands. There is always the possibility of biological material left on ropes, cords, or wires. Knots remain tied. A section of the wire, rope, or cord is cut away as far as possible from the knot. Small pieces are collected by placing them in a druggist fold, which is then double wrapped in a larger envelope. Large sections of wire, rope, or cord are packaged by rolling them into paper and then placing them in an appropriately sized paper bag. For field expediency, any clean paper bag or cardboard box is suitable.

Tape

A-98. Tape is photographed in place when possible and added to sketches. Balls of tape are placed on glass or hard plastic surfaces. Unraveled tape is placed sticky side down on glass or hard plastic to prevent smudging and smearing of the smooth side of the tape. Tape is placed in a clean cardboard box to preserve the non-adhesive side.

Paper, Documents, and Drawings

A-99. Paper, documents, and drawings are photographed in place and included on sketches. Documents are examined for information containing activity plans, personal contacts, handwriting samples, and other exploitable information. Documents can also contain fingerprints, and are handled along the edges to reduce the chance of disturbing latent prints or trace material. Paper pads are seized for any potential information contained. Documents and paper items are packaged in paper envelopes or plastic bags and then placed in a cardboard box. Burnt paper is easily damaged if not collected properly. A piece of paper is first placed under the burnt paper. The burnt paper is then placed in a box cushioned by padding. For field expediency, any available dry, clean bag or box is used.

DA FORM 4137

A-100. From the point of collection, a DA Form 4137 is completed for all forensic materiel seized during a site exploitation. A completed DA Form 4002 accompanies the DA Form 4137. When required, chain of custody lists all personnel handling seized forensic materiel. The 10-digit grid coordinates the items were collected from are recorded on DA Form 4137. This information is required in order to return the item to the owner, if necessary. The collected materiel is normally transported from the collecting unit’s forward operating base. When required, the collected materiel is placed in a temporary storage area while the proper documentation and arrangements for transportation are completed.

A-101. Included with the collected materiel is a storyboard, prepared by the collecting unit that indicates all pertinent information about the collected materiel. The storyboard is copied to a compact disc and accompanies the materiel. The compact disc is placed in its own envelope in a separate bag from any of the materiel. Photos of the collected materiel are included with the storyboard. The unit responsible for collecting the materiel coordinates with the battalion operations officer to transport the materiel to the appropriate custodian. The battalion operations officer is notified immediately when an information requirement or a requirement in the collection plan is answered. Once transported to the brigade, any materiel that requires a chain of custody is released to the designated custodian. Both the transporting Soldier and the custodian sign the DA Form 4137.

CUSTODIAN PROCEDURES

A-102. The custodian confirms that the items listed on DA Form 4137 are accounted for before signing receipt for the items. A completed DA Form 4002 accompanies the DA Form 4137. Once the custodian has signed the DA Form 4137, the transporting Soldiers are relieved of their responsibility. The custodian transports designated materiel to the appropriate facility, forensic laboratory, or host-nation judicial representative as soon as possible. At the receiving facility, the DA Form 4137 is again signed showing that materiel was accepted. A copy of the signed DA Form 4137 is maintained by the receiving individual and the submitting unit.

VOLUNTARY QUESTIONING TECHNIQUES

A-103. Field-expedient initial questioning is conducted to gain information of immediate tactical value; it is initiated at or near the point of capture. (See FM 2-91.6 for more information on tactical questioning.)

A-104. Questioning is preplanned. The purpose of the questioning is defined before it is conducted. Where to conduct the questioning and when to conduct the questioning is also established. All resources are made ready and available for the questioning. Resources include an interpreter, recorder, statement forms, evidence and photos, host-nation personnel, special operations forces, and law enforcement personnel to assist with the questioning. A Soldier is selected who is physically and mentally fit to conduct the questioning. Interviews of personnel remaining on-site use only direct questions and are focused on information having value to site exploitation from the start to its conclusion.

A-105. All primary persons connected with the questioning meet before the questioning takes place. Relevant questions are discussed, interpreters briefed, and known information, evidence, and photos are reviewed beforehand. Feedback is also obtained from the tactical site exploitation team. Pre-questioning notes are a useful reference during the questioning.

RECORDER ROLE

A-106. A digital recorder is used to record the questioning. Recorders used in a primary note-taking capacity can take more comprehensive notes if they are allowed to review the topics of the questioning beforehand. Before the questioning concludes, the recorder’s notes are reviewed to improve clarity and understanding. The recorder assists with clerical duties and completing statements, tracking evidence, photos, and tapes, and compiling case files.

INTERPRETER ROLE

A-107. Only skilled and vetted interpreters question subjects. The site exploitation team leader or human intelligence collectors can develop a stronger trust in an interpreter who consistently works with the team. Using an experienced interpreter is especially important when discussing the sensitive nature of tactical site exploitation.

A-108. Interpreters are briefed away from the subject to discern any spoken languages or dialects. The interpreter’s region of origin and ethnic group are taken into consideration to determine any possible biases against the subject. An objective view is taken when evaluating the veracity of the interpreter’s translations. A second interpreter is beneficial to maintain balance in the translation. The interpreter translates both verbal and nonverbal language, including tone of voice, words spoken with emphasis, and any profanities. Interpreters are monitored to ensure they are not questioning the subject independent of the person asking the questions. At the conclusion of the questioning, interpreters are asked to give their opinion of the subject, whether or not the subject is telling the truth, providing incomplete information, or if a cultural block is interfering with the communication process.

CONDUCT THE QUESTIONING

A-109. A location is established on or near the site to conduct the questioning. If appropriate, seating is arranged for all attendees. The amount of attendees in the questioning room is kept to a minimum. Before questioning begins, the digital recorder is checked to ensure it is ready and working. All evidence, photos, and forms associated with the questioning are made available.

A-110. Adequate security is in place before questioning begins, especially if the person of interest is in a hazardous area. The recorder tracks the date, start time, finish time, and names of attendees, and answers who, what, when, where, why, and how. Also noted, is whether the person of interest came voluntarily or involuntary. Voluntary cooperation is viewed more favorably by most courts. Questioning begins with a courteous greeting and introductions of all persons present in the room to establish a less intimidating environment. During the course of the questioning, who, what, when, where, why, and how are answered.

A-111. The questioning is possibly the only questioning of this individual by coalition personnel. There is no required time length for questioning. Practical guidelines suggest approximately 30 minutes for questioning. This is used as a guideline; questioning can require additional time depending on the flow of information.

A-112. At the conclusion of the questioning, subjects are asked to add to the questioning and are given the opportunity to provide their side of the story as a statement. The recorder offers the form to the subject for completion. The interpreter translates the statement directly on the statement form.

A-113. Intelligence and information collected on prosecutable targets are shared with U.S. coalition, and host-nation law enforcement officials. Materiel and information of value to coalition and multinational partners undergoes a foreign disclosure review before its release in oral, visual, or documentary form. After concluding the questioning, all activity and information is reported through the chain of command to the operations and intelligence section.

Appendix B

Tactical Site Exploitation Kits

This appendix lists recommended contents for tactical site exploitation baseline and enabler kits. Both of these kits are adaptable to mission needs.

BASELINE KIT

B-1. The baseline kit is a modular-based tactical site exploitation kit used by Soldiers to collect materiel from a site. This kit is readily adaptable to the number and skillset of the Soldiers tasked with collection activities. A baseline kit is sufficiently stocked to properly detect, collect, assess, process, and conduct simple analysis of materiel on-site. Information obtained from on-site analysis that also meets the commander’s critical information requirements is disseminated as soon as possible to tactical units. Tactical site exploitation organizations are notified of the incoming materiel collected on-site. Contents of the baseline kit are improvised with other items when not available. Contents of the kit are modified or enhanced to meet mission requirements. (See table B-1 on pages B-1 and B-2.)

Table B-1. Baseline kit contents

Item | Item Count
Medium black backpacks | 9 each
Tweezers | 9 each
Black markers, 3 fine point, 3 wide point | 6 each
Dry-erase marker, 6 assorted colors | 1 each
Large zippered duffle bag | 1 each
Dry-erase board | 1 each
0.5-inch (1.27-centimeter) flex cuffs, 10 per pack | 2 each
Toe tag, 50 per pack | 1 each
2-inch (5.08-centimeter) finger print ink pad with lines | 1 each
Finger print cards, 50 per pack | 1 each
Explosive detection kit | 5 each
AA batteries, 12 per pack | 3 each
2- by 4-inch (5.08- by 10.16-centimeter) labels | 10 pack
Plastic evidence bags | 50 each
Brown paper bags for packaging items, 50 per pack | 2 each
Sketch pad, 8.5 by 11 inches (21.59 by 27.94 centimeters), 80 sheets | 1 each
Telescopic mirror 2.25-inch (5.715-centimeter) diameter, 10 count | 10 each
Digital camera with 4 secure digital cards, at least 2 gigabyte in size | 1 each
Submersible flashlight | 1 each
Digital voice recorders | 2 each
Hand-held geospatial positioning system | 2 each
Fiber optic scope | 1 each
Bolt cutter | 1 each
Hand-held metal detector | 6 each
Digital distance | 1 each
Utility pry bar | 1 each
Claw hammer | 1 each
Field journals | 2 each
Eye blindfolds, 20 per pack | 1 each
Latex gloves, 2 boxes medium sized, 2 boxes large sized | 4 boxes
Vinyl gloves, 2 boxes medium sized, 2 boxes large sized | 4 boxes
Set of numeric markers | 1 each
2-inch (5.08-centimeter) duct tape | 3 each
Empty metal paint cans with lids | 6 each
12-inch (30.48-centimeter) ruler with English and metric markings | 3 each
25-foot (63.5-centimeter) cloth tape measure with English and metric markings | 3 each

ENABLER KIT

B-2. During the planning process, the staff determines whether or not the tasked unit needs enablers to accomplish its mission. Depending upon the target, the enabler is equipped with the appropriate enabler kit. (See table B-2.)

Table B-2. Enabler kit contents

Item | Item Count
Heavy duty digital camouflage duffel bag | 1 each
2-centimeter adhesive rulers, 150 per roll | 1 each
2 ounces (56.6 grams) of black fluorescent powder | 1 each
1 ounce (28.3 grams) of black fluorescent magnetic powder | 1 each
Tactical fiberglass fingerprint brush | 2 each
Tactical camel hair fingerprint brush | 1 each
2-inch (2.54 centimeters) clear fingerprint lifting tape | 2 each
Latent printed backing cards, approved size, 3 by 5 inches (7.6 by 12.7 centimeters), 50 per pack | 2 each
White 6-inch (15.24-centimeter) photographic scales, pack of 10 | 1 each
White 2-inch (2.54-centimeter) adhesive photographic scales, 50 per pack | 1 each
Arrest and institution fingerprint cards, 100 per pack | 1 each
Palm print cards, 100 per pack | 1 each
Postmortem fingerprinting strips, 100 per pack, 50 each left and right hands | 2 each
Folding postmortem fingerprinting strip holder metal spoon | 1 each
Materiel field collection bags, 100 per pack, 9- by 12-inch (22.86- by 30.48-centimeter) evidence | 1 each
Materiel field collection bags, 100 per pack, 12- by 16-inch (30.48- by 40.64-centimeter) evidence | 1 each
Compact ceramic ink pad, extras | 4 each
Extra-large black nitrile gloves, 100 per pack | 1 each
Metal detector includes battery and car mount kit | 1 each
Tactical forensic light source, 3 lights and 3 goggles, 455 nanometers, 505 nanometers, and white | 1 each
Fingerprint lift material tabs, 2 by 2 inches (5.08 by 5.08 centimeters), 24 per pack | 4 each
Fingerprint lift material tabs, 2 by 4 inches (5.08 by 10.16 centimeters), 12 per pack | 8 each
Fingerprint lift material, 2.375 by 1.5 inches (6.03 by 3.81 centimeters), white, 24 per pack | 1 each
Fingerprint lift material, 3.5 by 2.375 inches (8.89 by 6.03 centimeters), white, 12 per pack | 1 each
Fingerprint lift material, 2 by 2 inches (5.08 by 5.08 centimeters), black, 24 per pack | 1 each
Fingerprint lift material, 2 by 4 inches (5.08 by 10.16 centimeters), black, 12 per pack | 1 each
Fingerprint list tape pad, 2 by 6 inches (5.08 by 15.24 centimeters), 25 clear strips | 1 each
Digital camera, 40 megapixel, weather proof | 1 each
Black retractable permanent pens, 3 fine point, 3 brush point | 6 each
0.5 milliliter sterile water ampules, 50 per pack | 1 each
Sterile swab, 100 per pack | 1 each
Mini-evidence envelope, self-seal, 100 per pack | 1 each

Appendix C

Evidence Collection in Support of Host-Nation Rule of Law

This appendix provides practical means and methods to properly identify, collect, preserve, and analyze information and materials used as evidence that is recognized and accepted by the host-nation criminal justice system. The information in this appendix benefits host-nation security forces, host-nation police, U.S. forces, and individuals who conduct detention operations, and their judicial partners. This appendix focuses on host-nation advanced evidence collection guidelines and transfer of evidence, and engages host-nation forces and police to take the lead in criminal investigations and facilitate intelligence sharing between host-nation and U.S. forces to neutralize threats to security and stability throughout the host-nation theater of operations. Using this appendix, U.S. forces and partnered host-nation units can provide usable evidence, including statements, sketches, photographs, and physical evidence to the host-nation authorities for cases.

IMPORTANCE OF EVIDENCE COLLECTION

C-1. Evidence collection in support of host-nation rule of law complements existing site exploitation and intelligence activities that support the targeting process. To the greatest extent possible, however, the creation of unclassified products and declassification of classified products significantly enhances the transferability of evidence to the host-nation courts. While each nation may have independent national authorities that adhere to the detention process, the techniques discussed in this appendix can assist all U.S. forces in understanding the importance of collecting evidence for each suspect to support evidence-based criminal detentions. (For more information on the processing and analysis of collected evidence, see ATP 3-39.12.)

C-2. Although theater-wide units are trained on the theater-wide approach to evidence collection, units also coordinate with police, prosecutors, and judges to ensure they comply with local requirements. Joint training for both host-nation and U.S. forces is beneficial for gaining additional experience. While local prosecutors and judges often require their own formats or types of evidence, the information in this appendix is still valuable to units operating within the constraints of the host-nation legal system.

C-3. A host nation is a sovereign entity having its own criminal justice system. The Army strives to improve adherence to a host-nation’s rule of law and lends support to the criminal justice system. Capturing units are requested to provide evidence and witness statements for use in a host-nation court of law that enable the host-nation prosecutor’s office or a local criminal court to prosecute and convict criminal suspects. Appropriate evidence collection can result in admissible evidence that results in effective prosecutions.

C-4. To the greatest extent possible, host-nation forces perform evidence collection and case preparation. Although U.S. forces exploit evidence for potential intelligence value, units ultimately turn over all evidence associated with a suspect to host-nation authorities. Units develop a plan to transfer copies of case files and all evidence and statements associated with suspects to the appropriate host-nation authorities.

C-5. The host-nation legal system does not always specify standards of proof similar to those found in common law western legal regimes. Instead, units coordinate with relevant local, provincial, or national prosecutors and judges to determine the type and amount of evidence deemed credible. Some prosecutors or judges require slightly different formats or types of evidence than those accepted by other authorities. Evidence collection practices and the types of evidence collected are tailored to fit the requirements of the local court when necessary.

COLLECTING EVIDENCE FOR HOST-NATION COURTS

C-6. Generally, each detention is supported by certain forms of evidence, whenever possible. These forms of evidence include statements, sketches, photographs, physical evidence, and biometric data. If properly followed, basic evidence collection standards provide the host-nation prosecutor with the evidence needed to present a case for prosecution. Ultimately, proper evidence collection supports U.S. and host-nation goals to remove dangerous individuals from the area of operations, which demonstrates effective rule of law to the local population.

OPERATION PRE-PLANNING

C-7. Tactical units conducting an operation appoint a site exploitation team and evidence collection team to plan for, detect, collect, receive, and handle all evidence seized during an operation. These teams, which also include host-nation partner members, are properly trained on evidence collection and handling procedures. (See appendix A for more information on the tasks conducted by site exploitation teams during pre-mission, mission, and post-mission phases of the operation.)

POTENTIAL ENABLERS

C-8. The site exploitation team uses enablers for additional support. These enablers include—

Prosecutors.

Military police.

Interpreters.

Explosive ordnance disposal team.

Combat engineers.

Military working dogs.

Combat camera.

Technical intelligence team.

Female service members (for facilitating potential searches of females found on the objective).

C-9. Whether or not these potential enablers are required for a specific mission depends on the facts and purpose of that mission.

POTENTIAL EVIDENCE

C-10. When planning for a specific operation, the site exploitation team considers the types of evidence that may be found at the objective and prepare accordingly. Possible exploitable evidence includes documents, weapons, photographs, improvised explosive device components, explosives, drugs and other contraband, witness statements, money, multimedia and multimedia storage devices, suspects’ clothing, and information obtained from suspects’ requiring questioning.

C-11. Based on the evidence found, the site exploitation team follows certain evidence handling requirements. The evidence found consists of a variety of materiel that requires specialized handling techniques. Before handling evidence, site exploitation team members assess the physical properties of the evidence (such as weight, size, quantity, and if it’s hazardous material), the types of containers needed for packaging (such as plastic and paper bags), and types of personal protective equipment needed during handling (such as rubber or latex gloves and masks). The contents of the site exploitation kit are then tailored for the mission and capabilities of the unit. Generally, the goal of the site exploitation team is to provide physical evidence and solid information (such as witness statements, photographs, and sketches) to the host-nation court system, therefore, giving the host nation the capability to detect, collect, process, analyze, disseminate, and store evidentiary materiel for use at trial.

C-12. Although host-nation partners are the primary repositories for the evidence collected on-site, U.S. forces are sensitive to and recognize the evidence that has intelligence value. Units coordinate with technical subject matter experts, such as the assistant chief of staff, intelligence, military police, staff judge advocate, and the forensic exploitation team to determine the types of physical evidence to exploit for intelligence purposes. Mission planning includes the process of transferring evidence to the host nation after U.S. forces complete their intelligence exploitation. All transfer of evidence from U.S. forces to the host-nation partners is well documented.

SCENE AND SITE TASKS

C-13. The safety of U.S. forces is of primary importance. When the safety of U.S. forces is at risk and does not allow time to follow procedure, the site exploitation team collects as much evidence as possible and finishes documenting the evidence immediately upon return to the base.

C-14. The host-nation leads in evidence collection by sketching and photographing scenes and evidence, collecting the physical evidence, and taking on-scene witness statements with support from partnered U.S. units. Host-nation units are sufficiently trained in evidence handling. The most literate member of the partnered host-nation unit serves as the recorder. Units that have difficulty writing statements can use a recording device (video or audio recording).

C-15. Once the objective is secure, the unit secures and protects the scene from contamination. The goal is to keep the detected evidence undisturbed, untouched, untainted, and uncontaminated. In many instances, representatives from various host-nation agencies are present at the scene. Although well intentioned, these representatives sometimes attempt to collect and remove evidence without proper coordination with the host-nation partnered force that is responsible for the scene. To prevent potential issues, the unit provides refresher training to host-nation forces on how to cordon a scene and prevent untrained individuals, including suspects, from disturbing the evidence. Host-nation officials, who remove or disturb potential evidence, have their names and contact information recorded along with the items they removed or disturbed. This information is noted in the case files.

Photographic Documentation

C-16. Photographs are one of the most important pieces of evidence collected by host-nation personnel. Host-nation personnel are responsible for taking photographs and knowing the types of photographs required to document the scene. Photographs of material that has to remain on-site for whatever reason are acceptable. Therefore, it is important that host-nation personnel are properly trained to take photographs of evidence from a variety of angles and overlapping perspectives. The photographs also document exterior and interior scenes and suspects.

C-17. Proper and usable photographs are clear, sharp, free of distortion, and taken from a stable position at eye level or average height. The date, time, and location of a photograph is recorded. U.S. personnel are not included in any photographs depicting the scene.

Photographing the Scene

C-18. Photographs of site exteriors, vehicles, or buildings are taken from all angles and include a variety of approaches. If possible, the point of view establishes the location of the crime scene by including landmarks and reference points. Witnesses, onlookers, and the surrounding environment are also photographed. A common procedure, that is also a best practice, is photographing the site in all four cardinal directions, north, south, east, and west.

C-19. When photographing interiors, the condition of the site, vehicle, or building interior is documented. The photographs provide a 360-degree exposure of the area. Photographs are taken from all four corners of the room to depict the scene as initially viewed by U.S. forces.

C-20. The evidence is photographed in the state it is found, before it is moved or disturbed. Photographs include both a close-up view of the item and a wide-angle view that demonstrates where the item was located in relation to the interior space. When taking close-range photographs of the evidence, a small measuring device is used to show scale, such as a ruler or 3- by 5-inch (7.62- by 12.7-centimeter) card. In the close-range photographs, the evidence fills the entire frame. For wide-angle shots, it is acceptable to move items after the first pictures are taken to provide a clear depiction of the potential evidence. If an object is covering part of a weapon, a photograph is first taken of the weapon and the object in place. Afterwards, the object is removed and another photograph is taken of only the weapon. A series of photographs depict any attempts made to hide contraband.

Photographing Suspects

C-21. Photographs are taken of the suspect next to the potential evidence before the item is moved from its original location. The safety of U.S. and host-nation forces is considered when taking photographs of suspects. The suspect’s hands are kept secured and away from loaded weapons and ammunition.

C-22. Host-nation personnel photograph the suspect with evidence in its original location, then a photograph is taken of the suspect with the evidence at the evidence collection point. Items of potential evidentiary value, located on a suspect’s person, are removed and photographed independently of the other items recovered. Each piece of evidence is photographed separately, showing all details, serial numbers, size, and markings.

C-23. Once photographs are taken, the evidence is placed in the marked bags and prepared for transportation. Placing items in plastic bags when it is either very hot or cold outside can cause condensation and destruction of latent fingerprints. Only paper bags are used for items that possibly contain latent fingerprints. The marked evidence bags are also photographed. The photographs are documented according to the location in the room each one was taken.

C-24. Photographic documentation of the biometric collection and results of the identification and verification of the suspect’s identity aids in prosecution of the individual. Biometric signatures such as iris images, facial photographs, deoxyribonucleic acid (DNA), fingerprints, scars, marks, tattoos, and other identifying information can link individuals to events, locations, materials, and threat networks.

C-25. Suspects are photographed with evidence recovered during their capture. A placard is included with the each suspect’s name, date, place of capture, and eight-digit military grid reference system coordinate. If possible, a host-nation representative is included in the photo.

C-26. After photographs are made of the evidence found in its original location, it is permissible to consolidate the evidence into one location. The suspect is photographed again with the consolidated evidence. If possible, evidence is matched to the suspect it is associated with. Photographs are taken of each suspect along with the potential evidence. For example, a suspect seen carrying a weapon, is photographed with that weapon.

C-27. Evidence displayed in the photograph with the suspect includes, but is not limited to, disguises, identification documents (such as a passport), cell phones, notebooks, currency, maps, invoices, uniforms, patches, communications equipment, ammunition, shell casings, improvised explosive device parts, weapons, and precursor chemicals such as substances used in making weapons, ammunition, or explosive devices.

Cataloging Photographs

C-28. When possible, a photograph log is used to record and associate the photographs with the room sketches. Videos and photographs are transferred to compact discs for archival purposes. The storyboard is translated into the host-nation language and dialect to facilitate the transfer of evidence to host-nation authorities. Information in the photographs and the storyboard are cleared for release to the host-nation authorities.

C-29. The host-nation police provide a hand-written, signed, dated, and thumb-printed statement authenticating the photographs. An example of a statement reads—

I (name and rank) took the attached photograph(s) on (time and host-nation date). The photograph shows (describe the scene: who and what is in it). This photograph accurately depicts the way the suspect appeared at the time of capture and the evidence found with the suspect during the host nation-led operation to arrest the suspect. This photograph has not been altered in any way.

Sketches

C-30. Sketches document the layout of a scene and the location of buildings and rooms, and assist witnesses recall details. Sketches support photographs of exteriors and interiors, evidence, and suspects. Sketches are hand drawn and not necessarily drawn to scale. Host-nation personnel provide the sketches.

C-31. At a minimum, a sketch includes the name of a suspect, the suspect’s father’s name, the location of where the suspect was found, the location of any women and children found, and the location of all evidence found. A legend is included to identify the placement of items on the sketch. For example, the letter A on a sketch is used to mark the location where the suspect was found; it is included in the legend in the corner of the sketch to read, A: John Doe.

C-32. Sketches also provide the contact information of the unit that conducted the operation and made the sketch, the date of the operation, the name of the individual who drew the sketch, the location of the incident, and the eight-digit military grid reference system coordinate. The host-nation annotates which persons of interest were released and the names of all military-aged males found at the scene. Location of evidence is noted on the sketch with as much detail as possible. The location of the evidence and people assist the investigators in linking objects to individuals.

C-33. Host-nation judges use sketches to determine if a person is involved in a particular crime. Therefore, exact locations of evidence and suspects and other related individuals are paramount in providing a clear and accurate visual description that allows the judge to assess whether or not any criminal activity occurred. The sketch helps answer who, what, when, where, why, and how. In the event that host-nation personnel are not present at the scene, the sketch is completed by U.S. personnel, but is translated from English to the host-nation language or dialect upon return to the base.

Witnesses

C-34. Witness statements are key building blocks in host-nation criminal court cases and carry weight in proving a case. The host-nation takes statements, with assistance from U.S. forces, if necessary. Witness statements document, where applicable, the suspect’s actual violation of host-nation law instead of generalities. For example, “X is a bad guy” is a subjective and inadequate statement. Statements with specifics, such as “person X was seen carrying and emplacing an improvised explosive device,” or “X was seen meeting with Y who is a known insurgent, and they had weapons,” are more beneficial. Such statements, combined with evidence, are more likely to secure a conviction.

C-35. Witness statements are memorialized on paper, if possible. If this process is not practicable, statements are recorded using voice recorders or video cameras. However, some provincial courts lack the capability to view or listen to recorded testimonies. Alternatively, in lieu of a witness’s written statement or recording, a statement from a host-nation authority or an interpreter is allowed. The statement or copy is immediately presented to the investigating prosecutor. Judges prefer in-person or video testimony. Whenever possible, these forms of testimony are used in addition to written statements. Personnel never force or coerce witnesses to make a statement.

Interviewing Witnesses at the Scene

C-36. Host-nation personnel conduct witness interviews. Personnel interview witnesses individually, away from suspects and other witnesses to prevent collaboration or intimidation. An interpreter speaks in the appropriate language or dialect of the witness. The interview is recorded with a voice video recorder. Personnel record the information obtained at the location, including the evidence found and seized, any weapons found at the scene, the weapon’s functionality, the state in which the weapon was found, and any identifying marks located on the weapon.

C-37. During the interview, witnesses answer who, what, when, where, why, and how. The witnesses state names of all individuals who were present at the scene and explain the relationships between the individuals. The witnesses answer what occurred at the scene and the events leading up to the event. Witnesses are asked open-ended questions that allow them to explain the incident from their perspective. Personnel ask witnesses follow-up questions to obtain additional detailed information. If appropriate, witnesses can draw a picture of the scene, which is included in the witness statement with an annotation to that particular witness. At the conclusion of the interview, witnesses are asked to provide any additional information.

Witness Statements

C-38. Host-nation personnel take statements from eyewitnesses, witnesses who know the suspects, and host-nation personnel at the scene. U.S. personnel write statements supporting potential detention. Such statements answer who, what, when, where, why, and how. Personnel collect as many witness statements as possible. However, quality statements are more useful than several poorly documented statements.

C-39. Statements collected from local nationals offer first-hand knowledge of an incident or the suspect’s conduct on the day of capture. Statements are also collected from suspects who come forward voluntarily. Preferably, statements are taken from individuals living in the immediate vicinity of where the suspect was captured. Witness statements are not taken within hearing range of the suspect. Even if witnesses lie, their statements can differ from a suspect’s statements, thereby impugning the suspect’s credibility unintentionally.

C-40. Host-nation personnel do not record witness statements word for word, but write the statement in clear, coherent language. Military jargon is avoided unless it is used by witnesses. Statements include testimony from witnesses stating that they were not coerced into giving the statement, and whether or not they are available to testify at trial. The reason why a witness is not available to testify is noted in the statement.

C-41. Personnel review the statement with the witness. Witnesses make corrections, if necessary, before signing the statement. Witnesses sign their individual statements, sometimes with the addition of a thumbprint. The national identity number of a witness is included in the statement.

C-42. If detailed statements are not collected on-site, personnel record, at a minimum, the witnesses’ contact information, their name, father’s name, village name, telephone number, and directions to their home or a family member’s home. This information enables host-nation investigators to question the witness later.

C-43. In the event that a host-nation citizen is not available or willing to cooperate, statements are obtained from individuals who have first-hand knowledge of the suspect’s conduct on the day of capture. Statements taken from U.S. personnel are translated upon return to base if the site exploitation team is not partnered with a host-nation unit.

C-44. If a witness is literate, this information is annotated on the statement to indicate that the witness can read and write. When a witness is illiterate, the witness’s statement is taken by a linguist. An annotation is made to indicate that the statement was made by the witness, it was read to the witness by the linguist, the witness understood the statement, and agreed with the statement.

C-45. The on-site host-nation personnel member in charge signs the statement before giving it to the prosecutor. If the host-nation personnel member in charge refuses to sign the statement or is otherwise unavailable, the name of the unit is entered, along with a description, location, date, and time of the event.

C-46. In the event that witnesses do not provide their name, host-nation personnel take their statements and the host nation in charge signs it, printing the witnesses name and the unit’s name before providing the statement to the prosecutor. If host-nation personnel are not available, the eight-digit military grid reference system coordinate, the U.S. unit identification, and the village name are noted.

Host-Nation Police Statements

C-47. In addition to eyewitnesses and citizen statements, unclassified statements are taken from host-nation police who have first-hand knowledge of the scene. Statements taken from host-nation police encourages host-nation participation in the criminal process.

C-48. The senior host-nation force member presents a brief statement of facts. In this statement, the senior host-nation official details what occurred leading up to the collection of evidence, and the actual detention and the events that unfolded post-capture. This statement includes why troops were at a particular location, what led them there, and what they found.

Interviewing the Suspect

C-49. Before joint interviews are conducted with host-nation personnel, due diligence is used to ensure the suspect is not the victim of abuse. If the suspect alleges abuse, the interview is stopped and the abuse is reported. The unit’s standing operating procedure contains information on reporting requirements.

C-50. A host-nation prosecutor or investigator conducts the suspect’s interview, whenever possible, in compliance with host-nation law. The unit law enforcement professional coordinates with host-nation prosecutors or investigators to understand and explain the proceedings to the unit. The interviewer reviews physical evidence and witness statements before interviewing the suspect.

C-51. During the interview, suspects answer who, what, when, where, why, and how. Suspects may sign the interview statement at the conclusion of the interview. If a suspect refuses to provide details of the alleged crimes, the suspect’s name, the father and grandfather’s name, and social relationships, such as clan, tribe, and national identity are documented.

C-52. Suspects are never forced or coerced to sign a statement if they are unwilling to do so. If suspects refuse to sign statements, then two witnesses provide statements in writing, or by video or voice recording, providing details of any verbal statement or admissions made by the suspects.

C-53. In host-nation courts, or during a host-nation interview, incriminating statements can serve as the beginning of a full confession and are used to extract information about an event. Some judges have conveyed that an incriminating response made during the excitement of an event is the definition of a confession. An incriminating statement can serve as a basis for prosecution, if documented by a host-nation partner.

Host-Nation Arrest Form and Evidence

C-54. A host-nation arrest form is completed if a detention occurs. While on-site, personnel enter the data field with sufficient detail to identify the suspect. The remainder of the form is completed upon return to base.

C-55. Designated host-nation personnel document the scene by photographing equipment, tools, documents, currency, and drugs, with a statement included. Evidence is destroyed in accordance with the unit standing operating procedures. Photographs are taken of all evidence before it is destroyed and after destruction to verify destruction. Host-nation personnel provide a statement describing the items that were destroyed, using as much detail as possible, such as number of weapons, type, and serial numbers. In addition, the host-nation statement details why the items were destroyed. Host-nation statements answer why, how, and who destroyed the items.

C-56. A successful prosecution leading to long-term detention requires the host-nation to collect and preserve the minimum quantities of specific items. Units ensure host-nation personnel document the scene appropriately, and preserve the minimum standard of weight for particular drugs or narcotics in accordance with local law. Without preserving, labeling, and transporting minimum weight, the suspect will not qualify for trial at a counternarcotics tribunal. If the requirements are not satisfied for the counternarcotics tribunal, the local courts still maintain jurisdiction.

Physical Evidence

C-57. Loose objects, such as money, keys, and paper scraps are sometimes considered as evidence. These objects are usually found in a suspect’s pockets or clothing. All objects are collected because of the limited time to determine which objects have value. Once removed from the suspect, the pocket litter is placed in a marked plastic bag and documented on the appropriate chain of custody form.

C-58. To pursue an investigation, display associations, or demonstrate knowledge of threat activities, host-nation authorities are provided with a copy of receipts, documentation, leaflets, notebooks, or papers found at a scene. Host-nation personnel prepare a short statement indicating where the documentation was found and the name of the individual who found it. The host-nation personnel in charge sign this statement, document the unit’s name and date, and reference the relationship the items have to the event.

Documents

C-59. Documents are collected and stored in paper containers to preserve latent fingerprints. Documents found in separate areas of a crime scene are stored separately. The sketch is annotated to identify from where the documents were recovered. Documents are translated as soon as practicable for intelligence value. Documents are photographed in the event the actual document is misplaced.

Weapons

C-60. Weapons are photographed before they are moved. Weapons are cleared after the photographs are taken, but before they are transported. The condition of weapons is noted as they are discovered. Serial numbers of weapons are documented and photographed as well as any other visible nomenclature.

C-61. Latent fingerprints and genetic samples located on the weapon are preserved. The number of individuals who handle the weapon is kept to a minimum. Ammunition is not removed from magazines. Any weapon used for evidence is not destroyed in place, but is instead collected and preserved. To maximize potential exploitation opportunities, weapons are handled on areas that are less likely to contain fingerprints. The unit’s standing operating procedure contains guidance regarding destruction of weapons or hazardous material.

C-62. Weapons are stored separately from ammunition or magazines, but an annotation is made indicating which ammunition was found with which weapon. Because rounds can contain fingerprints, they are not removed from the magazine for any reason.

Explosive Materiel and Improvised Explosive Device Components

C-63. Personnel take extreme care with electronic devices, including flash photography, while in a structure where the possibility of an explosive hazard is present. Explosive materiel found on-site is handled by trained explosive ordnance disposal personnel. Improvised explosive device components found on-site, such as pressure plates, copper wire, switches, and battery packs are collected, documented, and stored. If safe to do so, explosive materiel is photographed before it is moved or destroyed.

Electronic Multimedia Storage Devices

C-64. Cell phones, memory cards, and multimedia storage devices, such as computer hard drives, thumb drives, compact discs, portable media players, cameras, optical disks, and video recorders are collected.

C-65. Electronic devices that are turned on, remain on. Electronic devices that are off, remain off. Pressing keys or buttons on electronic devices can destroy data. Batteries and memory cards are not removed from the electronic device. Personnel do not use electronic devices in any way, such as to answer an incoming call or check contact information. Power cords, cables, and chargers remain with the device.

C-66. U.S. forces request an unclassified list of phone numbers stored on a cell phone memory card. The cell phone is returned immediately after intelligence exploitation. The unit provides the unclassified list to the host-nation prosecutors. With this information, the host-nation prosecutors can identify a suspect’s ownership of a cell phone, and can detect threat relationships and communications methods.

Advanced Evidence Collection

C-67. If the capabilities are available, and host-nation prosecutors and judges accept the evidence, materiel and information obtained from advanced evidence collection is used to supplement basic evidence. Judges need adequate understanding of U.S. evidence processing and analysis procedures. Most of the advanced evidence collection methods are highly technical, and are only considered if the judge understands the significance of the scientific evidence.

Biometric Collection

C-68. Biometrics collected from persons encountered on-site are compared against the Biometrically-Enabled Watchlist. Detained persons that are enrolled may not have been previously entered in the database. Depending upon mission parameters, a complete enrollment is collected to include iris images, fingerprints of all ten digits, a full facial photograph, biographic data (claimed name, height, weight, eye color, and hair color), and situational contextual data (the information about the event that answers who, what, where, when, and why). Also documented, is the eight-digit military grid reference system coordinate associated with the location where the suspect was found.

C-69. The senior person on-site is notified of a suspect who is identified as a match in the Biometrically-Enabled Watchlist or to a regional biometric database. The senior person on-site is also contacted if the situation warrants the suspect’s immediate detention.

Explosives Testing

C-70. Trained host-nation personnel use available explosive testing material to conduct an explosive test immediately following a suspect’s capture. An explosive test, such as an explosives detection spray or vapor spray test, is administered to determine if suspects have trace elements of explosives on their body or clothing. A positive response may be indicative of the individual’s handling of explosives.

C-71. Personnel take a close-range photograph of the swab documenting the results of the spray test. An additional photograph depicts the results of the swab with the suspect. A translated chart is used to identify chemical compounds. The swab fades over time; photographs are the only accurate preserved evidence. Host-nation personnel write the statement regarding the explosive testing conducted on a suspect and the results of the test.

Latent Fingerprints

C-72. Clumsy or careless handling can destroy latent fingerprints. The use of rubber or latex gloves to handle the evidence eliminates unnecessary contact with the evidence. Evidence is handled only if necessary. Unnecessary handling of the evidence degrades latent fingerprints or impedes DNA sampling because of cross contamination. Paper containers also prevent damage to prints.

Deoxyribonucleic Acid

C-73. Items found at the scene may have traces of DNA that link a suspect to the crime scene. Rubber or latex gloves are worn on each hand when collecting DNA. The outer set of gloves are changed before collecting another item to avoid cross contamination. Evidence containing DNA is collected and stored in a sealed paper bag. The paper bag is then placed inside of a second paper bag and sealed. The biometric batch number and fingerprints of suspects are recorded on the paper bag. Biographical information is also recorded on the bag, to include the suspect’s name, father’s name, date of birth, tribe, and village. This information associates the DNA swab with the approved biometric collection device and fingerprint card entry in the fingerprint databases.

C-74. In order to match the suspect to any DNA found at a crime scene, a DNA sample from the suspect is necessary. DNA samples are collected by swabbing the inside cheek of a suspect’s mouth. The swab is stored in a paper bag and labeled with the suspect’s name, date, time, and location. The bag is sealed to prevent cross contamination.

C-75. Damp evidence and some DNA samples such as cheek swabs and blood are placed in paper bags, which allow ambient drying and prevent the destruction of evidence through the presence and growth of bacteria and mold.

Wet Documents

C-76. Personnel wear latex gloves and masks when handling wet documents. A damp document is carefully unfolded and allowed to completely dry. A document that is completely wet is placed in a paper bag, which helps absorb the moisture. The paper bag is placed into an unsealed plastic bag. The document is monitored for discoloration. The damp document is removed from the bag and allowed to completely dry upon the Soldiers return to their base of operations.

C-77. Rubber or latex gloves and a mask are worn when personnel handle documents soaked with body fluids. The contaminated documents are placed in paper bags, and placed in an unsealed plastic bag. Upon return to base, the medical clinic is notified of the contents. A digital camera is used to record the condition and content of the documents.

Labeling and Tagging Evidence

C-78. Units tag all evidence when possible. When tagging, units separately label evidence. Each piece of evidence is labeled with—

Name of item.

Name of suspect and the capture tag associated with this specific item.

Unit designated number given to this specific piece of evidence.

Date and time of capture.

Short description, to include color, serial number, and shape.

Exact location of where the item was located upon confiscation, to include the eight-digit military grid reference system coordinate and room.

Identity of capturing unit.

C-79. A copy of each tag is maintained for record-keeping purposes. The tags are translated into the appropriate language or dialect. All tags originally written in another language or dialect are translated. Loose items are placed in separately labeled plastic bags.

Evidence Transfer and Chain of Custody

C-80. Suspects are transferred to the host nation with a completed and translated host-nation arrest form that includes the suspect’s thumbprint and signatures of two host-nation witnesses. Also, included is an unclassified storyboard containing all photographs taken at the scene and a statement of facts translated by the site commander.

C-81. Physical evidence is required to assist the prosecution at trial. Evidence includes disabled weapons and components associated in the construction of improvised explosive device components. Additional forms that accompany the evidence during transfer are—

A completed and translated host-nation search form may be obtained in advance if the suspect’s capture was coordinated before the search with supporting host-nation entities. A host-nation prosecutor can provide consent for a search by phone if unexpected evidence is identified. If the search form is not obtainable in advance, a form is completed upon return to base.

Fully-completed and translated witness statement forms that include the witness’s contact information from both host-nation civilians and host-nation personnel, and full commercial contact information for the unit point of contact, including cell phone, to facilitate contact by investigators and prosecutors for investigation purposes.

A fully-completed and translated transfer of evidence form or the DA Form 4137. A completed DA Form 4002 accompanies the DA Form 4137.

C-82. Copies and records of documents and evidence related to a criminal prosecution are turned over to host-nation authorities. The evidence and information collected is considered unclassified unless there is reason to classify the information.

Appendix D

Weapons Cache Checklists

This appendix provides three sample weapons cache checklists for documenting weapons caches found on-site.

WEAPONS CACHE BASIC CHECKLIST

D-1. See table D-1 for a weapons cache basic checklist.

Table D-1. Weapons cache basic checklist

If the weapons are hidden, photograph them in place before removing them. If the weapons are in boxes or containers, open the container and photograph the contents.

Photograph the room and area where the weapons or contraband were found.

Photograph suspects and weapons together.

If there is more than one suspect, photograph all the suspects together along with the cache.

Take close-range photographs of the weapons, grenades, detonation cords, antitank rockets, and ammunition.

Photograph the exterior of the suspect’s house (courtyard, wall, entrance and exit points, and any major landmarks).

Annotate all weapons and contraband found on-site on the appropriate forms (evidence and property, witness statement, and apprehension).

Take at least two witness statements.

Sketch the house, specifically the room where the contraband is located.

Collect and tag the evidence.

WEAPONS CACHE CHECKLIST

D-2. See table D-2 for a weapons cache checklist.

Table D-2. Weapons cache checklist

If weapons are hidden, photograph them in place before removing them. If the weapons are in boxes or containers, open the container and photograph the contents.

Photograph each suspect and weapons together.

If there is more than one suspect, photograph all the suspects together with the cache.

Take close-range photographs of the weapons, grenades, detonation cords, rocket propelled grenades, and ammunition.

Photograph the suspect’s house and where the weapons cache was located in relation to the house. The suspect’s house is included in the background of the photograph. (Note. This photograph establishes the distance from the home in relation to the weapons cache. It also establishes that the suspect owns the property.)

If the cache is located in the suspect’s courtyard, then photograph of the courtyard wall. (Note. This photograph shows that the property is not easily accessible.)

Photograph the courtyard. (Note. This photograph shows the layout of the property.)

List all weapons and contraband found on-site on the appropriate forms (evidence and property, witness statement, and apprehension).

Take at least two witness statements.

Sketch the house, specifically the room where the contraband is located.

Collect and tag the evidence.

WEAPONS INSIDE VEHICLE CHECKLIST

D-3. See table D-3 for a weapons inside vehicle checklist.

Table D-3. Weapons inside vehicle checklist

Photograph the weapons inside the vehicle before removing them.

Photograph the entire vehicle.

Photograph the license plate of the vehicle.

Photograph the weapons, vehicle, and suspect together.

Take close-range photographs of all weapons and contraband found. If contraband is in a container, open the container and photograph the contents.

Photograph the area where the car stopped.

Take a close- range photograph of the car registration.

Take a close- range photograph of the vehicle’s identification number. The vehicle’s identification number is located under the driver’s side windshield or inside the door panel.

Identify the driver and passengers in the witness statements.

Photograph the car registration and the driver and passenger identification to prove ownership of the vehicle.

List all weapons and contraband found on-site on the appropriate forms (evidence and property, witness statement, and apprehension).

Take at least two witness statements.

Sketch the vehicle in relation to nearby landmarks, including any roads.

Photograph the location of where the suspect was captured in relation to the improvised explosive device site. (Note. This photograph shows distance.)

Photograph the location where the suspect was first observed by the unit after the improvised explosive device was discovered. (Note. This photograph shows distance and viewpoint of the improvised explosive device placement.)

Photograph the detonation device, if recovered.

Photograph the suspect with the detonation device.

Conduct explosives testing on all suspects and record the findings in writing.

Photograph the explosive testing conducted on the suspects.

State the number of photographs taken and the name of the photographer on the witness statements.

Sketch the scene.

Collect and tag the evidence.

Appendix E

Department of Defense Forensics

This appendix discusses DOD forensics and the role of the forensic exploitation team provided by the Defense Forensic Science Center’s Forensic Exploitation Directorate. It further describes the capabilities of a forensic exploitation team and how these capabilities support site exploitation.

INTRODUCTION TO DEPARTMENT OF DEFENSE FORENSICS

E-1. DOD forensics is the application of multidisciplinary science capabilities to establish facts to support intelligence, law enforcement, and identity superiority operations. In practice, forensics is used to individualize, identify, associate, and scientifically link people, places, and things, intentions, activities, organizations, and events to each other.

E-2. The DOD possesses considerable forensic capabilities; however, these capabilities do not sufficiently support unified land operations, and they lack department-wide coordination. Traditionally, forensics has focused on law enforcement investigative and judicial functions, but this is no longer the case. The purpose of site exploitation is to gain the knowledge that possesses both intelligence and law enforcement value. The forensic facts gained from materiel collected during site exploitation significantly contribute to the U.S. and multinational forces’ operations. (See table E-1 on pages E-1 and E-2 for notional forensic exploitation team support activities during joint operation planning phases.)

E-3. The Defense Forensic Science Center’s Forensic Exploitation Directorate supports the Army by fielding an expeditionary forensic exploitation team to provide forensic support to operational commanders. Forensic exploitation teams continue to evolve through the use of cutting-edge scientific methods and technology and highly trained and certified personnel.

Table E-1. Notional forensic exploitation team support activities during joint operation planning phases

Phase | Support Activities

Phase 0
Shape the Environment

Theater security engagement.

Host-nation training.

Build civilian capacity.

Joint operation planning.

Phase 1
Deter the Enemy

Host-nation support.

Identity dominance.

Maintain expeditionary forensic capability and fly-away teams.

Joint operation planning.

Phase 2
Seize the Initiative

Force protection.

Identity dominance.

Targeting.

Joint operation planning.

Phase 3
Dominate the Enemy

Force protection.

Identity dominance.

Targeting.

Detainee operations.

Joint operation planning.

Phase 4
Stabilize the Environment

Force protection.

Detainee operations.

Transition to rule of law.

Regional focus.

Joint operation planning.

Phase 5
Enable Civil Authority

Force protection.

Host-nation training.

Build civilian capacity.

Focus on people and dispersed operations.

E-4. The forensic exploitation team provides forensic capabilities tailored to support site exploitation. The forensic capabilities provided by the forensic exploitation team are an integral part of a commander’s overall mission. During planning, commanders provide a clear intent for employing the forensic exploitation team’s capabilities. The commander identifies the qualitative and quantitative measures needed to assess the outcome of specified tasks. (See table E-2 for forensic capabilities of a forensic exploitation team, provided by the Defense Forensic Science Center’s Forensic Exploitation Directorate.)

Table E-2. Forensic exploitation team forensic capabilities

Capability | Tasks

Forensic Exploitation

DOD’s sole force provider for battlefield forensic capabilities.

Provide actionable information for targeting, rule of law prosecution, and force protection.

Provide forensic services.

Support law enforcement and intelligence operations.

Develop remote exploitation capability.

Forensic Expertise

Technical leads (such as deoxyribonucleic acid, latent prints, chemistry, firearms, and tool marks).

Standards and certification.

Quality assurance.

Forensic training.

Reachback Operations

Global exploitation support for theaters without organic capability.

Analysis that cannot be performed by deployed laboratories.

Real-time analysis for overflow.

Exercise and training support.

Research and development.

Operational Support

Coordinate forensic support to current operations.

Combatant command engagement for forensic support.

Coordinate forensic training and support to theater exercises.

Shape future force requirements determination.

Influence development of forensic strategy and doctrine.

Human resources, intelligence, logistics, information technology, maintenance, resource management.

E-5. The forensic information provided by a forensic exploitation team is most valuable to a commander when it provides subsequent operations with information that identifies and characterizes persons and materiel; links people, organizations, places, things, intentions and activities; advances situational understanding; answers intelligence requirements; and provides attribution for incidents and activities. The forensic exploitation team provides factual information that enables intelligence, targeting, prosecution, personnel recovery, medical, component materiel sourcing, and other tasks. Multidisciplinary forensic sciences contribute to examining sites; identifying, tracking, and targeting the threat; locating and identifying individuals; determining the cause and manner of a death; and prosecuting offenders in judicial systems.

