U.S. Army TRISA Threat Tactics Report: Islamic State of Iraq and the Levant

The following report is part of a series produced by the TRADOC G-2 Intelligence Support Activity (TRISA) Complex Operational Environment and Threat Integration Directorate (CTID).  While the reports contain no control markings, they are not released publicly.


TRISA-CTID Threat Tactics Report: ISIL

  • 30 pages
  • July 2014


The Islamic State of Iraq and the Levant (ISIL) has risen to prominence as a danger to peace and a regional threat with global impact. This perception comes, in large measure, because of its successes in Syria and then a rapid takeover of northern Iraq. Its military victories are largely due to successful recruiting, intra-insurgent conflict, large cash reserves, and ineffective opponents. There is much to learn from how ISIL is fighting. The ready availability of recruits, many of whom are foreigners attracted to ISIL successes, and large amounts of money for payroll and purchasing war materiel are critical considerations, but it is also important to consider how ISIL is fighting on the ground.

This report is intended to identify key aspects of tactics and techniques used in ISIL’s actions in Iraq and Syria. ISIL, unlike its predecessors and competitors, is a paramilitary insurgency. While the baseline techniques being used by ISIL do not differ significantly from those it has employed since its early days as an al-Qaeda affiliate in Iraq, its capabilities have increased in scope and complexity. Techniques making use of suicide vehicle-borne IEDS (SVBIED) and vehicle-borne IEDs (VBIED) have become more sophisticated. ISIL’s use of information warfare (INFOWAR) has become more refined and pervasive with the adaptation of social media technology and increased technical competency among recruits. ISIL has targeted infrastructure such as dams, oil refineries, and power plants for use in population control and financing. ISIL has also demonstrated the ability to execute military tactics that require a level of competence and control uncommon in recent experience.

Executive Summary

• ISIL is an evolution of an insurgent group that has changed its name to reflect an increasing geographic vision.
• ISIL’s advantage to date has been an increasingly large number of fighters and deep cash reserves to fund its operations. This provides greater capacity to organize, train, and equip like a military organization.
• ISIL executes military tactics to the best of its capability. This is a greater capability than that shown by previous insurgencies in the area, but still not best practice in a number of warfighting functions and key tasks.
• High value targets for ISIL have included such infrastructure as dams and oil refineries, which also contribute to its cash flow.
• Social media use has reached a new level of refinement as ISIL has capitalized on Western recruits’ language skills and a new generation of technically savvy apprentices.

Command and Control

Abu Bakr al Baghdadi, the ISIL-appointed caliph, governs through a bureaucratic organization that includes close advisors and specialty, regional, and local councils. Al Baghdadi requires a theologically-based pledge of loyalty and fealty. Until recent US airstrikes, ISIL had relatively unfettered movement capabilities along a corridor spanning northern Syria and Iraq. Command and control under these circumstances did not require the kinds of considerations now necessary with the US airstrikes targeting ISIL communication nodes. The use of couriers is likely to become an important part of communicating to ISIL’s network of fighters.
ISIL’s growth has come from its ability to coopt, dominate, or absorb competitor organizations. Some of these organizations may only be fair-weather friends and leave the coalition when the time is deemed right. There is a very real chance that ISIL leadership will lose control through splintering and infighting. With a varied and diverse demographic of foreign fighters, Sunni tribes, former Baathist leaders, etc., the challenge for ISIL will be controlling both the message and the fight.

A key element of ISIL’s command and control infrastructure is social media. During the attack on Mosul, for example, ISIL sent tens of thousands of tweets in a way that avoided the Twitter spam trigger. While social media companies are constantly identifying and deleting questionable accounts, it is easy to simply open a new account. A new, tech-savvy generation of jihadists opens up new means of communicating to vast audiences for recruiting, propaganda, and bureaucratic control.


ISIL’s anti-armor arsenal now contains a number of highly effective weapons that can be used against Iraqi and Syrian security forces. Anti-armor weapons with shape charges increase the likelihood of targeted armor vehicle crew casualties, but may not completely destroy the targeted vehicle during the engagement.15 However, due to Iraqi Security Forces’ (ISF) challenges in maintaining larger armored vehicles like the M1, it is possible this platform has been denied future use. The most common systems in use right now are the Kornet, the M79 Osa Rocket Launcher, and the ubiquitous rocket-propelled grenade launcher. In addition, ISIL has also captured a number of Russian and US tanks which, while more difficult to maintain and larger targets, can be used to attack enemy convoys.

Not surprisingly, these weapons are of choice use for the prosecution of offensive actions like assaults and ambushes. In July 2013, ISIL fighters ambushed an ISF convoy in the Khalidiyah area in Anbar Province. The convoy consisted of at least three M1A1 Abrams tanks and nine M113 armored personnel carriers. The attack occurred on a rural dirt road, initiated with IEDs and followed with anti-tank fire. The graphic below shows the missile hitting the tank. Even more recently, on 20 April 2014, ISF lost a formation with mixed armored vehicles including T-62 tanks.

ISIL Media Organization

The ISIL media department, Al Hayat Media Center, under the authority of its official propaganda arm, the Al Itisam Establishment for Media Production, has seen recent success in recruiting Westerners in general and Americans specifically. The products being generated include English-language videos, pamphlets, and a magazine. Competent English speakers are creating the products which are free from spelling and grammatical errors generally common in such materials, and sprinkled with Arabic words and phrases. German materials are also finding their way into areas with German-speaking potential recruits.