FORENSIC FUNCTIONS

E-6. The forensic exploitation team directly supports site exploitation through the application of the six forensic functions. The forensic functions occur in sequence, in parallel, or in any combination based on the mission variables.

RECOGNIZE

E-7. Recognize is a function that involves locating and distinguishing materials having potential forensic value; it involves using special methods and advanced training to detect items of value.

PRESERVE

E-8. Preserve is a function that involves protecting materials and data from the moment they are recognized as having potential forensic value. Materiel is preserved by taking available, reasonable measures (for example, marking, packaging, and tracking) to prevent contamination, loss, or alteration of the materiel’s forensic value.

COLLECT

E-9. Collect is a function that describes the process of recovering and accounting for materiel removed from a site. The site is documented and contextual information is recorded within the parameters allowed by the situation, which often includes limited processing of specific items or areas in an effort to detect additional forensically-relevant information. Presumptive testing of materials is also involved.

ANALYZE

E-10. Analyze refers to the scientific processes conducted by a forensic exploitation team to produce facts. Forensic analysis occurs when materials and contextual information is recognized at the site, resulting in an in-depth examination at a mobile or traditional (institutional) lab. Presumptive testing of materials is often involved. A variety of factors, such as submitting a unit’s request, expected use of results, time priorities, and available lab resources, dictates the type of analysis performed by a forensic exploitation team.

STORE

E-11. Materials and associated information is maintained until forensic material disposition is fully adjudicated or resolved. Policies and procedures dictate proper disposition. Balancing information assurance with necessary retrieval capabilities is crucial when storing material and information.

SHARE

E-12. As forensic analyses are completed, results are cataloged and shared in accordance with policies and procedures. Interoperability is essential to developing databases and retrieving information. Sharing information with the relevant organizations, to include the submitting unit, is vital.

FORENSIC OPERATIONAL PROCESS

E-13. The activities associated with the six forensic functions form a forensic operational process that is separate from, but related to the forensic functions. The forensic operational process includes the activities of triage, transfer, exploitation, and action, each of which occur in any or all of the forensic functions.

TRIAGE

E-14. The triage function of deployable laboratories is important because it is the first point of contact between the arriving evidence and the routing of evidence to appropriate examiners. At the triage point, explosive ordnance disposal personnel ensure all material is rendered safe before it is processed through the forensic exploitation team forensic modalities. Triage assumes control when the area is cleared.

E-15. One of the first documents prepared during the forensic operational process is a case file. A typical case file contains an individual's name, place and date of birth, physical appearance, occupation, names and relationships of other family members, and those objects thought to be attributed to that person from the point of occurrence. A forensic analysis plan is developed with support from forensic modality technicians. A laboratory manager ensures that evidence, when obtained and ready for triage, continues through the exploitation phase with a proper chain of custody. The forensic exploitation team personnel collate all knowledge collected during the analysis phase and archive that data in the case file. The forensic exploitation team personnel enter the data from the case file into the forensic exploitation team process and information management system for further sharing and analysis. This process of evidence management is critical to ensuring that evidence is attributed and not compromised.

TRANSFER

E-16. Transfer consists of physically transporting materials or transmitting digital information. Once analyzed, forensic materials and information are transferred to an appropriate location, such as the Defense Forensic Science Center, for long-term storage or a complete scientific analysis.

EXPLOITATION

E-17. Exploitation is the action of taking full advantage of any information for tactical, operational, or strategic purposes. After the information, personnel, and materials are forensically analyzed by the forensic exploitation team, the resulting analysis is fed into operations and intelligence channels. The operations section uses the results of the forensic exploitation team analysis as additional input when conducting the military decisionmaking process.

ACTION

E-18. Exploiting the results of the forensic exploitation team forensic analysis leads to actions such as follow-on operations, additional intelligence taskings, battlefield targeting, and apprehension and prosecution of suspects. The operational process is considered complete once the appropriate action is taken to exploit the results of the scientific analyses.

FORENSIC EXPLOITATION TEAM CAPABILITY OVERVIEW

E-19. The Forensic Exploitation Directorate deploys a scalable and modular forensic exploitation team to provide the joint force commander or combatant command with an expeditionary forensic capability. The forensic exploitation team is sourced by the Forensic Exploitation Directorate with highly qualified Army civilian scientists. The Forensic Exploitation Directorate has the ability to support forensic analysis in remote locations, as required. Deployed assets of the Forensic Exploitation Directorate can obtain assistance through reachback to the Defense Forensic Science Center, Global Forensic Exploitation Center for forensic support, if needed.

E-20. Forensic exploitation teams are scalable, modular, and adaptable to support a commander’s needs. They can deploy as one- or two-person teams to augment a commander’s staff as the forensic science officer, and support training exercises and partner nation engagements. When a deployable forensic laboratory capability is required, a forensic exploitation team deploys in an eight-person lite forensic laboratory construct that is scaled larger as operational requirements demand. Figure E-1 shows a basic footprint of a forensic exploitation team’s deployable lite forensic laboratory.

FORENSIC MODALITIES

E-21. The Defense Forensic Science Center’s Forensic Exploitation Directorate is the Army’s sole provider of forensic capabilities across the range of military operations. A forensic exploitation team, as a multidiscipline forensic laboratory, uniformly applies accepted industry standards to examinations for rule of law prosecutions and intelligence. Forensic exploitation teams are equipped to conduct latent print, deoxyribonucleic acid (DNA), firearm and tool mark, and chemical analysis, as well as manage evidence and case files.

Latent Prints

E-22. Latent print examiners detect, develop, and recover latent prints from submitted material, such as weapons, documents, tape, ammunition, and explosive device fragments. Latent print examiners compare any unidentified latent prints against existing records for identification. Latent print examiners collect usable latent prints from unidentified bodies. Examiners search and compare latent prints to database candidate lists for possible matches. The examiners have the ability to work in both classified and unclassified environments when rule of law prosecutions and intelligence are involved.

Deoxyribonucleic Acid

E-23. DNA examiners recover DNA from submitted material, such as cigarette butts, clothing, weapons, and drinking containers. The DNA examiners follow protocols set by the Federal Bureau of Investigation for quality assurance standards. They also identify and obtain DNA from unknown stains and recover DNA from bodily fluids. Once DNA is obtained, DNA examiners enter profiles into DNA databases to search against other known and unknown profiles. The examiners process samples and obtain results within 72 hours. They also provide training to tactical commanders on the collection and preservation of evidentiary material.

Firearms and Tool Marks

E-24. Examiners link multiple shooting incidents and determine the number of firearms involved. They can access a firearm’s functioning and identification, and conduct microscopic comparison of fired bullets, cartridge cases, and limited tool marks using microscopic comparison. Examiners can even determine the serial number in cases where a firearm’s serial number is missing.

E-25. Similar to latent prints and DNA, tools leave unique signature marks when used. Tool mark examiners can determine if a tool was used to construct an improvised explosive device based on the tool mark imprint. The tool marks can link multiple events to a single tool of origin.

Chemistry

E-26. Forensic chemistry is generally categorized with drug and explosive specialties. Chemists identify types of drugs and their individual characteristics. Explosive analysis involves the examination of improvised explosives, controlled substances, and organic and inorganic fuels.

ORGANIC CAPABILITIES

E-27. To function effectively in a remote environment, the forensic exploitation team uses organic capabilities.

Information Technology Support

E-28. The forensic exploitation team deploys with organic information technology support. Information technology personnel coordinate with the host organization for connectivity. Information technology personnel are present on-site to provide immediate technical support.

Logistics and Maintenance

E-29. Also organic to the Forensic Exploitation Directorate is a logistic and maintenance capability necessary for shipping laboratory containers, equipment, and people. Personnel manage a warehouse that contains the deployable equipment. They ensure availability and serviceability of all equipment and shelters. They coordinate with laboratory supervisors on the contract maintenance of specialized equipment and calibration. When deployed with a forensic exploitation team, these personnel are involved with the assembly and positioning of shelters. They coordinate with the host organization for power and water, as well as billeting and life support arrangements for all personnel. As required, the logistics personnel coordinate movement of forensic exploitation team examiners with their supplies and equipment depending on mission requirements. Additionally, they handle the shipment of evidence to the Global Forensic Exploitation Center as required for reachback support.

Laboratory Process and Information Management System

E-30. The forensic exploitation team information management system is the Weapons Exploitation and Analysis Tool. This database facilitates highly efficient lab processing, analysis, and reporting, increasing the technical intelligence analysts and laboratory examiners’ access to timely and actionable intelligence and exploitation products. It is essentially a vehicle for sharing information, which is a critical function of forensics.

Appendix F

Support for Site Exploitation

This appendix discusses additional support Soldiers can obtain from government and military organizations when conducting site exploitation, regardless of the area of operations. This appendix briefly describes several non-Army intelligence and forensic organizations that support site exploitation that can enhance a commander’s awareness and facilitate coordination.

INTERAGENCY COORDINATION

F-1. Interagency relationships are ones of coordination and mutual support, not direction. A commander may request support from another government agency; however, the degree to which other government agencies or departments provide support depends on federal statutes, policy decisions, resources, and memorandums of agreement and understanding. Commanders collaboratively plan to identify where and how they and other government agencies or departments can work together. Together, they provide mutually beneficial support through the Office of the Secretary of Defense and the joint staff to develop standing relationships with the requisite organizations.

F-2. Successful site exploitation operations are often the result of careful coordination with the DOD and other government agencies. Site exploitation operations require significant interagency and intergovernmental coordination. Often, the joint force commander supports another government agency; this agency may support a partner nation or intergovernmental organization. Commanders often use a joint interagency coordination group or a joint interagency task force to coordinate with the agencies operating in the operational area.

JOINT INTERAGENCY COORDINATION GROUP

F-3. A joint interagency coordination group facilitates coordination between interagency activities based on existing agreements. This group performs a liaison function, enabling civilian and military operational planners to establish regular, timely, and collaborative working relationships. Originally formed to coordinate counterterrorism activities, joint interagency coordination groups cover all interagency coordination requirements such as site exploitation. Commanders ensure joint interagency coordination group personnel collaborate with their parent agencies’ subject matter experts. These experts understand their agencies’ authorities, capabilities, and capacity to assist in given situations.

JOINT INTERAGENCY TASK FORCE

F-4. The joint interagency task force exercises tactical control over assigned elements when conducting a mission. Joint interagency task forces derive their authority from an interagency memorandum signed by the head of each participating department or agency. Joint interagency task forces currently lack authority to interdict weapons of mass destruction.

F-5. Commanders identify tasks requiring interagency support early in the planning process. These tasks are associated with diplomacy, economics, law enforcement, and civilian agencies. For example, in support of site exploitation, a commander may require national intelligence assets and engagement from the Department of Justice during site exploitation operations.

OVERVIEW OF THE U.S. INTELLIGENCE COMMUNITY

F-6. The U.S. intelligence community comprises government and intelligence-oriented organizations. Together they form a team capable of leveraging skillsets unique to each organization without having to maintain assets individually.

DIRECTOR OF NATIONAL INTELLIGENCE

F-7. The Director of National Intelligence serves as the head of the intelligence community. The Director oversees the implementation of the National Intelligence Program and acts as the principal advisor to the President of the United States, National Security Council, and Homeland Security Council for intelligence matters.

F-8. The Intelligence Reform and Terrorism Prevention Act of 2004 outlines the duties of the Director of National Intelligence. The Director’s duties are to—

Ensure timely and objective national intelligence is provided to the President of the United States, the heads of departments and agencies of the Executive Branch, the Chairman of the Joint Chiefs of Staff and senior military commanders, and Congress.

Establish objectives and priorities for collecting, analyzing, producing, and disseminating national intelligence.

Ensure maximum availability of and access to intelligence information in the intelligence community.

Coordinate relationships with the intelligence or security services of foreign governments and international organizations.

Ensure the most accurate analysis of intelligence comes from all sources to support national security needs.

F-9. The Director of National Intelligence has six mission managers. These mission managers oversee all aspects of intelligence related to their focus areas:

Iran, led by the mission manager for Iran.

North Korea, led by the mission manager for North Korea.

Cuba and Venezuela, led by the mission manager for Cuba and Venezuela.

Counterterrorism, led by the Director of the National Counterterrorism Center.

Counterproliferation, led by the Director of the National Counterproliferation Center.

Counterintelligence, led by the Director of the National Counterintelligence Executive.

F-10. In each area, mission managers understand the requirements of intelligence consumers; provide consistent overall guidance on collection priorities, integration, and gaps; assess analytic quality, capabilities, and gaps; share intelligence information on the target; and recommend funding, investment, and research and development resource allocations.

CENTRAL INTELLIGENCE AGENCY

F-11. The Central Intelligence Agency provides national security intelligence to the President of the United States through the Director of National Intelligence. The Director of the Central Intelligence Agency also serves as the National Human Intelligence manager.

F-12. To accomplish the mission, the Central Intelligence Agency works closely with the rest of the intelligence community and other government agencies. Together, these agencies ensure that intelligence consumers receive the best intelligence possible. The Central Intelligence Agency is organized into directorates. These directorates carry out the intelligence process of collecting, analyzing, and disseminating intelligence. The directorates include the Directorate of Science and Technology and the Directorate of Support.

The Directorate of Science and Technology

F-13. The Directorate of Science and Technology works closely with the National Clandestine Service and Directorate of Intelligence to access, collect, and exploit critical intelligence. This directorate applies innovative scientific, engineering, and technical solutions. By maintaining extensive contacts with national scientific and technical communities, this directorate can rapidly assemble experts from many fields to bring the technological prowess of the United States to solve pressing intelligence and national security issues.

The Directorate of Support

F-14. The Directorate of Support provides integrated, mission critical support to the entire intelligence community. This directorate’s core support disciplines include human resources, financial and logistic operations, medical support, contracts and acquisitions, security, secretarial and administrative support, facilities, and integrated information technology support.

DEFENSE INTELLIGENCE AGENCY

F-15. The Defense Intelligence Agency is a major producer and manager of foreign military intelligence for the DOD and is a principal member of the U.S. intelligence community. This agency provides timely, objective all-source military intelligence to decision makers, the U.S. Armed Forces, the U.S. intelligence community, and force planners. This intelligence counters various threats and challenges across the spectrum of conflict.

F-16. To support all-source analytical efforts, the Defense Intelligence Agency directs and manages DOD intelligence collection requirements for the various intelligence collection disciplines. These disciplines include measurement and signature intelligence, imagery intelligence, and signals intelligence.

F-17. The Defense Intelligence Agency manages various national and DOD activities related to measurement and signature intelligence. Such intelligence is technically derived information that measures, detects, tracks, and identifies unique characteristics of fixed and dynamic targets. Measurement and signature intelligence technologies allow the DOD to confidently monitor arms control agreements, make smarter weapons, and support protection and missile defense efforts effectively.

F-18. To support DOD efforts in oversees contingency operations, the Defense Intelligence Agency established the Joint Intelligence Task Force for Combating Terrorism to consolidate and produce all source terrorism-related intelligence. This task force leads and manages the DOD counterterrorism intelligence effort and exploits all sources of intelligence to warn U.S. forces and to support offensive counterterrorism operations. It collects, analyzes, and shares intelligence with military commanders, government officials, and other intelligence agencies.

F-19. The Defense Intelligence Agency also serves as the executive agency for the U.S. intelligence community’s prisoner of war and missing in action analytic cell. This unit provides actionable, national level intelligence support to locate missing, isolated, evading, or captured U.S. military or U.S. government personnel.

F-20. The Defense Intelligence Agency’s underground facility analysis center houses the nation’s intelligence and other technical resources. It coordinates the intelligence community’s efforts to detect, identify, and assess buried underground facilities and their associated programs worldwide.

F-21. The Defense Intelligence Agency’s Missile and Space Intelligence Center is the DOD authority on man-portable air defense systems. It develops scientific and technical intelligence on foreign missile systems to include—

Short-range ballistic missile system.

Surface-to-air missile system.

Antitank-guided missile system.

Antiballistic missile system.

Ground-based antisatellite system.

Associated command and control systems.

F-22. The Defense Intelligence Agency’s National Center for Medical Intelligence provides medical profiles of foreign countries. It assesses real and potential health hazards, providing support and humanitarian operations to U.S. forces worldwide.

F-23. To support the growing demand for intelligence agility and global collaboration, the Defense Intelligence Agency maintains the Joint Worldwide Intelligence Communications System. This system incorporates advanced networking technologies that permit a secure, high bandwidth system, which provides video teleconferencing and data exchange for the entire intelligence community.

F-24. The Defense Intelligence Agency also assumes responsibility for managing intelligence information technology for the combatant commands. This initiative creates greater efficiency and promotes information sharing. It also encourages a single DOD data standard for information metadata tagging and ensures that every DOD system will track, tag, and store data in the same way. This consolidated resource management ensures a more integrated and interoperable intelligence information architecture.

Department of Homeland Security’s Office of Intelligence and Analysis

F-25. Intelligence in the Department of Homeland Security consists of the Office of Intelligence and Analysis and intelligence offices located within the Department of Homeland Security operational components. These offices focus on five principal areas:

Improving the quality and quantity of its analysis.

Integrating the intelligence elements of the department.

Sharing threat information and assessments with state and local governments, and the private sector.

Ensuring the Department of Homeland Security is an effective member of the National Intelligence Community.

Strengthening relations with Congress.

F-26. Department of Homeland Security intelligence analysts not only track terrorists and their networks but also assess threats to U.S. critical infrastructures, biological and nuclear terrorism, pandemic diseases, threats to U.S. borders (air, land, and sea), and radicalization within U.S. society.

National Geospatial-Intelligence Agency

F-27. The National Geospatial-Intelligence Agency provides timely, relevant, and accurate geospatial intelligence to support national security objectives. Geospatial intelligence is the exploitation and analysis of imagery and geospatial information to describe, assess, and visually depict physical features and geographically referenced activities on the Earth. Geospatial intelligence consists of imagery, imagery intelligence, and geospatial information. (See JP 2-03)

F-28. Information collected and processed by National Geospatial-Intelligence Agency is tailored for customer-specific solutions. By giving customers ready access to geospatial intelligence, the National Geospatial-Intelligence Agency provides support to civilian and military leaders and contributes to the state of readiness of U.S. forces. This agency also contributes to humanitarian efforts such as tracking floods and fires, and keeping the peace. The agency ensures access to geospatial intelligence and provides tailored, customer-specific geospatial intelligence analysis, services, and solutions.

F-29. The National Geospatial-Intelligence Agency’s strategy supports operational readiness through a set of geospatial foundation data. These may include controlled imagery, digital elevation data, and selected information. This information is readily augmented and fused with other spatially referenced information such as intelligence, weather, and sustainment data. The result is an integrated, digital view of the mission space.

National Reconnaissance Office

F-30. The National Reconnaissance Office is the nation’s eyes and ears in space. The National Reconnaissance Office aims to establish a foundation for global situational awareness, and provide intelligence on timelines that is responsive to user needs.

F-31. To meet these goals, the National Reconnaissance Office—

Addresses new intelligence imperatives of present and future operational environments.

Shifts focus to producing value-added information and not increasing volumes of data.

Manages its systems as a single, integrated architecture focused on multidisciplinary solutions to intelligence problems.

Recognizes that its ground-based capabilities are as critical as collection in meeting the need for actionable intelligence.

Places equal priority and programmatic emphasis on the quick turnaround of support to intelligence and defense users as it does on long-term system acquisition.

F-32. The National Reconnaissance Office collaborates closely with National Security Agency/Central Security Service, National Geospatial-Intelligence Agency, Central Intelligence Agency, U.S. Strategic Forces Command, and the Army, Navy, and Air Force, as well as other intelligence and defense organizations.

National Security Agency/Central Security Service

F-33. The National Security Agency/Central Security Service is the nation’s cryptologic organization that coordinates, directs, and performs highly specialized analysis to produce foreign intelligence to protect U.S. information systems. A high technology organization, the National Security Agency/Central Security Service is at the forefront of communications and information technology. The National Security Agency/Central Security Service is also one of the most important centers of foreign language analysis and research in the U.S. government.

F-34. The National Security Agency/Central Security Service has two strategic missions that relate to site exploitation signals intelligence and information assurance. Signals intelligence is the exploitation of foreign signals for national foreign intelligence and counterintelligence purposes. Information assurance is the protection of the U.S. intelligence community and allied information through technical solutions, products, and services, and defensive information operations.

F-35. The National Security Agency/Central Security Service has remained agile and responsive to an increasingly dynamic set of customer demands. Terrorism, narcotics trafficking, organized crime, counterintelligence, and asymmetric threats are a few issues facing U.S. strategic interests. U.S. forces are often more involved in multinational warfare, regional conflicts, peacekeeping operations, and nontraditional operations. The rapid growth of global information technology makes the National Security Agency/Central Security Service’s missions of signals intelligence and information assurance more significant. To meet these emerging challenges, the National Security Agency/Central Security Service has embarked on an ambitious strategy to increase its agility with a service-based architecture that includes a reengineered cryptologic system that provides interoperability and connectivity with its customers. This mandate for change firmly establishes signals intelligence and information assurance as major contributors to information superiority for U.S. warfighters and decision makers.

Armed Forces Intelligence Organizations

F-36. Each branch of the U.S. Armed Forces is staffed with an intelligence capability tailored to accomplish the mission. Although some overlap in common capabilities exists, each of the services has niche intelligence functions that provide answers to intelligence requirements levied by commanders in the field.

Army

F-37. The Army Deputy Chief of Staff for Intelligence is responsible for policy formulation, planning, programming, budgeting, management, staff supervision, evaluation, and oversight of intelligence, weather, and geospatial activities for the Department of the Army. The Deputy Chief of Staff for Intelligence also exercises staff supervision over the United States Army Intelligence and Security Command and the 650th Military Intelligence Group. The Intelligence and Security Command provides intelligence support to strategic and operational level commanders in the areas of geospatial intelligence, measurement and signature intelligence, signals intelligence, tactical and strategic human intelligence, counterintelligence, information operations, and general military, scientific, and technical intelligence. Intelligence and Security Command elements include the National Ground Intelligence Center (production of all-source intelligence), the 902nd Military Intelligence Group (counterintelligence), the Army Operations Group (human intelligence), 1st Information Operations Command, and theater military intelligence brigades (multidiscipline collection and analysis).

F-38. The National Ground Intelligence Center’s mission is to produce all-source analysis for biometrics to on-the-ground individuals and provide training for deploying units. National Ground Intelligence Center works closely with Armed Forces DNA Identification Laboratory and the Federal Bureau of Investigation’s Terrorist Explosive Device Analytical Center on disseminating the information into an operational area to make available matches. The National Ground Intelligence Center’s operational support mission also includes weapons technical intelligence, biometrics-enabled intelligence, and forensic-enabled intelligence for DOD and national customers.

F-39. The National Ground Intelligence Center’s Combat Incident Analysis Division is the Army’s Center of Excellence for attack scene investigation and battlefield vehicle forensics. The Combat Incident Analysis Division investigates and analyzes all attacks on U.S. vehicles worldwide in order to identify the weapon used, its lethal effects, and the enemy tactics, techniques, and procedures. The Combat Incident Analysis Division then recommends measures to mitigate U.S. vehicle vulnerabilities and protect U.S. personnel. Commanders leverage the Combat Incident Analysis Division’s unique reachback capabilities to provide feedback on the data and materiel provided by the unit.

F-40. The Combat Incident Analysis Division trains Soldiers in attack scene investigation and battlefield vehicle forensics before their deployment. Upon the completion of their training, these Soldiers provide the commander with the ability to determine what the threat used in the attack based on the materiel recovered at the scene.

Marine Corps

F-41. Within Marine Corps doctrine, intelligence is considered as the foundation on which the operational effort is built and the premise on which all training, doctrine, and equipment are developed. Intelligence encompasses the policy, planning, direction, collection, processing, dissemination, and use to meet Marine Corps missions in maritime, expeditionary, land, and air warfare.

F-42. The Marine Corps participates in three component programs of the National Intelligence Program:

The Consolidated Cryptologic Program.

The Foreign Counterintelligence Program.

The General Defense Intelligence Program.

F-43. The Consolidated Cryptologic Program funds the majority of Marine Corps participation in the National Security Agency/Central Security Service activities worldwide. The Foreign Counterintelligence Program provides Marines to the Naval Criminal Investigative Service for counterintelligence activities. The General Defense Intelligence Program funds Marine Corps participation in the Defense Human Intelligence Service, combatant command staff, and manning of the Joint Intelligence Center, Joint Analysis Center, and Defense Intelligence Agency-distributed production functions of the Marine Corps Intelligence Activity.

Navy

F-44. The Navy’s intelligence organization is known as the Office of Naval Intelligence. It supports a variety of missions including U.S. military acquisition and development, counterterrorism, counterproliferation, counternarcotics, customs enforcement, and through partnerships and information-sharing agreements with the U.S. Coast Guard and U.S. Northern Command, Homeland Security, and Homeland Defense.

F-45. The Navy’s cryptologic professionals, who form the maritime component of the Unified Cryptologic System, are integrated with the Navy’s warfighting organizations, from major combatants to fleet command staffs. This integration includes Navy and national cryptologic field locations worldwide.

F-46. The mission of the Naval Criminal Investigation Service is to provide investigation and intelligence services and forensic support through major crime scene response teams and consultant programs. The Naval Criminal Investigation Service is experienced in crime scene processing.

Air Force

F-47. Air Force intelligence provides the nation with technical collection against foreign ballistic missile development using a global network of airborne, shipborne, and ground-based collectors. The Air Force is the executive agent for technical analysis of opponent aircraft, long-range ballistic missiles, and space-based technologies. Air Force intelligence, surveillance, and reconnaissance provides persistent surveillance, available worldwide and on demand, providing an unmatched asymmetric advantage. The Air Force achieves these capabilities by increasing its investment in measurement and signatures intelligence to identify threats.

Coast Guard

F-48. The Coast Guard is a military, multi-mission, maritime service within the Department of Homeland Security. Coast Guard missions are accomplished in any maritime region in which maritime interests are at risk, including international waters and U.S. coasts, ports, and inland waterways.

F-49. Because the Coast Guard employs unique expertise and capabilities in the maritime environment—in domestic ports, coastal waters, offshore regions, and foreign ports, where other U.S. government agencies typically are not present—the opportunity exists to collect information that supports not only Coast Guard missions, but other national security objectives as well.

F-50. The Coast Guard’s Intelligence and Criminal Investigations Program includes its National Intelligence Element, the Criminal Investigations Service, the Counterintelligence Service, and the Cryptologic Service. Its mission is to direct, coordinate, and oversee intelligence and investigative operations and activities that support all Coast Guard objectives by providing actionable (timely, accurate, and relevant) intelligence to strategic decision makers, as well as operational and tactical commanders. The Coast Guard’s Intelligence and Criminal Investigations Program also supports the National Strategy for Homeland Security and applicable National Security objectives.

F-51. The Coast Guard is the lead federal agency in maritime homeland security. Its role includes missions related to port security, search and rescue, maritime safety, counternarcotics, alien migration interdiction, living marine resources protection, and homeland security. The Coast Guard stands ready to protect the nation and provide unique intelligence to ensure that the ports, waterways, and coasts remain safe and secure.

Appendix G

Attack Scene Investigation

This appendix describes an attack scene investigation and provides information on how to conduct an attack scene investigation. The information in this appendix can be used by forensic analysts to determine the munitions type, country of origin, and weapons used in an attack. An attack scene investigation is not a criminal investigation, although it can later become one depending on whether the United States is enforcing the host-nation’s rule of law.

INTRODUCTION TO ATTACK SCENE INVESTIGATION

G-1. An attack scene investigation is a post-attack methodology for collecting forensic materiel at an attack scene, to include the area around targeted vehicles and any blast effects evident on the vehicle, personnel, or infrastructure. The investigation focuses on collecting attack-related material from the area surrounding the attack and the firing point. The materiel collected includes, but is not limited to, munitions fragments, projectiles, empty cartridge cases, ammunition packaging, casualty information, and explosive residue. Through attack scene investigation, the technical intelligence community can identify how the threat manufactures, employs, and targets vehicles belonging to friendly forces.

INITIAL ACTIONS

G-2. When arriving at the attack scene, personnel observe and collect information via photography, documentation, and sketches. Leaders ensure the attack scene is rendered safe by explosive ordnance disposal personnel before initiating an attack scene investigation. The team leader plans for and arranges security for the team. The team leader links up with the leadership on-site once vehicles are at the safe area.

PERSONNEL ACCOUNTABILITY

G-3. The team leader is responsible for knowing the location and status of personnel during each stage of the attack scene investigation. The team leader identifies and coordinates with the senior leader on-site and briefs the team on any variables that can affect the attack scene investigation. The team leader identifies the attack scene investigation enabling units on-site to include explosive ordnance disposal personnel, mortuary affairs, medical personnel, and security personnel and unique security procedures.

G-4. The team leader coordinates with the on-site commander and security force leader on what actions to take if attacked. Actions include locating team rally points for accountability purposes and providing team augmentation to the security force. The team leader obtains as much information as possible from personnel on-site concerning the incident requiring the investigation. The team leader records the unit name, contact information, and best method to contact the unit if additional information is required.

BEFORE COLLECTION

G-5. If the mission variables allow (mission, enemy, terrain and weather, troops and support available-time available and civil considerations), vehicle exploitation is conducted at the attack site. Detailed information recorded at the attack scene includes, but is not limited to—

Vehicle type.

Grid location and extent of damage to the vehicle.

The estimated location of the attack (site of the explosive detonation) relative to the vehicle body.

Authorized or unauthorized modifications to internal and external components.

Upgraded bar or slat armor and rocket propelled grenade net added to the vehicle.

Undercarriage type, such as V-hull or flat.

Conduct a Walk-Around

G-6. Personnel are outfitted in protective equipment such as protective disposable suits, boot-covers, gloves (heavy duty and lightweight), masks (with and without respirators), safety glasses, and hard hats before the investigation and before entering the area of the attack.

G-7. Explosive ordnance disposal personnel and the team leader conduct a walk-around. While taking precautions to avoid safety hazards, personnel walk around the perimeter of the attacked vehicle without taking pictures, mentally noting the location of debris and vehicle battle damage. (See figure G-1.)

Establish a Perimeter

G-8. The perimeter completely surrounds the point of impact. The perimeter includes access control points to limit access to the scene and to establish personnel and material accountability within the attack scene. The perimeter and access control points are marked with engineer tape, evidence tape, or rope, which creates a visual barrier around the attack scene.

G-9. There are several targets and multiple points of impact depending on the complexity of the attack. For example, a vehicle struck by a rocket-propelled grenade can continue in a forward motion for another 16 feet (50 meters) before stopping. A second vehicle, hit by a buried improvised explosive device, can remain at the point of impact. There are two areas to investigate for both of these vehicles, the point of impact and the location where each vehicle came to rest. Each vehicle is independently investigated when multiple vehicles are struck.

G-10. Perimeter and search area dimensions depend on the terrain at the attack scene. If time allows, an inner perimeter is established that extends 16.4 to 32.8 feet (5 to 10 meters) from the impact point, and an outer perimeter is established that is 164 to 328 feet (50 to 100 meters) from the inner perimeter. Generally, the majority of the weapons debris is located in the inner perimeter. (See figure G-2.)

G-11. The blast seat refers to the detonation point of an explosive device. The blast seat differs from the point of impact when a delayed fusing method is used. The point of origin of an explosive device may be in the outer perimeter or beyond when rocket propelled grenades, command detonated, or pressure-plate arming devices are used.

Designate a Collection Point

G-12. The team leader designates a primary collection point for all material collected at the attack scene to maintain accountability. A secondary collection point is sometimes necessary to support multiple incident sites.

PHOTOGRAPHS AND VIDEOS OF THE SCENE

G-13. Photographs and videos of the attack scene are essential for documenting the scene. Photographs and videos also supplement notes and sketches taken by investigators. Off-site, the photographs and videos help the technical analyst recreate the incident, examine the damage, and assess the facts.

G-14. Photographs and videos help investigators accurately record the attack scene before materiel is moved. Photographs and videos are necessary to create a visual record of the attack scene and the location of exposed debris. They are also used to supplement the initial reports already submitted about the scene and allow the forensic analysts to compare similarities in the results from other investigations.

G-15. Investigators taking photographs or videos need to wear appropriate personal protective equipment for their safety and to prevent any contamination of materiel. The materiel at the scene is photographed before it’s moved and collected. Photographers take long-range or panoramic photographs to document the entire scene. Midrange photographs show the point of impact, associated battle damage, explosive residue, and weapon components. Close-range photographs that fill the frame show additional details associated with the battle damage (such as spalling, fragments, and unique blast characteristics).

G-16. Photographs are taken of ingress and egress routes to the scene and identified points of origin, especially if they were likely access or exit locations. Photographs documenting materiel before collection include location and position of materiel in relation to other structures, objects, or bodies. After collection, photographs document the area underneath the evidence after it is removed. Photographs capture any items that appear out of place or any information that helps investigators understand the scene.

G-17. A ruler is used when photographing evidence to show scale of items. The ruler is placed on the same level, and as close as possible to the point of interest. A photograph taken of latent prints or impressions with a ruler allows enlargement of the photograph to the exact scale of the evidence, which enables one-on-one comparison.

G-18. Labels or markers used in photographs help identify materiel and the attack scene. The first photographs taken identify as much detail of the attack scene as possible and include an index card or white board marked with the date, grid, and name of the team leader.

G-19. The overall attack scene is photographed including the vehicle data plate, vehicle information, unit identification number, and bumper number. Damage to the vehicle is correlated back to the point of impact, when possible. The scene is photographed from each of the cardinal directions without damaging the integrity of the attack scene. Photographs are taken facing out from the point of impact, point of origin, if known, and towards the point of impact or blast seat.

COLLECTION

G-20. Materiel is collected once initial photos are taken and valuable items are identified. However, before collecting munitions-related items, personnel first ensure there are no explosive, incendiary, or chemical hazards present. When determining which items to collect, the attack scene investigation personnel note the purpose an item serves in the investigation such as ballistics, trace evidence, deoxyribonucleic acid (DNA), fingerprints, metallurgy, explosives residue, or origin. Personnel also determine the type of weapon system used.

G-21. Attack scene investigation personnel strive to prevent items from getting cross-contaminated and protect the integrity of the scene and collected materiel. Personnel conduct post-blast attack scene collection from the outward perimeter, to the epicenter, then to the point of impact. However, circumstances such as terrain, threat, and specific needs dictate the appropriate method.

G-22. If the mission variables allow, a grid or zone search method is used to identify, categorize, and map the attack scene to include the target of the attack (for example, personnel, vehicle, building) and the distribution of fragments resulting from the blast effects. The team documents and photographs each item as found within the grid or zone before moving them. Quality photographs and sketches are required so the technical exploitation personnel can isolate and identify details of the attack scene such as point of impact, location, scale, and weapon signatures, at the laboratory. Personnel collect as much materiel as time and the situation allows. When time is limited, the priority is to collect the debris associated with the explosion and weapon system components.

G-23. A ruler included in the photographs shows the size of items in regards to their relative distance and position from the blast seat or point of impact. Personnel record the position of items from a distance, showing the items’ relationship to the point of impact. Personnel gradually move towards items and take close-range photographs to document items as they are found. Personnel also carefully move towards the blast seat to photograph items as found. The investigators annotate the condition of items when found and note specific observations such as ballistic penetrations, perforations, and damage effects, and note all materials of possible intelligence value.

G-24. Attack scene related materiel is photographed at several angles. Photographs angles include the top and bottom of an item and side views so that the entire condition of an item is documented. Sketches, detailed photographs taken at a range of 10 feet (3 meters), and close-range photographs taken with a ruler enable analysts to better assess items of interest. A side view photograph that illustrates an item’s thickness is more important than top or bottom views for explosively-formed penetrator cores. A ruler photographed in close proximity to the item establishes scale and dimension. (See figure G-3 on how to photograph a three-dimensional object.)

EVIDENCE HANDLING PROCEDURES

G-25. Evidence collected at the attack scene maintains its value if it’s protected from cross contamination and has an established and unbroken chain of custody. The chain of custody documentation establishes the continuity of possession and is key to attacking the threat, especially when evidence is required in court.

G-26. Adhering to standing operating procedures when collecting, recording, marking items, and properly completing evidence submission forms is critical for maintaining chain of custody. When handling evidence, personnel first attach a locally prepared label or a self-adhesive DA Form 4002 on the evidence container, ensuring that they enter as much information on the form as possible. Packages are clearly labeled in legible handwriting before materiel is placed inside evidence containers.

G-27. The container or seal is labeled with the name or initials of the person who collected the materiel. The labels also include the date and time of collection, attack scene associated number or scene identifier (requires an identification and dissemination protocol), a brief description of the recovery location, and a warning of hazards present (for example, biohazard, sharp, fragile, inert).

G-28. Containers are sealed with approved tape or sealant and marked as evidence. Personnel package items in accordance with procedures for preserving the type of item, such as trace, residues, prints, chemical composition, and determining origin. Personnel prevent contamination of items by wearing gloves, protective suits, boot covers, and masks. While handling evidence, personnel continually control the attack scene to maintain the site’s integrity, which includes monitoring all persons working the scene.

G-29. The collected items are arranged at a collection point and photographed or videotaped together. Afterwards, collected items are assembled in an appropriate clean transport container, such as a laundry bag, garbage bag, storage box, or ammunition can, and transported to the appropriate collection point. The chain of custody documents remain with the items at each transfer point.

SPECIALIZED HANDLING TECHNIQUES

G-30. Delicate or sensitive evidence, such as fingerprints, ballistic materiel, trace evidence, DNA, oversized items, soil samples, fire-related items, and wet or moist items require specialized handling and collection techniques.

Fingerprints

G-31. Items containing possible fingerprints are handled on areas less likely to have prints. The item is secured in a box using zip ties to keep it from shifting during transport. The ties are placed on the item so that the prints are not disturbed.

Ballistic Materiel

G-32. Ballistic materiel is collected and packaged in plastic bags, plastic containers, or small evidence boxes.

Trace Evidence

G-33. Trace evidence is usually microscopic or semi-microscopic in nature, fragile, and easily lost or destroyed. Trace evidence is secured in sealed bags, cans with tight lids, or plastic containers with lids. Residue and trace evidence are collected by first swabbing, then sweeping, vacuuming, or by using a sticky-roller. Plastic bags containing trace evidence are sealed. Swabs are carefully returned to their original packaging and then sealed in a plastic bag.

G-34. Control samples are packaged separately from primary samples. Control samples allow the laboratory to establish the known properties of a material so that it is not mistaken for properties having forensic significance, also known as a negative control or blank.

Deoxyribonuceic Acid

G-35. DNA is generally collected using swabs. Swabs are returned into their original packaging then packaged in sealed envelopes.

Metal and Oversized Items

G-36. Generally, sturdy containers such as cans, plastic containers, or boxes are used for metal and oversized items because they are less likely to tear or break.

Soil

G-37. Soil samples are collected in glass or plastic vials or plastic bags. Residue is kept in a plastic bag or container with an airtight seal.

Fire-Related Items

G-38. Accelerants, combustible liquids, or related chemicals need to be isolated by placing them in a sealed, unlined can. Lined cans are not used for packaging fire-related items because they can contain petroleum-based chemicals that may affect the results of the item of interest. Fire debris is often wet, which can result in mold growth. Wet fire debris is taken to the laboratory as soon as possible before mold has an opportunity to grow and cause contamination to evidence. Fire debris is not air dried.

Wet or Moist Materiel

G-39. Wet or moist materiel kept in sealed containers is susceptible to mold and putrefaction, resulting in rapid deterioration of the materiel’s value as evidence. Wet items are placed in paper bags, which allows them to air dry. Larger or soaked items are dried in makeshift open-air dryers. Kraft paper placed under the items collects any debris or particles that break or fall off.

EXPLOSIVE RESIDUE COLLECTION

G-40. A post-blast survey of the scene discloses the overall damage, presence and size of the crater created by the blast, fragmentation patterns, and thermal changes. This information assists personnel in determining how to conduct materiel collection.

CAUTION

All explosive residue is collected in metal cans to prevent loss of volatile explosive residue. Materiel is secured in the container if the possibility of fingerprints is present. Debris is collected even if there is uncertainty that it has value as evidence.

G-41. Explosive residue is always present at the scene of an explosion. Even a partial detonation leaves remnants of high explosive residue. Vertical surfaces such as light poles, signs, and building facades, which are close to blast seat but just outside the fireball, are excellent collection points for residue. Swabbing collection efforts are more productive if conducted where witness materiel is present. When collecting explosive residue, safety is a priority.

G-42. Personnel work from the outside to the inside of the search area. Explosive fillers are collected by sweeping or scooping the area of the blast seat. An explosion yields unconsumed particles that are sent to a laboratory for identification. Explosive fillers are packaged in sealed metal cans. Recovered fragments of the bomb casing or an improvised container yields tool marks, tape, latent prints, and unique manufacturing techniques that are used to identify the origin of the device.

G-43. Fragments are collected and secured in metal cans to prevent movement of the fragments during transport. Explosive components such as batteries, timers, wires, switches, and concealment materiel are collected and then placed in plastic bags or cans.

G-44. Wet or charred documents are allowed to air dry. Because of their delicate nature, wet and charred documents are handled as little as possible and are not separated. Once dry, they are placed in a sturdy cellophane or plastic cover. They are securely packaged to prevent further movement, which can destroy prints or other contents.

G-45. Cigarettes used as a time delay element on explosive and incendiary devices provide leads on device construction and initiation, latent prints, and DNA. Tape and adhesives found on recovered materiel is left intact. Materiel is hand delivered whenever possible. (See table G-1 on page G-8 for guidelines on collecting explosion residue.)

CRATER DATA COLLECTION

G-46. Measurements and data are collected for craters present. Accurate crater measurements are of critical importance. Soldiers are required to know what and how to measure craters. Rulers and tape measures are the preferred means of making physical measurements of a crater. Items with unknown or non-standard dimensions are not acceptable for use as a length scale. (Refer to FM 3-09.12, appendix B, for additional information on crater analysis and reporting.)

G-47. Crater measurements are made as described in the National Ground Intelligence Center’s Post-Blast Crater Collection and Analysis Guide, using the critical crater measurement procedure or deliberate crater measurement procedure. Figure G-4 is a checklist of measurements for crater data collection.

G-48. The recommended items and tools for conducting crater data collection at an accident scene investigation include—

Digital camera.

Hammer.

Shovel.

Two stakes or rods for holding string line 2 to 3 feet (0.7 to 1 meter) in length.

Cloth or reel tape measure, 12 feet (4 meters) or surveyor’s rope.

Tape measure, National Stock Number 5210-00-182-4797, 12 feet (3.65 meters).

Tape measure, National Stock Number 5210-01-139-7444, 25 feet (7.62 meters).

Composite folding ruler.

Multiple folding ruler, National Stock Number 5210-00-293-3393, 6 feet (1.82 meters).

Nylon string.

Reference flags (or non-metallic markers).

Critical crater measurement checklist.

Sealable plastic bags, 1-quart size.

G-49. Upon arrival at the scene of an explosive event in which a crater was formed, there are steps personnel need to perform in as much detail as possible, given the time and location limitations. This work is conducted only after the scene is cleared and rendered safe for investigation. A size reference such as a ruler or other object of known length is included in all photographs. Photogrammetry, the science of making reliable measurements by the use of photographs and overhead photographs, relies on a known standard in the photograph to establish the actual dimensions and location of an object in a photograph. Photographs are taken of the crater from multiple angles before walking on or otherwise disturbing the crater. At least one photo of the overall crater is taken from an elevated position (for example, from the top of a vehicle). (See figure G-5.)

G-50. Additional data about the crater is also recorded. Personnel note the presence of a target vehicle and type. If possible, a sketch or notes are made of the location of detonation relative to the underside of the vehicle (for example, under the left wheel or centered under the vehicle rear). Alterations to the crater shape due to vehicle removal are noted. Also noted are the presence and thickness and type of pavement and if the weapon or explosive charge detonated in a culvert.

G-51. If the explosive event occurs on a paved roadway, the type and thickness of the pavement is noted, as well as the type and thickness of any subgrade material (for example, crushed rock or gravel). For concrete pavement, the presence of any reinforcing steel or wire mesh is noted. If the roadway is not paved, then the type and thickness of the gravel and rock surface is measured. (See Figure G-6.)

CONDUCT EXPEDIENT CRATER MEASUREMENTS

G-52. Expedient crater measurements consist of the apparent crater diameter and depth and the lip-to-lip diameter, which are the minimum measurements needed to provide an estimate of the effective net explosive weight value. The goal is to obtain the minimum amount of measurements required to estimate the explosive net equivalent weight with reasonable accuracy.

G-53. This collection procedure takes approximately five minutes for two people to complete. The apparent diameter, apparent depth, and lip-to-lip diameter are used for an initial estimate of the estimated net explosive weight. A and B indicate matching heights of a string line outside of the crater. A₁ and B₁ indicate heights of the string lines inside the crater lip and match A and B, respectively. (See Figure G-7.)

Note. Personnel enter the crater in a manner that will not disturb the crater profile beneath the string line.

STEPS TO ESTABLISHING EXPEDIENT CRATER MEASUREMENTS

G-54. There are eight steps, ordered in a logical progression, for establishing the expedient crater measurements.

Step 1. Establish Crater Dimensions

G-55. Reference poles are placed on undisturbed ground at least 12 inches (0.3 meters) beyond visible signs of disturbance related to the explosive event. (See figure G-8.)

Step 2. Establish Reference Data Points

G-56. The two reference poles are connected using a string line set parallel to the ground surface. (See figure G-9.)

Step 3. Measure for A

G-57. The measurement for A is made from the natural ground surface to the string line outside the crater profile near reference pole 1. Measurements are recorded to the nearest 0.5 inch (10 millimeters). The string line is set approximately 12 inches (0.3 meters) above ground surface. This point is marked with a flag marker. The vertical measurement for A is recorded. (See figure G-10.)

Step 4. Measure for B

G-58. The measurement for B is made from the natural ground surface to the string line outside the crater profile near reference pole 2. The measurement is recorded to the nearest 0.5 inch (10 millimeters). The string line height is adjusted at B to match the measurement at A. This point is marked with a flag and recorded as the vertical measurement for B. (See figure G-11 on page G-14.)

Step 5. Measure for A₁

G-59. A₁ is determined by measuring inside the crater lip at the point nearest reference pole 1 and has the same vertical measurement as A. This point is marked with a flag and labeled as A₁. The vertical distance from this point to the string is measured and recorded. (See figure G-12.)

Step 6. Measure for B₁

G-60. B₁ is determined by measuring inside the crater lip at the point nearest reference pole 2 and has the same vertical measurement as B. This point is marked with a flag and labeled as B₁. The horizontal distance between points A₁ and B₁ are measured and recorded as apparent crater diameter M. (See figure G-13.)

Step 7. Measure for L

G-61. L is determined by first locating the highest point of the crater lip closest to reference pole 1. This point is marked with a flag. Next, the highest point of the crater lip closest to reference pole 2 is located. This point is also marked with a flag. The horizontal distance between the two flags is measured as the lip-to-lip diameter and recorded as L. (See figure G-14.)

Step 8. Measure for D

G-62. D is determined by first identifying the lowest point of the crater (typically, but not always, near the center). This point is measured and recorded as D, the vertical distance from the string line to the lowest point of the crater (without digging out any soil). Steps 1 through 8 are repeated at a 90-degree angle from the first set of measurements, across the center of the crater (known as the secondary string line). (See figure G-15.)

ATTACK SCENE SOIL ANALYSIS

G-63. Soil samples are collected to determine the soil density and moisture content immediately after establishing the crater’s dimensions. Additionally, two soil samples are collected from the wall and slope of the crater at approximately mid-height. Approximately 3 to 6 inches (76 to 152 centimeters) of loose soil is scraped away from the wall of the crater to obtain a sample from the natural ground that has not been altered by the blast. For each sample, 3 to 4 cups (24 to 32 ounces) of soil is collected and sealed in a plastic bag, and then either double-bagged or stored in a sealable container. The sample size obtained from each layer nearly fills a quart-sized (32-ounce) container. Typical collection containers include sealable freezer bags, evidence bags, or plastic jars.

G-64. If obvious and distinct layers of soil are noted along the crater slope, samples are collected from each layer and labeled to identify the layer from which they were removed. The depth of each layer is recorded in relation to the bottom of the crater. All sample layers and depths, relative to crater depth, are identified with the sample number. (See figure G-16.)

SOIL DENSITY

G-65. Table G-2 provides guidelines on how to determine soil density.

Table G-2. Soil density estimation criteria

Relative Density of Soil | Soil Resistance to Shovel or Rod
Loose | Can push shovel into soil by hand. Can easily penetrate with 0.5-inch (1.27-centimeter) diameter reinforcing rod by hand.
Medium | Must exert pressure with foot to advance shovel. Can penetrate more than 6 inches (15.24 centimeters) with a 0.5-inch (1.27-centimeter) steel reinforced rod by using a hammer.
Dense | Must chisel with shovel or use a pick. Can penetrate only a few inches with 0.5-inch (1.27-centimeter) reinforcing rod driven with a hammer.

SOIL WATER CONTENT ASSESSMENT

G-66. Soil water content is assessed by collecting samples with a shovel. Water content evaluation is conducted on-site before the samples dry. Table G-3 provides criteria to determine the soil’s water content. (See figure G-17 on page G-18 illustrating the appearance of soil samples with varying water content.)

Table G-3. Water content estimation criteria

Soil Condition | Water Content Estimation Criteria
Dry | Soil is dry to the touch, dusty, displays a clear absence of moisture. Dry clay particles will not stick together.
Moist | Soil is damp, slight moisture, no visible water. Moist clays tend to stick together.
Wet | Soil is clearly wet, water is visible when squeezed, visible free water. Wet clays have a shiny appearance.

IDENTIFYING SOIL TYPES

G-67. Soil samples are identified by visual inspection and characterized as one of six soil types:

Gravel.

Sand.

Intermediate gravel.

Intermediate sand.

Silt.

Clay.

G-68. These soil types are simplified soil material types. The flowchart in figure G-18 provides a means of selecting the proper soil type for each sample.

G-69. Allowing the soil sample to dry facilitates accurate identification of the soil type. The sample is separated into individual particle sizes once it has dried. A wood pestle, or wooden handle of a hammer, and a coffee cup are used to break down the soil sample. The pestle is used to tamp and grind the soil against the sides of the cup using a circular motion. This action breaks the clumps of the soil and separates the soil particles for easy identification. This step is important for proper soil identification because hard chunks of dry soil are easily mistaken for rock. (See figure G-19.)

Gravel

G-70. Gravel consists of more than 90 percent coarse pea-sized particles or larger. Less than 10 percent of gravel consists of fine-grained particles. Figure G-20 illustrates the scale and appearance of gravel.

Sand

G-71. Sand consists of more than 90 percent of course rock salt-sized particles or smaller. Less than 10 percent of sand consists of fine-grained particles. Figure G-21 illustrates the scale and appearance of sand.

Intermediate Gravel

G-72. Intermediate gravel consists of 50 to 90 percent of coarse pea-sized particles or larger, with the remainder consisting of fine particles. Figure G-22 illustrates the scale and appearance of intermediate gravel.

Intermediate Sand

G-73. Intermediate sand consists of 50 to 90 percent of coarse rock salt-sized particles or smaller with the remainder consisting of fine particles. Figure G-23 illustrates the scale and appearance of intermediate sand.

Silt

G-74. Silt consists of less than 50 percent coarse-grained particles. Classification of silt is determined by its stickiness. Figure G-24 illustrates the scale and appearance of silt.

Clay

G-75. Clay consists of less than 50 percent of coarse-grained particles. Clay soil sticks together when wet and has the consistency of modeling clay. Classification of clay is determined by its stickiness. Figure G-25 illustrates the scale and appearance of clay.

FINGER TEST

G-76. The finger test is one method of determining if soil has a coarse or fine consistency. A finger test is done by sifting a small amount of the soil sample between the fingers. If particles are detected, the soil is classified as coarse. If the soil has a powder-like or flour consistency, it is classified as fine. Figure G-26 illustrates how the finger test is used to determine the difference between coarse and fine soil.

SEDIMENTATION TEST

G-77. Another test used for distinguishing fine or coarse soil is the sedimentation test. Approximately 4 ounces (113 grams) of soil is placed in a transparent container, such as a jar. The jar is filled with clean water and stirred or shaken vigorously for 10 to 20 seconds. The jar is left to sit for 30 seconds to allow the soil to settle. Sand and gravel, which is considered as coarse material, settles to the bottom of the jar after 30 to 40 seconds. Silt and clay, which is considered as fine material, remains suspended in the water for several minutes. The soil that settles at the bottom of the jar is used to estimate the percentage of coarse particles in the sample. If the settled soil is difficult to see due to the cloudiness of the water, the dirty water is poured out of the jar without pouring out the solids at the bottom. Dark and cloudy water is usually an indicator of fine material. (See figure G-27 on page G-22.)

CLAY AND SILT IDENTIFICATION TEST

G-78. A clay and silt identification test is used to distinguish if a soil sample is clay or silt. This test is performed by adding a small amount of water to the soil sample. The water is worked into the soil by mixing, squeezing, and rolling the soil. The condition of the soil is observed after all the water is absorbed by the soil. If the soil feels sticky and forms a clump or tubular shape and most of the soil remains intact, the soil is predominately clay. If all or most of the soil breaks apart, the soil is predominately silt. If the result is not immediately known, the soil is worked through the hands further. Clay tends to stick and hold together, while the silt tends to break apart.

ATTACK SCENE CLOSURE

G-79. The attack scene investigation leader determines when the attack scene investigation is complete. The investigation leader releases control of the site to the security force commander before departing the scene. The security force commander has the option to—

Secure the site.

Conduct a site exploitation.

Act in accordance with orders from higher authorities.

Transfer control of the scene to the host nation.

Abandon the site and continue with the mission.

G-80. The tasks completed before departure include—

Accounting for all personnel.

Accounting for sensitive items before loading the vehicle.

Ensuring items are protected from environmental conditions.

Packing fragile items so they are well padded and marked as fragile on the outer packaging.

Ensuring items are secured before movement.

Ensuring evidence containers, boxes, and crates are sealed.

Identifying the best method for reporting items from the attack scene investigation.

Verifying the location of where to bring items (per operations order, as planned).

Establishing communication with the receiving unit or section.

Generating a DA Form 4137.

Verifying recovered item inventories and chain of custody documents.

Completing a DD Form 2922, if required.

Transporting items recovered during the attack scene investigation to the designated facility.

Physically delivering and signing over any items of evidentiary value to the appropriate exploitation facility.

Generating and disseminating a detailed after action report to higher headquarters.

Ensuring information gleaned from collection and exploitation is disseminated.

CHAIN OF CUSTODY

G-81. Documentation is completed as soon as possible. Descriptions of items match what is recorded on the evidence label and collection list. Unique markings and identifiers concerning individual descriptions are also included. Custody and transfer signatures are kept in sequential order. Purpose or reason for a change in custody is included in the documentation. A new chain of custody form is used when materiel is broken down into individual components. The original chain of custody document stays with the materiel. A copy of DA Form 4137, associated with each specific attack scene investigation file, is retained.

LABORATORY REQUEST FOR ANALYSIS

G-82. The laboratory is notified by radio, phone, or email of the intent to forward materiel for analysis. A DA Form 4137 is included with the signature of the person who released the materiel. If the materiel is sent by mail, the courier agency signs as receiving the materiel and includes the tracking number. The laboratory is notified of the courier’s tracking number. A storyboard or short description of the circumstance of the incident is included, which can assist the laboratory personnel in determining best testing procedures. DD Form 2922 is also attached. The receiving laboratory conducts an independent analysis of the materiel and provides an analysis report to the providing organization.

BATTLEFIELD VEHICLE FORENSICS

G-83. Battlefield vehicle forensics is a subset of an attack scene investigation. Battlefield vehicle forensics is conducted at the attack scene depending on mission variables or if the vehicle is transported to a safe location. Battlefield vehicle forensics is conducted at the attack scene because access to the vehicle is not always possible once it is recovered. A vehicle forensic investigation focuses on a battlefield damage assessment and detailed examination of the vehicle.

G-84. Battlefield vehicle forensic investigation procedures are standardized to ensure complete coverage of the vehicle and the surrounding terrain. Though vehicle exploitation is a subset of an attack scene investigation, it is key that no attempt is made to identify the weapon at the vehicle exploitation stage. Vehicle exploitation is mainly a forensic collection activity that supports forensic analysis.

G-85. Vehicle forensic investigation gives forensic analysts the ability to assess damage in relation to the attack. The vehicle exploitation team collects items in a manner that supports follow-up analysis at forensic laboratories. The vehicle exploitation team’s goals are to identify and collect primary and secondary damage effects to the vehicle and any additional damage associated with the attack. The team also aims to identify extraction damage (damage done during extraction of personnel) and recovery damage (damage done during vehicle recovery operations).

G-86. The initial search starts with the exterior of the vehicle and progresses to the interior of the vehicle. The vehicle exterior is checked for weapon signatures, weapon fragments, spalling, and armor debris. One search technique is to divide the vehicle into a grid and then record the battle damage sustained to each area. Forensic investigation personnel avoid focusing all their attention on the actual battle damage area, but instead focus on identifying and recording the damage on the vehicle.

G-87. When conducting vehicle exploitation, the vehicle exploitation team documents battle damage found on the vehicle using notes, sketches, and photographs. Collected fragments are measured and photographed in accordance with forensic collection and processing standards. Photographs, documents, physical fragments, and chemical swabs are properly packaged and marked in preparation for forwarding to the appropriate laboratory.

G-88. Conducting a thorough attack scene investigation requires personnel to accurately identify and record the incident. A sheet of paper is used to record the damage, date, location, unit attacked, vehicle type, identification number, and the names of all Soldier’s present when the vehicle was attacked. If possible, the vehicle at the site is photographed in as much detail as possible.

BATTLEFIELD VEHICLE FORENSIC INVESTIGATION SAFETY

G-89. Safety is critical during a vehicle investigation because vehicle exploitation teams often work with traumatized ammunition, chemical hazards such as acids, heavy and sharp unstable pieces of metal, toxic fumes, and biohazards. Safety protocols ensure safety of the personnel. A risk assessment allows personnel to determine the required protective equipment needed to conduct the vehicle inspection. Protective equipment includes personal protective equipment, specialized safety equipment, and sensors and test kits that identify toxic chemicals and materials, and biological and radiological hazards.

G-90. An explosive ordnance disposal technician conducts a visual clearance of the vehicle for explosive hazards before starting vehicle exploitation. The explosive ordnance disposal technician only moves vehicle debris and components as necessary to reveal areas where unexploded ordnance is hidden. Those explosive ordnance disposal technicians who come in contact with the vehicle have a spotter present who can watch for potential hazards.

G-91. After the vehicle is cleared for medium to large unexploded ordnance (approximately 1.57 inches [40millimeters]), the vehicle inspection team begins the vehicle inspection. If possible, explosive ordnance disposal technicians are present during the vehicle inspection. Vehicle inspections immediately cease if unexploded ordnance is encountered, and all non-essential personnel are evacuated to a designated safe area.

PHOTOGRAPHING DAMAGE FOR A BATTLEFIELD VEHICLE FORENSIC INVESTIGATION

G-92. Initial photographs for a battlefield vehicle forensic investigation procedure include the vehicle identification plate, registration number, and bumper number. The vehicle’s identification plates are generally located on the inside door panel or dashboard of the vehicle. Vehicle identification or registration numbers are generally located on the front, side, or rear of the vehicle. Other vehicle identifying marks are also documented with photographs. (See figure G-28.)

G-93. Several photographs taken of the attacked vehicle from several angles and ranges thoroughly document the vehicle damage. Photographs of the vehicle begin at the front, then clockwise or counter clockwise to capture all angles of the vehicle. The vehicle is photographed with the doors closed, if possible. Wide-angle photographs document the vehicle with the surrounding area. (See figures G-29 and G-30, and figures G-31 and G-32 on page G-26.)

G-94. Midrange photographs establish the location of damage on the vehicle and close-range photographs provide a clearer depiction of the damage and entry point on the vehicle. (See figures G-33 and G-34.)

G-95. If possible, the location of all crewmembers inside the vehicle at the time of the attack are identified. Additionally, circumstances may not allow personnel to obtain photographs of the front, left, right, and back sides of the vehicle. In this case, personnel take as many photographs of the vehicle as the situation allows. Using a ruler in the photographs gives an indication of the size of the impact of damaged areas and entry points. A known and easily identifiable scale is a 2-inch wide black and white checkerboard ruler with 1-inch squares. (See figure G-35.)

G-96. The shot path through the vehicle is photographed and marked using a string, rod, or similar item. While the rod is in place, an angle level finder is used to determine the angle of a shot path. Identifying the shot path of a projectile through and or in the vehicle assists experts in better understanding the events of the attack. (See figure G-36, and G-37 and G-38 on page G-29.)

G-97. Interior photographs also include wide-angle, midrange, and close-range photographs. A wide-angle photograph depicts the inside of the vehicle, which establishes overall condition and location of damaged areas. A midrange photograph establishes the condition of the interior and damage point. A close-range photograph captures damaged areas and any entry points on the interior of the vehicle. A scale is used to indicate size of impact or entry points. Photographs taken throughout the interior of the vehicle capture the overall scene. (See figure G-39.)

G-98. Next, photographs are obtained of any secondary damage using the same photography techniques used for documenting the exterior and interior vehicle damage. Several photographs are taken to completely document all the damage. Secondary damage includes—

Broken door hinges.

Bent or broken steering wheel.

Broken or cut seat belts.

Sheared bolts from flooring.

Damaged seat mounts, equipment, and shelving.

Breach of flooring.

Breach of walls.

Breach of doors.

Impact or exit points.

Blood splatter on ceiling, walls, or floors.

Internal equipment as projectiles.

G-99. If safe to do so, the undercarriage of the vehicle is photographed to document—

Blast patterns.

Trajectory.

Impression markings.

Unusual color washing or splashing on strike areas.

Unusual odors, such as chemicals or fuel, on assessment forms or documentation.

MATERIEL TRANSFER

G-100. During materiel transfer, a chain of custody is maintained using both DA Form 4002 and DA Form 4137. Forensic materiel found while recovering remains are collected and bagged for transfer with the remains. During vehicle assessment, materiel having forensic value is photographed to clearly show its location. The materiel is then collected. Additional photographs are taken of the materiel, if necessary, before it is bagged. A DA Form 4137 is included in the bag of the item collected, and the appropriate agency is notified of the materiel.

G-101. Once vehicle exploitation collection is complete, items recovered are transported to a holding facility. The vehicle exploitation team inventories all items recovered from the vehicle and report on the items collected. Additionally, information gleaned from collection and or exploitation is disseminated and inserted back into the intelligence cycle.

Glossary

The glossary lists acronyms and terms with Army or joint definitions. Where Army and joint definitions differ, (Army) precedes the definition. Terms for which ATP 3-90.15 is the proponent are marked with an asterisk (*). The proponent publication for other terms is listed in parentheses after the definition.

SECTION I – ACRONYMS AND ABBREVIATIONS

ADP | Army doctrine publication
ADRP | Army doctrine reference publication
AR | Army regulation
ATP | Army techniques publication
DA | Department of the Army
DD | Department of Defense (forms)
DNA | deoxyribonucleic acid
DOD | Department of Defense
DODD | Department of Defense directive
FM | field manual
JP | joint publication
U.S. | United States

SECTION II – TERMS

biometrics

The process of recognizing an individual based on measurable anatomical, physiological, and behavioral characteristics. (JP 2-0)

exploitation

1. Taking full advantage of success in military operations, following up initial gains, and making permanent the temporary effects already created. 2. Taking full advantage of any information that has come to hand for tactical, operational, or strategic purposes. 3. An offensive operation that usually follows a successful attack and is designed to disorganize the enemy in depth. (JP 2-01.3)

forensic science

The application of multidisciplinary scientific processes to establish facts. Also called forensics. (DODD 5205.15E)

materiel

All items necessary to equip, operate, maintain, and support military activities without distinction as to its application for administrative or combat purposes. (JP 4-0)

preparation

(Army) Those activities performed by units and Soldiers to improve their ability to execute an operation. (ADP 5-0)

sensitive site

A geographically limited area that contains, but is not limited to, adversary information systems, war crimes sites, critical government facilities, and areas suspected of containing high value targets. (JP 3-31)

*site exploitation

(Army) The synchronized and integrated application of scientific and technological capabilities and enablers to answer information requirements, facilitate subsequent operations, and support host-nation rule of law.

threat

Any combination of actors, entities, or forces that have the capability and intent to harm United States forces, United States national interests, or the homeland. (ADRP 3-0)

References

All URLS accessed on 3 June 2015.

REQUIRED PUBLICATIONS

These publications must be available to intended users of this publication.

ADRP 1-02. Terms and Military Symbols. 02 February 2015.

JP 1-02. Department of Defense Dictionary of Military and Associated Terms. 08 November 2010.

RELATED PUBLICATIONS

These documents contain relevant supplemental information.

DEPARTMENT OF DEFENSE PUBLICATIONS

Most DOD publications are available online at http://www.dtic.mil/whs/directives/index.html.

DODD 2310.01E. DOD Detainee Program. 19 August 2014.

DODD 3115.09. DOD Intelligence Interrogations, Detainee Debriefings, and Tactical Questioning. 11 October 2012.

DODD 5205.15E. DOD Forensic Enterprise (DFE). 26 April 2011.

JOINT PUBLICATIONS

Most joint publications are available online at http://www.dtic.mil/doctrine/new_pubs/jointpub.htm.

JP 2-0. Joint Intelligence. 22 October 2013.

JP 2-01.3. Joint Intelligence Preparation of the Operational Environment. 21 May 2014.

JP 2-03. Geospatial Intelligence Support in Joint Operations. 31 October 2012.

JP 3-0. Joint Operations. 11 August 2011.

JP 3-31. Command and Control of Joint Land Operations. 24 February 2014.

JP 4-0. Joint Logistics. 16 October 2013.

ARMY PUBLICATIONS

Most Army publications are available online at http://www.apd.army.mil/.

ADP 5-0. The Operations Process. 17 May 2012.

ADRP 3-0. Unified Land Operations. 16 May 2012.

ADRP 3-90. Offense and Defense. 31 August 2012.

ADRP 5-0. The Operations Process. 17 May 2012.

ADRP 6-0. Mission Command. 17 May 2012.

AR 195-5. Evidence Procedures. 22 February 2013.

ATP 2-33.4. Intelligence Analysis. 18 August 2014.

ATP 2-91.8. Techniques for Document and Media Exploitation. 5 May 2015.

ATP 3-39.12. Law Enforcement Investigations. 19 August 2013.

ATP 3-90.37. Countering Improvised Explosive Devices. 29 July 2014.

ATP 5-19. Risk Management. 14 April 2014.

FM 2-22.3. Human Intelligence Collector Operations. 6 September 2006.

FM 2-91.6. Soldier Surveillance and Reconnaissance: Fundamentals of Tactical Information Collection. 10 October 2007.

FM 3-09.12. Tactics, Techniques, and Procedures for Field Artillery Target Acquisition. 21 June 2002.

FM 3-55. Information Collection. 3 May 2013.

FM 27-10. The Law of Land Warfare. 18 July 1956.

UNITED STATES LAW

Detainee Treatment Act of 2005. http://www.dni.gov/index.php/about/organization/ic-legal-reference-book-2012/ref-book-detainee-treatment-act-of-2005.

Intelligence Reform and Terrorism Prevention Act of 2004. http://www.gsa.gov/portal/content/178103.

OTHER PUBLICATIONS

National Ground Intelligence Center, Anti-Armor Analysis Program. Post-Blast Crater Collection and Analysis Guide. 4th Edition. 10 December 2014. Contact National Ground Intelligence Center to obtain a copy of this publication. https://www.inscom.army.mil/MSC/NGIC.aspx.

RECOMMENDED READINGS

These documents contain additional supplemental information.

DEPARTMENT OF DEFENSE PUBLICATIONS

Most DOD publications are available online at http://www.dtic.mil/whs/directives/index.html.

DODD 8521.01E. Department of Defense Biometrics. 21 February 2008.

JOINT PUBLICATIONS

Most joint publications are available online at http://www.dtic.mil/doctrine/new_pubs/jointpub.htm.

JP 3-15.1. Counter-Improvised Explosive Device Operations, 09 January 2012.

ARMY PUBLICATIONS

Most Army publications are available online at http://www.apd.army.mil/.

ADRP 2-0. Intelligence. 31 August 2012.

AR 75-15. Policy for Explosive Ordnance Disposal. 17 December 2013.

ATP 2-22.4. Technical Intelligence. 4 November 2013.

ATP 3-11.37. Multi-Service Tactics, Techniques, and Procedures for Chemical, Biological, Radiological, and Nuclear Reconnaissance and Surveillance. 25 March 2013.

ATP 4-32. Explosive Ordnance Disposal (EOD) Operations. 30 September 2013.

FM 3-34.210. Explosive Hazards Operations, 27 March 2007.

FM 7-15. The Army Universal Task List. 27 February 2009

OTHER PUBLICATIONS

National Science and Technology Council Subcommittee. Biometrics Glossary. 14 September 2006. Available online at http://www.biometrics.gov/Documents/Glossary.pdf.

WEB SITES

DOD Automated Biometric Information System. http://www.dote.osd.mil/pub/reports/FY2013/pdf/army/2013dodabis.pdf.

DOD Biometrics Project Management Office. http://www.eis.army.mil/programs/biometrics.

Universal Joint Task List. http://www.dtic.mil/doctrine/training/ujtl_tasks.pdf.

PRESCRIBED FORMS

None

REFERENCED FORMS

Unless otherwise indicated, DA forms are available on the Army Publishing Directorate web site at http://www.apd.army.mil/. DD Forms are available on the Office of the Secretary of Defense web site at http://www.dtic.mil/whs/directives/infomgt/forms/index.htm.

DA Form 2028. Recommended Changes to Publications and Blank Forms.

DA Form 4002. Evidence/Property Tag. (Available through normal forms supply channels.)

DA Form 4137. Evidence/Property Custody Document.

DD Form 2745. Enemy Prisoner of War (EPW) Capture Tag. (Available through normal supply channels.)

DD Form 2922. Forensic Laboratory Examination Request.

Index

Entries are by paragraph number.

A

analysis, higher headquarters order, 2-36

intelligence, in support of site exploitation, 1-50–1-54

link, 1-53

mission, 2-35–2-42

network, 1-54

pattern, 1-52

preliminary, 4-44–4-47

analyze, as core activity of site exploitation, 1-21–1-25

archiving, data , 1-41

assessment, criteria, 5-4–5-5 techniques, 5-1–5-3

assets, available for planning, 2-43-2-44

brigade support, 2-48–2-50

attack scene, ballistic materiel, G-32

battlefield vehicle forensics, G-83–G-101

closure, G-79–G-82

collection, G-5, G-20–G-24

crater data collection, G-46–G-62

evidence handling, G-25–G-39

fire-related items, G-38

investigation, G-1–G-101

personnel accountability, G-3–G-4

photographs , G-13–G-19

residue collection, G-40–G-45

walk-around and perimeter, G-6–G-12

wet materiel, G-39

B

battlefield vehicle forensics, G-83–G-101

materiel transfer, G-100–G-101

photography, G-92–G-99

safety, G-89–G-91

soil, G-37, G-63–G-78

biological material, collection techniques, A-80–A-82

biometrics , defined, 1-10

collection, advanced, C-68

Biometric-Enabled Watchlist, 2-55

building material, collection techniques, A-94

C

cache site, search techniques, A-33–A-36

chemicals , collection techniques, A-90

civilians, on-site, 1-55–1-59

collect, as core activity of site exploitation, 1-19

collection, activities, A-58–A-65

advanced evidence, C-67–C-82

attack scene, G-20–G-24

crater data, G-46–G-62

evidence, C-1–C-82

point, A-44–A-47

techniques, A-69–A-99

commander’s critical information requirements, 2-71–2-74

considerations, for effective site exploitation, 1-31–1-43

contamination, of materiel during collection, A-66–A-68

constraints, determined during planning, 2-65

core activities, of site exploitation, 1-16–1-30

prioritizing , 1-38

working together, 1-30

custodian procedures, A-102

D

DA Form 4137, A-100–A-101

decision points, and site exploitation planning, 2-6

deliberate site exploitation, 2-9–2-12

versus hasty site exploitation, A-50–A-53

deoxyribonucleic acid, See DNA

detection, as core activity of site exploitation, 1-18

dissemination, and information sharing, 1-40

as core activity of site exploitation, 1-26–1-29

information and intelligence, 4-68–4-74

DNA, analysis, 2-56, E-23

attack scene, A-35

evidence collection, C-73–C-75

documents, evidence collection, C-59

wet documents, C-76–C-77

drugs and narcotics, collection techniques, A-96

E

electronics and electronic media, as evidence, C-64–C-66

collection techniques, A-83–A-87

enablers, in support of tactical site exploitation, 2-51–2-64

environmental considerations, during tactical site exploitation, 4-64–4-67

evidence, advanced collection, C-67–C82

attack scene handling, G-25–G-39

collection, in support of host-nation rule of law, C-1–C-82

DNA, C-73–C-75

documents, C-59

documents, wet, C-76–C-77

electronic multimedia, C-64–C-66

explosive materiel, C-63

explosive testing, C-70–C-71

for host-nation courts, C-6–C-9

host-nation arrest form, C-54–C-56

importance of, C-1–C-5

labeling and tagging, C-78–C-79

latent fingerprints, C-72

physical, C-57–C-58

potential, C-10–C-12

transfer and chain of custody, C-80–C-82

weapons, C-60–C-62

exploitation, awareness, 1-42

chemical, biological, radiological, and nuclear material , 2-63

defined, 1-2

document and multimedia, 2-61–2-62

electronic, 2-58

explosive materiel , 2-60

mechanical, 2-59

explosives, as evidence, C-63 materiel, 2-60

residue collection at attack scene, G-40–G-45

testing, C-70–C-71

F–G–H

fingerprints, see latent prints

firearms, collection techniques, A-88–A-89

examination, 2-57, E-24

forensics, battlefield vehicle at attack scene, G-83–G-101

chemistry, E-26

defined, 1-7

DOD, E-1–E-30

exploitation team, E-19–E-20

functions, E-6–E-12

materiel, A-54–A-57

modalities, E-21

operational process, E-13–E-18

organic capabilities, E-27–E-30

forensic science, See forensics

hasty site exploitation, , 2-7–2-8

versus deliberate site exploitation, A-50–A-53

I

impressions, collection techniques, A-77–A-79

information and intelligence, dissemination, 4-68–4-74

information collection, in planning for site exploitation, 2-13–2-22

plan development, 2-75

information management, obtained from site exploitation, 1-39

information, materiel, and persons, prioritization of, 4-20–4-25

transfer of, 4-26–4-31

information sharing, and dissemination, 1-40

initial guidance, 2-33–2-34

intelligence, Armed Forces Intelligence Organizations, F-36–F-51

Central Intelligence Agency, F-11–F-12

Defense Intelligence Agency, F-15–F-24

Director of National Intelligence, F-7–F-10

National Geospatial-Intelligence Agency, F-27–F-29

National Reconnaissance Office, F-30–F-32

National Security Agency/Central Security Service, F-33–F-35

Office of Intelligence and Analysis, F-25–F-26

U.S., F-6–F-51

intelligence preparation of the battlefield, 2-37–2-39

interviews, suspect, C-49–C-53 witness, C-36–C-37

J–K–L

joint interagency, coordination group, F-3

task force, F-4–F-5

kits, baseline, B-1

enabler, B-2

latent prints, collection techniques, A-70–A-73

evidence collection, C-72

examination, 2-53–2-54

attack scene, G-31

materiel, ballistic, G-32

defined, 1-5

explosive, 2-60, C-63

forensic, A-54–A-57

transfer, G-100-101

wet, G-39

M–N–O

measures of effectiveness, 5-6–5-8

military decisionmaking process, 2-28–2-50

mission analysis, 2-35–2-42

mission command warfighting function, for effective site exploitation, 1-32

nested concepts, in site exploitation planning, 2-3

objective, actions on, 4-13

operational environment, and site exploitation, 1-44–1-59

P

pace, of site exploitation, 1-37

paint, collection techniques, A-95

paper, documents, and drawings, collection techniques, A-99

photography, attack scene, G-13–G-19

battlefield vehicle forensics, G-92–G-99

documentation, C-16–C-29

techniques, A-15–A-24

planning, commander’s critical information requirements, 2-71–2-74

concepts, 2-1–2-79

constraints, 2-65

courses of action development, 2-77–2-79

critical facts and assumptions, 2-66

information collection plan, 2-75

mission, 2-76

nested concepts, 2-3

risk assessment, 2-67–2-70

roles, 2-23–2-27

techniques and preparation of tactical site exploitation, A-10–A-12

preparation, defined, 3-1

for tactical site exploitation, 3-1–3-9

preservation , of life for effective site exploitation, 1-33-1-35

of materiel, 1-36

of site and materiel, 4-37–4-38

prioritization, of site exploitation activities, 1-38

process, as core activity of site exploitation, 1-20

Q–R–S

questioning, voluntary, 4-26–31

techniques, A-103–A-113

receipt of mission, 2-29

reporting, techniques, 4-50–4-51

risk, assessment during planning, 2-67–2-70

awareness during planning, 2-68

awareness in site exploitation, 1-34

management, 2-70

running estimates, 2-30–2-32

search, conducting, 4-14–4-17

personnel, 4-26–31

techniques, A-27–A-32

techniques for cache site, A-33–A-36

sequencing, in site exploitation planning, 2-4–2-5

sketches, techniques, A-25, C-30–C-33

site, civilians located on, 1-55–1-59

control transfer, 4-39–4-43

key activities , A-40–A-41

location of, 4-8

processing, A-42

protection of, 4-9

security, A-37–A-39

tasks , C-13–C-15

walk-through, A-43

site exploitation, archiving data, 1-41

assessment, 5-1–5-8

civilians, 1-55–1-59

considerations, 1-31–1-43

core activities , 1-16–1-30

definition of, 1-1

deliberate, 2-9–2-12

discussion of tactical site exploitation and technical exploitation, 1-8–1-15

hasty , 2-7–2-8

hasty versus deliberate, A-50–A-53

in support of unified land operations, 1-49

information collection, 2-13–2-22

information management, 1-39

information sharing and dissemination, 1-40

intelligence analysis , 1-50–1-54

introduction to, 1-1–1-30

maintaining risk awareness, 1-34

materiel preservation, 1-36

military decisionmaking process, 2-28–2-50

mitigating threats, 1-35

operational environment, 1-44–1-59

pace, 1-37

planning concepts, 2-1–2-12

preservation of life, 1-33–1-35

prioritization, 1-38

scalability and modularity of, 1-43

support, F-1–F-51

soil, attack scene analysis, G-63–G-78

attack scene collection, G-37

soils and minerals, collection techniques, A-92

standing operating procedure, A-1–A-113

statements, witness, C-38–C-46

host-nation police, C-47–C-48

suspects, interviews, C-49–C-53

T–U–V

tactical site exploitation, assessment, 4-32–4-36

considerations, 4-1–4-5

discussion of, 1-8–1-15

enablers, 2-51–2-64

environmental considerations, 4-64–4-67

execution of, 4-1–4-74, A-13

kit, baseline, B-1

kit, enabler, B-2

planning and preparation techniques, A-10–A-12

post activities, A-14

preparation, 3-1–3-9

reporting, 4-50–4-52

search, 4-14–4-17

seizing items, 4-18–4-19

standing operating procedure, A-1–A-113

team and responsibilities of, A-3–A-9

techniques, 4-6–4-52

tape, collection techniques, A-98

tasks, specified, implied, and essential, 2-40–2-42

technical exploitation , discussion of, 1-8–1-15

information obtained from, 4-62–4-63

techniques, 4-53–4-61

threat, defined, 1-4

mitigation during planning, 2-69

mitigating for effective site exploitation, 1-35

tobacco, collection techniques, A-91

tools, collection techniques, A-93

mark examination, 2-57, E-24

trace material, collection techniques, A-74–A-76

attack scene, G-33–G-34

transportation, 2-52, E-22

unified land operations, in support of site exploitation, 1-49

W–X–Y–Z

walk-through, final, A-48–A-49

initial, A-43

weapons, as evidence, C-60–C-62

cache checklist, D-1–D-3

collection techniques, A-88–A-89

wires, rope, and cord, collection techniques, A-97

witnesses, C-34–C-46

interviews, C-36–C-37

statements, C-38–C-46

ATP 3-90.15

28 July 2015

By order of the Secretary of the Army:

RAYMOND T. ODIERNO
General, United States Army
Chief of Staff

Official:

GERALD B. O’KEEFE
Administrative Assistant to the
Secretary of the Army
1519401

DISTRIBUTION:

Active Army, Army National Guard, and United States Army Reserve: Distributed in electronic media only (EMO).