ISIL continues to use Twitter effectively to engage supporters and control the organization’s narrative. Prior to entering Iraq, ISIL had already developed digital tactics in Syria. Upon entering Mosul, the social media campaign began by tweeting, among other things, a consistent ominous prediction, “#ISIS we are coming Baghdad.” Subsequent tweets included a cartoon with trucks filled with militants rushing to Baghdad. ISIL Twitter accounts have also carried gruesome pictures and narratives of mass killings, enhancing its image as conqueror and discouraging resistance from those in its path.

ISIL has capitalized on Twitter features such as hashtags to expand its audience. A hashtag is a way to create a grouping of discussions in a mostly unmonitored ad hoc discussion forum. Any combination of characters preceded by a pound sign, or hashtag (see quote in previous paragraph as an example), allows anyone to sort all discussions with a particular hashtag into one place. If promoted by enough people, a hashtag will appear in Twitter’s “Trending Topics.” Hashtags are not registered or controlled by any one user or group of users and are not retired from public availability. A hashtag is a title arbitrarily assigned by the author that may or may not have anything to do with the message associated with the hashtag. ISIL uses faux hashtags in order to get its message to a larger audience. Capitalizing on the World Cup soccer fervor, ISIL used a number of hashtags associated with the event to gain a larger audience and improve its trending potential. As an example, ISIL has used hashtags associated with premier English soccer league clubs such as #MUFC, #WHUFC, #LFC, and #THFC.

ISIL has also doctored images to present a message. In one such post, ISIL or one of its supporters used the White House’s hashtag message on behalf of the kidnapped Nigerian girls to its advantage. The original Obama Administration hashtag featured Michelle Obama with a sign that said “#Bring Back Our Girls.” In a tweet, the picture was altered to say “BringBack Our Humvees,” an obvious reference to equipment and vehicles seized by ISIL in its takeover of northern Iraqi cities.

For several weeks in early 2014, ISIL supporters were able to download a Twitter app from the Google Play Store called “The Dawn of Glad Tidings” or “Dawn” for short. The app was advertised as a way to receive updates on ISIL’s efforts. Once a user downloaded the app, it would automatically post ISIL materials to each user’s Twitter account, spacing the tweets out at a rate and in numbers that would not alert Twitter’s anti-spam detectors. Each user essentially became a server for dissemination of ISIL propaganda materials. When ISIL stormed Mosul, the app posted 40,000 tweets in a single day. The app has since been removed from the Google Play Store after being available for several weeks.


Facebook has long been used by terrorist and insurgent groups. ISIL is no different, using it to share information and garner support. Facebook and other social media platforms have policies requiring these types of pages to be taken down; however, new accounts can be easily set up under different names. A new twist on the old approach is utilizing social media platforms such as Facebook to sell ISIL-branded products. For a reasonable price, a person can purchase shirts with the ISIL logo and phrases such as, “We are all ISIS” and “Fight for Freedom, Until the Last Drop of Blood.” Other products such as t-shirts, hoodies, and toys can be purchased. Many of the websites promoting these products come from Indonesia, a base of support for ISIL and other militant groups. One of these sites, Zirah Moslem, had over 9,000 likes before it was removed from Facebook. While it is not clear if ISIL is actually selling the merchandise, there is reason to believe it is receiving at least some support from the profits and publicity.


The ease with which events can be captured on video and disseminated via any number of digital media allows ISIL to distribute messages world-wide within minutes. Videos have been used for the purpose of recruiting disaffected Muslims in the West and sending messages designed to terrify, including graphic tweets of beheadings and mass killings. Whatever the purpose, ISIL has a willing network of people anxious to spread the visual images. News organizations, looking for images to tell stories, and people simply captivated by the images, also become participants in the distribution of the ISIL story.

Unmanned Aerial Vehicles (UAV)

In the recent Raqqa Governorate fighting, ISIL added a new reconnaissance capability to its fighting by employing UAVs. A recent ISIL video, meant for propaganda, shows that it is capable of and interested in using technology to gain an advantage. The released video shows a reconnaissance flight over the Tabqa airbase prior to a successful attack on that base.

The Phantom FC40 Quad Copter, believed to be used by ISIL, can be purchased commercially for about $500. The UAV has an attached smart camera which supports 720p/30fps HD video. It can be controlled through an iOS or Android app running over a 2.4G Wi-Fi connection. While the video is useful, the capabilities of the quad copter do not allow it to see from long distances in real time. Even with its limitations, the video retrieved from the quad copter gave ISIL a view of the area it was attacking it would not otherwise have had.


ISIL uses deception in two ways. First, ISIL has the ability to blend-in with the population. Air strikes have had the predictable result of causing ISIL fighters to shed military uniforms in favor of less identifiable clothes. Sunni tribal support, either directly or passively, has facilitated this by allowing ISIL fighters to move freely and hide in some areas. With the increase in US airstrikes and the involvement of other nations, ISIL will inevitably continue to hide among the population and begin to look much more like an insurgency than a state army.

ISIL has put captured equipment to good use as well. In September 2014, Camp Saqlawiyah in Anbar Province had been under siege with supply and logistics routes controlled by ISIL. With food, medicine, water, and ammunition in short supply for the five battalions trapped in the camp, officers made desperate calls to commanders and even members of parliament for relief. When camp defenders saw uniformed Iraqis in military vehicles they assumed it was the promised relief and let them pass through the gate without proper security checks. After entering the camp, the first ISIL SVBIED exploded in the middle of the camp while two others detonated on the perimeter. The gate security tried to hold back the rest of the convoy, but was hit with more SVBIEDs. The camp was overrun with only a minority able to escape.

Share this: