NATO UNCLASSIFIED

Releasable to Finland and Sweden

NATO C-UAS Working Group

NATO Countering Class I Unmanned Aircraft Systems

(C-UAS) Doctrine

DRAFT

This document is currently being drafted and has only been issued for the purposes of review.
It may not be cited as representing formally approved C-UAS WG opinions, conclusions or
recommendations. The publication may be expanded or modified at any time.

Version ThirdFourth DRAFT0.1

08 Jul13 DECFEB 2022

Table of Contents

i
NATO UNCLASSIFIED
 NATO UNCLASSIFIED
Releasable to Finland and Sweden

1. INTRODUCTION
2. THREAT ENVIRONMENT
3. PROTECTION MODEL
4. STRATEGIC CONSIDERATIONS
5. OPERATIONAL GUIDANCE
6. TRAINING

ii
NATO UNCLASSIFIED
 NATO UNCLASSIFIED
Releasable to Finland and Sweden

This page is left blank intentionally

iii
NATO UNCLASSIFIED
 NATO UNCLASSIFIED

1. INTRODUCTION

1. INTRODUCTION

1.1 BACKGROUND
- There is new kit fielded for C-UAS. This is was mainly EW, mature active sensors are
emerging and start being fielded. Initial short range kinetic effectors accompany EW and
development has started for new interceptor prototypes and technologies. is not coming with
sensors to identify the threat. Still Tthere is a shortage of defence capabilities.
- Planning considerations based on threat/risk assessment.
- IAMD, layered defence, system of system approach for. Create a defence design that will lead
to a solution.
- 1) Identify the threat
- 2) Tailor neutralization capabilities and capacities
- Consider pre-planned defence and pre-authorizations
- Permissive vs non-permissive environment.
- C-UAS is similar to C-IED and could reuse some of the doctrine documents developed in C-
IED (AJP 3.15) The forensic aspects of C-IED and the doctrine developed there could be
adopted for UAS.
- The doctrine should cover the theatre level concept
- Include C-UAS as an appendix to existing
- Include the coordination altitude as a possible friction mitigation. challenge, the threat is
evolving. Below coordination altitude it is mostly FP above is usually only AD. AD is still
responsible for low level threats too.
- The difference from C-IED the UAS can cross the boundary between FP and C-UAS. This
should be the focussfocus of this document.
- The Handbook and the doctrine will be valid at the same time. The doctrine document will
replicate some of the parts in the doctrine but will also refer to other parts of the document.
1.2 CLASS I UAS
 Need to discuss the need for a classification from a Counter perspective. The mandate is
for CLASS I <150KG
 The size is not a sufficient criteria to decide on counter measure. Need to add other
characteristics (e.g. mode of operation). Control autonomy, satcom, ROE
enviromentenvironment
 Describe the neutralization options, match the threat to the counter measures
 Describe the C-UAS from a capability perspective
 Avoid using a new classification with artificial boundaries
 NIAG 249 process on

1.3 Purpose
 The aim of this standard is to provide guidance to the operational level of command and
describes the links, the coordination and cooperation with the tactical level of command,
for the preparation and use of C-UAS capabilities in response to operational requirements
for Air Defence of NATO territorial assets and NATO forces deployed
The document covers the characterization of the threat, the protection model (including
reporting) and operational planning and execution guidance.

NATO UNCLASSIFIED Page 1

 NATO UNCLASSIFIED

1.4 SCOPE
 Will not go system specific, but will keep system categories (e.g. VSHORAD, )
 TTPs are excluded from this document and will be covered and other natoNATO doctrine
documents

 NDPP need to define capability in terms of battlespace objects, range
 Have qualitative requirements for C-UAS in NDPP, part of GBAD

1.5 INTENDED AUDIENCE

- Add a RASCI matrix and identify the key players.
- Applicable to all at Joint level
-
1.6 DOCUMENT OVERVIEW

NATO UNCLASSIFIED Page 2

 NATO UNCLASSIFIED

[2.] THREAT ENVIRONMENENVIRONMENTT

2.1 THREAT DEFINITIONINTRODUCTION

2.1.1 Introduction.
The analysis of future operational environments, lessons learned, experiences and feedbacks from
recent conflicts, highlight the importance of autonomous systems, in particular of Unmanned Aircraft
Systems (UAS), as a real threat to military forces and NATO operations.

In just a few years, technology maturity of new generation of Class I UAS, has made great strides
reaching unpredictable results. Threats executed by small, mini and micro COTS UAS have been
highly effective till now; however, although commercial UAS today can still pose a threat in various
conditions, such as in unconventional conflicts and urban environments, many military and non-
military companies and actors are investing to develop increasingly high-performance “drone
systems”1.

New software, artificial intelligence, new components and remote piloting innovations, offer high
potential to perform tactics operation to achieve strategic impacts. A proper combination of UASs and
conventional aircrafts would optimize a sinergic use of both platforms, maximizing operational
capability, results and reducing risks to crew life. The nNew software used are able to preset flights
parameters, with predefined values and detailed areas. Moreover, nNew generation drones are capable
of automatic transitions (automatic switching between fixed-wing and multi-rotor modes for more
stable flight in adverse weather conditions). Concerning the new components, these drones mount
thermal cameras, multi-spectral LIDAR (Light Detection and Ranging or Laser Imaging Detection and
Ranging.) which allow an extraordinarily fast and precise way and correctly measure of the distance
between the measuring emitting point and the target point and to carry out high quality ISTAR
activities. Further, the combination between drones and artificial intelligence (AI) increases the
potential of this equipment which can monitor border areas, identify risks and communicate threat
information to the appropriate response teams on battlefield. Thanks to AI-driven image processing
and its ability to analyse different characteristics of objects, including size, weight, speed and more,
commanders can gain better situational awareness and accurately determine whether an object seen
from far away or on the radar is innocuous or a possible threat. Another insidious menace more and
more growing is represented by loitering ammunition (Kamikaze drones). These type of UASs are
widely used, and very efficient and very difficult to counter. For the aforementioned considerations
and for the complexity of the threat represented by drones, it is necessary to have a holistic/systemic
approach. There is no “silver bullet” to face this challenge.
C-UAS operations has to be coordinated and executed by all components, using a variety of integrated
weapons systems and sensors to counter threats. To achieve this, Commanders and planning staff must
understand the adversary and their supporting networks. A C-UAS approach must be integrated into
the planning and execution phases of operations at all levels and must reflect the requirements to
integrate the safe use of friendly Class I UAS within a complex, congested airspace as well.

1
“Drone Systems”: The development of autonomous systems is currently extremely rapid and metamorphic,
almost unpredictable. The systems and their rapid evolution, in all areas, are changing the characteristics and
perception of threats

NATO UNCLASSIFIED Page 3

 NATO UNCLASSIFIED

UASs have advanced technologically and proliferated exponentially. As technology has progressed,
their capabilities have matured to a point where UASs represent a significant risk from both regular
and irregular forces. Therefore, detection, identification, engagement and defeat represent a gap to be
addressed, since UASs are currently being employed in a wide range of roles, like reconnaissance,
surveillance, command and control, electronic warfare, target acquisition, indirect fire engagement and
direct attack.
In general terms, The use of UAS capabilities by adversaries, both conventional forces and non-state
actors, is rapidly increasing and evolving. a UAS can defined as “a system that includes unmanned
aircraft and the necessary equipment, network and personnel to operate it.”1 The important aspect to
highlight in this definition is the trilateral nature of the capability, which involves a relationship
between the unmanned aircraft (UA), the equipment, and the personnel to operate it.
In particular, Class I UASs – as further defined below - are growing increasingly sophisticated,
offering autonomous flight, high-end ISR capabilities, and ever-expanding payload capacity, range,
and endurance.
Engineering advancements, paired with relatively low costs, have led to an explosion of commercial
off-the-shelf production of this category of UASs, thus becoming widely accessible to potentially
disruptive actors. UASs can even be assembled or modified by using component parts without
identifiable markings (e.g. parts can be produced by 3-D printers), increasing the complexity and
difficulty of attribution if used in an attack or any other hostile act
The tactical applications of these UASs are numerous, and adversarial forces can use them at the
tactical level to achieve strategic impacts. Given their small size and material composition, the Class I
UASs have in general very small radar cross-sections, which, combined with relatively slow speeds,
creates significant detection and identification challenges. Therefore, countering Class I UASs (C-
UAS) requires defence capabilities specifically designed to overcome the key challenges of detecting
these systems that possess the following characteristics:

a. low radar cross-section;

b. low, slow and unpredictable flight patterns;
c. difficulty to be visually observed;
d. difficulty to be engaged; and
e. potential for collateral damage or unintended post-engagement effects.
They are widely accessible to potentially disruptive actors and could be assembled using component
parts without identifiable markings (can be produced by 3-D printers), thus increasing the difficulty of
attribution if used in an attack.
In addition, due to their size, construction material, and flight altitude – which categorise them as
LOW, SLOW and SMALL (LSS) - hobbyist UASs are difficult to defend against, if their presence in a
particular area is unknown or unexpected. These factors could in turn increase the likelihood that
hobbyist UASs – particularly those assembled by the operator, and thus not subject to manufacturer-
installed geo-fencing – are being weaponized and autonomously deployed in a terrorist attack against
civilians, military personnel, or high-profile individuals or landmarks. The possibility of swarm UASs
attacks against strategic military and civil objectives (including bases or industrial/energy
infrastructures, airports and seaports) should be considered as well. The rapid technological
development of this commercial sector, has led to relatively cheap, easy-to-use and disposable UASs
to become available to anyone. The “hobbyist” UAS referred to here also include those
UAS made in significant numbers in “artisanal” factories and workshops, using a wide
range of commercial components imported in a systematic manner, planned and financed by an
NATO UNCLASSIFIED Page 4
 NATO UNCLASSIFIED

operational/strategic C2 entity, with end-users trained and integrated into military-style structures,
with the UAS adapted to our own counter-measures and using an established and sophisticated lessons
learned process.

Given the nature of the threat, For these reasons, C-UAS will treat the Class I UAS threat as a
systemic problem, and aiming at to defeating the system, but also the hostile networks which support
adversarial Class I UAS activitieoperations (the personnel, resources and activities necessary to
resourcefinance, plan, execute and exploit UAS events), in particular when UASs are operated by
irregular or non-state actors.

As such, C-UAS can be described as a collective effort and responsibility, that spans across many
capabilities at all levels of command, to defeat the UAS by preparing own forces (personnel and
equipment), defeating the aerial vehicle and attacking its supporting network, to reduce the risk and/or
eliminate the effects of all forms of UASs employed against friendly forces and non-combatants..

2.1.2 Composition. As anticipated before, Igenerallyn general, a Class I UAS is a complete system,
whose components include the aircraft and all the equipment, network and personnel and necessary
supporting activities to control and exploit it.
In its the most simplified form, the a complete Class I UAS system is composed of the following
elements:

• Aircraft - one (or more) remotely controlled (or autonomous) unmanned aircraft, normally
composed of:
(1) Airframe.
(2) Propulsion system.
(3) Flight control system.
(4) Imagery Sensor system.
(5) Battery or power unitpack.

• Controller/Operator - the “Ground Control Station (GCS)”, that may be located outside the
actual area of operations, depending on the flying range of the UAS. The GCS may consist of
a smartphone or tablet-style device and / or a hand-held flight control unit. It will requires a
radio frequency link to transmit / and receive guidance signals that to direct the asset. This
will normally be a local Wi-Fi link between the GCS and unmanned aircraft

• Payload - the associated (mostly modular) payload that usually consists of sensor systems
and armaments, as required.
,
• Link - the control and data link between GCS and unmanned aircraft. Depending on size and
flying range of the aircraft, this link is directly established between GCS and the aircraft (Line
of Sight - LOS) or indirectly via a satellite orf a land communication network infrastructure
(Beyond Line of Sight - BLOS).
,
• Logistic - a logistics support element (in some cases reduced at little to nonenone or small
footprint in same cases).

NATO UNCLASSIFIED Page 5

 NATO UNCLASSIFIED

2.1.3 Classification. In broad terms, UASs differ considerably in their outward appearance, size,
weight, performance parameters and mission roles. Depending on their key performance parameters,
UASs are classified as presented in Table 1 (see STANAG 4670 – ATP 3.3.8.1 “Minimum Training
Requirements for Unmanned Aircraft Systems (UAS) Operators and Pilots”). Note that these classes
may not match the UAS classifications of other nations or organisations, but are generally very
similar.

In general terms, Class I UASs are small, self-contained and generally man-portable. They usually
operate at relatively low altitudes (below the Coordination Level), below the Co-ordination Level.
Tthey typically support small footprint of ground forces and are generally controlled by a single
individuaindividual, l who also views the sensor feed ( images and / or Full Motion Video (FMV)) on
a small laptop-type computer. They are typically limited to Line of Sight operations. For the purpose
of this publication, the Coordination Level (CL) is set up to 5.000ft AGL. It is recognised that, in some
operating spaces, the CL could be higher or lower than 5000ft.

NATO UNCLASSIFIED Page 6

 NATO UNCLASSIFIED

Table 1 NATO UAS classes adapted from STANAG 4670, ATP 3.3.8.1 (recent examples of UASs from
NATO countries were added to the original table; also added examples of units relevant at JTF level).

Note: In the event the UAS is armed, the operator should comply with the applicable Combined/Joint Mission Qualifications
in this ATP and the system will need to comply with applicable airworthiness standards, regulations, policy, treaty, and legal
considerations.

2.1.4 UASs can be launched from the ground, but also from ships/boats or aircraft. They will reach
their area of operations either:
• remotely controlled,
• automatically via a pre-programmed course (e.g. using Global Positioning System or inertial
navigation),
• autonomously via remote sensing (e.g. using cameras and computer vision), or
• a combination of the above.

NATO UNCLASSIFIED Page 7

 NATO UNCLASSIFIED

NATO UAS CLASSIFICATION

Usual Primary
Usual
Class Category Operating Mission Supported
Employment
Altitude Radius Commander
Strike/ Strategic/ Unlimited
Up to 65,000 ft Theatre
Combat1 National

Class III Strategic/ Unlimited

(> 600 kg) HALE Up to 65,000 ft Theatre
National

Operational/ UP to 45,000 ft Unlimited

MALE JTF
Theatre MSL

Class II Tactical Up to 18000 ft 200 km

(150 kg- Tactical Brigade
Formation AGL
600kg)
UP to 5000 ft 50 km Battalion,
Small (>15 kg) Tactical Unit
AGL Regiment
Tactical Subunit Company,
Class I Mini (<15 kg) (manual or hand
Up to 3000 ft Up to 25 km
Platoon,
(<150 kg) AGL
launch) Squad
Tactical Subunit Up to 1000 ft UP to 5 km Platoon,
Micro (<2 kg)
(manual or launch) AGL Squad

1
In the event the UAS is armed, the operator should comply with the applicable joint mission qualifications in
ATP-3.3.8.1 Ed. B., Ver. 1 and the system will need to comply with applicable air worthiness standards,
regulations, polity, treaty, and legal considerations.

_____________________________

2 Note: UAS that have a maximum energy state less than 66 Joules are not likely to cause significant damage to life or
property, and do not need to be classified or regulated for airworthiness, training, etc. purposes unless they have the ability to
handle hazardous payloads (explosive, toxins, chemical/biological agents, etc.).

NATO UNCLASSIFIED Page 8

 NATO UNCLASSIFIED

2.1.4 Operation. Class I UASs can be launched from the ground, but also from ships/boats or aircraft.
They will reach their area of operations either:
• remotely controlled,
• automatically via a pre-programmed course (e.g. using Global Positioning System or inertial
navigation),
• autonomously via remote sensing (e.g. using cameras and computer vision), or
• a combination of the above.

Some UASs can be armed or conditioned as unmanned airborne carrier systems for adapted and
releasable munitions or chemical/biological substances. In addition, high-performance sensor systems
are ableprovide the capability to reconnoitre identify/locate/track friendly forces at long distances,
cross-cue information and provide data data and information for their engagement.
Although the operational radius of such Class I UAS is typically smaller than that of larger UAS
classes, they can often appear unexpectedly since they are small, manoeuvrable, quiet and rapidly
deployable and generally do not require significant take-off or landing infrastructure and, thus, are
flexible enough to be employed a morein diverse mission areaenvironments.
Depending on design and equipment, small, mini and micro UASs can provide enemy forces with a
relatively inexpensive but capable air support for their operations.

However, Class I UAS are generally limited by weather, electromagnetic emissions, payload and a
certain degree of structural fragility. In addition, such systems are currently highly dependent on GPS
GNSS signals and Innertial Navigation Systems (INS) to provide flight stabilization and device
recovery systems in the event of a lost data link. On the other hand, Tthe rapid development of new
emerging technologies, including the incorporation of hazardobstacle detection and avoidance,
hydrogen power packs, silent motors and intelligent flight modes, will offer greater advantages of
speed, endurance, payload, lower cost and sensor capability in the near future.

2.2 THREAT SPECTRUM

2.2.1 Introduction. The threat posed to friendly forces by the use of Class I UAS in a malicious,
reckless or negligent manner poses a new set of challenges to our freedom of manoeuvre in the
maritime, land and air domains. It is therefore important that all friendly forces must have an
awareness of the threat and an understanding of their responsibility to support the effective mitigation
of potentially hostile Class I UAS risk. A Class I UAS event is likely to be short, confusing and
dynamic. Effective C2 of such a hostile UAS event will be challenging. Counter-Class I UAS
operations will be resource intensive, difficult to sustain, require patience on the part of Commanders
and have a detrimental impact on morale if sustained for long.
The characteristics of Class I UAS enables an adversary to exploit existing defensive weaknesses to
achieve a disproportionate effect within either the home domestic or deployed operating spaces. Class
I UAS are will be detectable by current state of the art Short range air defense (SHORAD) and Very
Short range air defense (VSHORAD) sensors, but are generally undetectable to current legacy
integrated Ground-Based Air Defence (GBAD) systems. Moreover, many forces will not have organic
GBAD assets and will therefore be dependent on the application of basic military skills and limited
technological support to counter the threat.

NATO UNCLASSIFIED Page 9

 NATO UNCLASSIFIED

Class I UAS represent a genuine and evolving challenge to our ability to operate unconstrained in the
air and enjoy freedom of manoeuvre on the ground, and Class I UAS threats must be regarded as a
significant restraint on these previously assumed conditions, both within the home and deployed
operating environments. Neither should these threats be immediately regarded as purely kinetic in
nature. Class I UAS offer a range of current or developing technologies which will present challenges
on our freedom of manoeuvre, not only in traditional military operating spaces, but also through the
ability to complement or enhance the use of hybrid military operations, such as the ability to
livestream video images on social media platforms in near or real-time.

2.2.2 Employment.
Class I UAS are small, manoeuvrable and quiet. Even to the trained eye, they are often very difficult
to observe in flight. Environmental conditions will make such systems difficult to OBSERVE,
TRACK and IDENTIFY without the use of bespoke technological tracking and identification devices.
Other factors like Ttime of day, ambient light levels, meteorological conditions and observer alertness
will may all affect the ability to observe a potential hostile Class I UAS.
Class I UAS agility can be exploited to make these systems difficult to observe and track.
AMoreover, an experienced operator can fly a Class I UAS in such a tactical manner as such to further
enhance the ability to exploit Class I UASits characteristics, like. This might include:
a. Flying at low level, using terrain, obstacles with vertical extent and/or urban environment
to mask an approach to a potential target location;
b. Making a series of false take-offs, approaches to intended target location, false recovery;
c. Use of erratic, dynamic flight profiles to confuse and deceive personnel, making visual
observation challenging;
d. Using the sun and / or cloud cover to effectively mask the Class I UAS from sight;
e. Flying upwind approaches to minimise the ability to detect the sound of the UAS;
f. Use of Sport flying modes to increase speed and agility and minimise the time to observe
the UAS;
[g.] Use of multiple UAS to confuse, deceive and overwhelm military forcesthe intended
target;
a. Flying a pre-programmed flight profile to minimise risk to the operator.

Commercial Off The Shelf (COTS) Class I UAS can be easily adapted, often at very low cost and with
minimal technological expertise to exploit our weaknesses. Many such adaptations are easily
commercially available and can incorporate technologies initially developed for the UAS racing
community, to. Such adaptations will improve the speed, range and endurance of a UAS, which will
subsequently offer the malicious, reckless or negligent UAS operator extended options to conduct a
potentially hostile UAS operation. These can include:
a. Use of enhanced engines, rotor blades and batteries to improve performance or endurance of
the device or reduce its sound profile;
b. Reduction of weight through the modification of the device to remove non-essential
components or structural elements to improve the performance or endurance of the device.
This may also be conducted to increase payload or reduce the profile of the device (i.e. the
removal of navigation lights);

NATO UNCLASSIFIED Page 10

 NATO UNCLASSIFIED

c. Modification of the device to remove manufacturer or legally mandated UAS safety

restrictions such as geo-fencing restrictions;
d. Modification of the device to reduce the effectiveness of potential UAS countermeasures
such as frequency hopping technologies to maintain a link to the GCS and minimise the
propensity to lose control of the device;
e. Adaptation of optical devices to enhance capability such as Camera UV filters or the use of
enhanced optical systems including IR cameras for ISR purposes.

Employment options of small UASs are, among others: Intelligence, Surveillance and Reconnaissance
(ISR), Target Acquisition, Target Engagement, Battle Damage Assessment (BDA), Information /
Influence activities, Command and Control (C2), battle tracking, engagement of sources of
electromagnetic radiation, Electronic Countermeasures (ECM), and deliberate disruption of air
operations, both civil and military, via airspace infringement.
They can be employed:

• in at low / very low flight altitudes,

• within relatively short flying ranges,
• within a broad spectrum of flight speeds,
• with long operational endurance and high manoeuvrability,
• by day, at night and in relatively adverse weather conditions, and
• in almost every terrain and all climate zones.

Besides the conventional employment options, UASs can also be used by irregular forces for
asymmetrical warfare. Field units have to expect employments of UASs in combination with IEDs.

The reader should considerconsiderate should be assumed that the adversary has a good imagination
and new ways of employing UAS threat will be developed. In the following section there are listed
some of the most frequently observed scenarios at the time of writing this document.

NATO UNCLASSIFIED Page 11

 NATO UNCLASSIFIED

2.35 ENEMY USAGE AND EMPLOYMENTSCENARIO

2.35.1 Introduction. Class I UAS flight profiles and TTPs continue to mature rapidly to exploit both
technological enhancements and current defence vulnerabilities in the deployed operating
environment. The threat from UAS must not be regarded as purely a kinetic one but a broad range of
potential threats which may present a risk to life, safety, information or reputation. Therefore,
commanders and staff at all levels must think laterally and innovatively to the variedying challenges of
Class I UAS to military operations. The impact of an asymmetric quick-win, information operations
Class I UAS attack and subsequent reputational damage could be as much of a compromise to military
operations as a more traditional form of attack. Furthermore, the complexity of C-UAS defence will
only increase, as local airspace becomes more congested with the legitimate use of recreational and
commercial Class I UAS. Such systems ease of use, proliferation, automated flight profiles and limited
detection and engagement opportunities must all be considered and mitigated against where possible,
whilst minimising the impact on military objectives and the safe delivery of operations.

2.35.2 Adversary Courses of Action (ACOA). Understanding the nature of any threat system
provides insight into both the possible scale of the threat and how it might be defeated. The more
technologically advanced and hence potentially capable a system is, the greater the likelihood that it
will pose a real risk. Ultimately, if Class I UAS is viewed as just another threat, then, as with any
other, understanding where it comes from, who is using it, for what purpose, and how it is being
operated (TTP) will provide important information to assist friendly forces in countering the threat.
Different tactics, techniques and procedures (TTPs) have been observed and considered on potential
adversaries, ranging from tactical observation and support to targeting, to disrupting airspace usage,
infrastructures and networks, up to direct attack. Both asymmetric and symmetric concepts have been
studied and quoted according to threat levels and the types of platforms fitted for the attackhostile
event.
TTPs can also be considered as:
- Reactive: necessitate little to none planning or plotting. These activities are opportunity based;
- Proactive: elaborated and more sophisticated, that need planning activities.

The enemyAdversary Ccourses of Aaction (AECOA) scenarios are representdescribed using a

schedule of events and a template for courses of action matching the different TTPs, including
preparatory planning. This corresponds to worse case compound attacks, with two waves of swarming
UASs, one for defence disruptions and one for the terminal attacks over multiple targets.
In general, adversaryIt divides the enemy plans can be divided in the following phases:

• Intelligence collection,
• Offline planning,
• Preliminary deployment,
• Hot planning,
• Execution on Deployment, Primary targets strike,
• Secondary targets.

Based on the actor, scale and complexity of the intended hostile activity, This ECOA template
complements the TTPs description, from an execution point of view. An ECOA describes which

NATO UNCLASSIFIED Page 12

 NATO UNCLASSIFIED

agents operate and provide a typical schedule in months or hours. There are preconditions to check for
running an action, the post-conditions (or expected effects), and the critical parameters. Contingencies
are events that may jeopardize the realization of an action. Go/No-go decisions are contingent since
they are decided according to the operational context and assessment of the success of previous
actions set.

For each scenario, two categories of TTPs are described:

• Reactive attacks: behaviour that necessitate little to none planning or plotting. These attacks
are based on openings and opportunities.
• Proactive attacks: elaborated and more sophisticated attacks that need reconnaissance and
planning activities. These can involve feinting, masquerading and the use of decoys.

Each category is quoted according to a classical risk analysis method:

• Risk occurrence (that represents the level of probability) can be mitigated by some
operational constraints, target access or technology feasibility. Risk occurrence is quoted
according to a mitigation indicator. The higher the indicator; the higher the occurrence risk.
For example, UAS speed, range, accuracy, and its payload capabilities may drastically
decrease the risk of occurrence if there is no attack plan.

• Effect gravity is quoted by the damage to the friendly forces: panic effect, loss of
communication assets, critical targets and so on.

Five TTPs have been selected and are described below, as illustrated in Figure 5:

• Attack or false attack by single or multiple low cost UASs with limited or advanced
capabilities (reactive) leading to panic effects,
• Vulnerable Target / Very Important Person (VIP) targeting (proactive),
• Highjack fleet of commercial UASs (proactive),
• Infrastructure disruption (reactive/proactive),
• Saturation attacks (proactive) for COMINT or RADINT.

All these scenarios can be realized by a large set of different platforms.

NATO UNCLASSIFIED Page 13

 NATO UNCLASSIFIED

2.3 SCENARIO BASED THREATSADVERSARY COURSES OF ACTION

2.3.1 ENEMY COURSES OF ACTION

2.36.1 The enemy courses of action (ECOA) are represented using a schedule of events and a template
for courses of action matching the different TTPs, including preparatory planning. This corresponds to
worse case compound attacks, with two waves of swarming UASs, one for defence disruptions and
one for the terminal attacks over multiple targets. It divides the enemy plans in the following phases:

• Intelligence collection,
• Offline planning,
• Preliminary deployment,
• Hot planning,
• Deployment, primary targets strike,
• Secondary targets.

This ECOA template complements the TTPs description, from an execution point of view. An ECOA
describes which agents operate and provide a typical schedule in months or hours. There are
preconditions to check for running an action, the post-conditions (or expected effects), and the critical
parameters. Contingencies are events that may jeopardize the realization of an action. Go/No-go
decisions are contingent since they are decided according to the operational context and assessment of
the success of previous actions set.

2.63.2 Weit can be assumed that the adversary would be organized as follows:

• An Intelligence team, in charge of targeting,

• A command team, in charge of command and control during the attack phase,
• Teams of controllers that actually operate the UASs.

NATO UNCLASSIFIED Page 14

 NATO UNCLASSIFIED

• A systemlogistic support for finance, procurement, construction, training, deployment, and

adaptation, etc...

The NATO Industrial Advisory Group SG -188 showed in a report that each ECOA action signature
could be broken down into several types of sub-signatures:

• Human: related to human footprint

• Visibility: related to UAS detection with optronics or human eyes
• Infrared: related to thermal detection
• Radar: related to active detection in the radar spectrum
• Communication: related to enemy COMINT

Each signature is assessed on a scale of high/medium/low. Note that the most discrete attacks are not
necessarily the reactive ones. Most of the signatures are revealed after a period.

As anticipated, potential Class I UAS scenarios include (but are not limited to) UAS employed for:
 UAS employed for Intelligence, Surveillance and Reconnaissance (ISR),
 Support toUAS employed for tTargeting and guided Iindirect Ffire,
 UAS employed to dDropping munitions, booby traps and Improvised Explosive Devices
(IEDs)Direct Attack,
 UAS employed for Electronic Warfare (EW) and Ccyber-Aattack,
 UAS employed for Information Operations including attribution and propaganda,
 UAS employed for sSmuggling,
 UAS employed for a dDirect attack,
 UAS employed for dDeliberate disruption of air operations, both civil and military, via
airspace infringement,
 UAS employed for cCombined attacks (i.e. with IEDs).
 Saturation Attack (SWARM)

These scenarios are detailed in the following sections, mainly with examples from the air and land
domains. However, these scenarios equally apply to the maritime domain.

2.3.1 2.1 UAS employed for ISR.

At delivery, a large number of commercially available Class I UAS are equipped with cameras and
other means of reconnaissance already. This equipment can transmit images and videos in real-time to
the UAS operator, or provide them for post-mission analysis after return on installed storage media..
Thus, Class I UAS enable enemy forcesadversaries to conduct airborne reconnaissance on. Targets of
such reconnaissance can be, for example, friendly infrastructure, forces in the area and their tactics,
techniques, and procedures.

NATO UNCLASSIFIED Page 15

 NATO UNCLASSIFIED

The TTPs observed for ISR scenario are commonly is depicted in Figure 1, where three common
UAS control techniques are illustrated: controlling the Class I UAS on Line-of-Sight (LOS), Beyond
Line-of-Sight (BLOS) and pre-programmed (or autonomous).

Figure 1 UAS employed for reconnaissance

2.3.2 2.23 UAS employed for in Support to tTargeting and guided Iindirect Ffire.

Class I UASs can be equipped with payloads, which can support targeting and guide indirect fire 3.
Common payloads to support targeting include cameras and geo-fencing equipment based on Global
Navigation Satellite System (GNSS)Global Positioning System (GPS). Laser designators could also be
mounted on small UAS, although there is little evidence of such developments at the time of writing
this document.

Class I UAS may be used to vector suicide bombers to the correct locations avoiding security forces or
roadblocks.
These use cases are depicted in Figure 2.

NATO UNCLASSIFIED Page 16

 NATO UNCLASSIFIED

Figure 2 UAS employed to

guide indirect fire
(from [38]).

_____________
3See The Russian-Ukrainian War: Understanding the Dust Clouds on the Battlefield, Amos Fox, Modern War
Institute at West Point, 17 Jan 2017

NATO UNCLASSIFIED Page 17

 NATO UNCLASSIFIED

2.3.3 2.34 UAS employed for Direct Attack to drop munitions, booby traps and IEDs.

The target of a direct attack using a UAS may be selected by an operator while the UAS is in flight,
on an opportunity base. Otherwise, the target of the attack can be selected prior to UAS launch, by
entering waypoints, coordinates or by geoimaging procedures, to guide the UAS on a pre-programmed
course against a stationary target. Class I UAS can also be modified to drop bomblets or release
munitions. For this purpose, the operator can actively control flight course and target selection or pre-
program the system in advance. UASs may also be modified and/or designed by means of factory
equipment with a non-separable warhead for one-way missions.

Besides the conventional employment options, UASs can also be used by irregular forces for
asymmetrical warfare. In this mannerregard, a commercially available UAS can be employed as a
“loitering munition”, in combination with an onboard IED explosive as an airborne IED (ABIED).
Commercial UAS used for agriculture can easily be adapted to deliver chemical or biological
substances for terrorist or warfare missions.
Though still in early development certain multi-rotor UAS, likely class 1 (small), have the capability
to carry and fire one or more rocket-propelled grenade (RPG) variants. The fact that the RPG would be
employed from the air means that the warhead will strike the target from above, where the armour is at
its weakest, thus greatly increasing the effectiveness of the weapon system
Enemy UASs located on the ground can also be prepared as booby traps. For this purpose, booby traps
can be brought to the intended location by dropping them, by a targeted landing or a mock crash of the
UAS. The enemy ruse of re-producing friendly UAS models and possibly attaching national
identification marks as part of the deception must be taken into consideration when recovering UAS.

Since it is generally not clear whether an UAS have has been equipped with ordnance, the UAS have
has to be handled in accordance with the Countering Improvised Explosive Devices (C-IED)
operational doctrine after a crash or landing. After gaining a minimum distance of 200 m and blocking
access to the UAS, it has to be checked by explosive ordnance disposal forces.
Once any explosive threat has been neutralized or dismounted, UAS have to be secured within the
framework of the NATO technical exploitation process and handled accordingly in order to derive
useful information to improve protection against the UAS threat.

Figure 3 illustrates some of the use cases relevant for this scenario such as attacks on mobile troops or
fixed installation using line of sight or pre-programmed UAS controls.

NATO UNCLASSIFIED Page 18

NATO UNCLASSIFIED

NATO UNCLASSIFIED Page 19

 NATO UNCLASSIFIED

2.3.4 2.45 UAS employed for Electronic Warfare (EW) and Cyber Aattack.

Class I UASs may be equipped with electronic equipment to conduct radiofrequency (RF)
reconnaissance and jamming of communication and sensor systems. Cyber-attacks could also be
conducted using UASs and it is relatively easy to install Wi-Fi spoofing devices and attempt to
connect to an information systems network.

2.3.5 62.5 UAS employed for Information Operations including attribution and recording
Propaganda.

With Class I UASs now equipped with higher standard cameras, improved flight times and highly
intelligent flight modes, it allows theany potential adversary to is capable of creatinge low cost, high
quality propaganda materiel to inspire adversaries others on how to use drones, to advertise hostile
actions, take attribution and credit, generate support and consensus, discredit friendly forces activities
for lone-wolf attacks. Class I UASs may also provide a delivery mechanism for propaganda leaflets. If
those Class I UAS are equipped with means of reconnaissance that transmit video recordings in real-
time to the operator or another receiver, the enemy can exploit such recordings.

2.3.6 2.67 UAS employed for smuggling.

Class I UASs can be used for illicit activities such as smuggling of narcotics and other goods to and
from restricted areas. For example in the United Kingdom in 2018, a number of people were sentenced
for smuggling drugs and mobile phones into prisons [43]. Smuggling of goods across international
border is another example of illicit use of Class I UAS and the Finnish Border Guard reported
cigarettes were being trafficked across the border between Finland and Russia in 2017 [44].

2.3.7 8 UAS employed for a direct attack

The target of a direct attack using a UAS one-way mission may be selected by an operator while the
UAS is in flight. However, the target of the attack can alternatively be selected prior to UAS launch
already by entering waypoints, coordinates or by geoimaging procedures to guide the UAS on a pre-
programmed course against a stationary target.

Class I UASs may be employed individually, in larger numbers controlled by multiple people leading
to saturation or network-enabled in larger numbers in a swarm and, thus, achieving significantly more
severe effects. A swarm is comprised of a large number of UAS operating autonomously to sense the
environment and react cooperatively to achieve objectives.

In this manner, UAS swarms can be specifically employed to overwhelm a target and/or its defences,
or to saturate airspace to deny its use. The UAS swarms scenario is depicted in Figure 4.
For further information on swarms, please refer to the dedicated section in this chapter.

NATO UNCLASSIFIED Page 20

 NATO UNCLASSIFIED

2.3.2.7.8 9 Deliberate disruption of air operations.

Recent events have highlighted the impact that small UAS operated within sensitive airspace can
cause (due to associated Flight Safety Risk). This is a valid Tactics Techniques and Procedures (TTP),
which could be used throughout the spectrum of conflict (including peacetime, periods of crisis and
hybrid warfare).
Maritime operations should also consider the Class I UAS threat and prepare for possible attacks and
disruptive actions.
Unintentional disruption by other actors unaware of wider activity, such as NGOs delivering
medicines or even parcels delivering Companies, can also be included in this scenario.

2.3.2.89 10 UAS employed for combined attacks.

In a combined arms use of UAS, the adversary will combine air forces with ground forces. For
example, the adversary will create a distraction using a Class I UAS to push a manoeuvres element
into an ambush.
Another example observed TTP is the case when UAS is used to drop munition on a unit, to move the
unit into another area where there is an ambush.

2.3.2.9 Saturation Attack (SWARM). A major future challenge for C-UAS operations will come
from the ability for one entity to control multiple Class I UAS to overwhelm C-UAS defences –
commonly referred to as “swarming”. The technology to conduct UAS swarming is already available
in the commercial sector, such as in the entertainment sector to perform night-time light shows.
Swarming-UAS will present a unique challenge to the effective delivery of C-UAS operations at the
tactical level, requiring a thorough, layered defensive plan which fully exploits both offensive and
defensive operations to deter, disrupt and deny a hostile actor the opportunity to initiate such an

NATO UNCLASSIFIED Page 21

 NATO UNCLASSIFIED

operation. Current C-UAS technologies will offer timely warning of such an event, but the ability to
track significant numbers of Class I UAS and affect their operation will be severely limited.
It is acknowledged that, by the time this document is drafted, characterizing a “Swarm” may result
complicated. The NATO Joint Airpower Competence Centre (JAPCC) has conducted a number of
workshops in 2022, from which the following definition has been provided:

“A swarm is a group of entities that exhibit coordinated, cooperative, and adaptive behaviour to
achieve a common objective.”

It is relevant to notice that:

- “Swarm” may consist of a handful or even hundreds of elements, but at least more than one, without
specifying any set of numbers. The term “group” also indicates the spatial correlation between swarm
elements, while purposefully not describing their specific organization or distance;
- The term “Entities”covers all categories of unmanned vehicles, including air, land, surface, and sub-
surface systems;
- The verb “Exhibit” refers to the inner workings and technical mechanisms of arraying a swarm, that
can differ and cannot be reliably identified by an outside observer, e.g. an Air Defence unit. The term
accounts for that and leaves further specifications (e.g. level of autonomy, artificial intelligence etc.) to
subordinate terminology;
- “Common Objective” serves the military context, as it can be assumed that a swarm is always
directed towards an objective to achieve its given mission goal, e.g., site survey, intelligence,
surveillance, and reconnaissance, or even strike or suicide missions.

Based on adversary’s expertise, technology and sophistication of planning, a Swarm may be

employed in different ways, which will ultimately require different capabilities and TTPs to counter it.
For example, a group of entities could be separately flown to a predetermined common goal via
Global Navigation Satellite Systems (GNSS) waypoint or terrain navigation on autopilot, or by human
operators in real time. In-flight activity is co-ordinated only during pre-mission (human) planning and
cannot readily respond to a changing situation without additional operator intervention, except through
limited pre-programmed responses.
Otherwise, a group of entities, possibly with established internal hierarchy and interdependency, self-
organised into a network as a single, (semi-) autonomous UAS, may have the ability to assess the
situation (including the actions or loss of other UASs) and respond without operator intervention. A
Swarm like this will automatically adjust individual UAS roles to maintain the overarching central
mission aim, using some form of internal communication system across the entities.

NATO UNCLASSIFIED Page 22

 NATO UNCLASSIFIED

2.4 THREAT OBSERVATION

2.4.1 Due to the low, slow and small signature of Class I UAS and the low-noise propulsion that some
of them have, detecting and recognizing these vehicles poses a great challenge to forces assigned to
aircraft spotting. Depending on weather conditions, reconnaissance is only possible at distances of
300- 800 m, recognition without optical aids only at distances of less than 300 m.
When UAS can be heard, it generally means that they are already close to friendly units.
Due to the small radar cross section of mini and micro UASs, reconnaissance by forces capable of
radar surveillance is often difficult. Consistent implementation of permanent passive air defence
measures to protect against threats posed by UAS is essential because of short advance warning times
in the reconnaissance of mini and micro UAS.
Thermal imagers are suitable for UAS reconnaissance under most visibility conditions. In general,
their performance during daylight hours at close and medium distances is similar to the range of
daylight real-image visual aids. In limited visibility and at long distances, they are more efficient than
daylight real-image visual aids.
Since Class I UAS operators often need direct visual contact to the UAS for control and data
transmissions, operator localization should be performed after recognition of the UAS.

2.4.2 Future C-UAS operations will be further complicated by the exponential growth in the legitimate
commercial use of UAS across society. Such systems have the ability to transform the way society
operates and offer significant positive economic and social benefits. They are likely to be operated in a
number of critical areas including law enforcement and emergency response, security, logistics,
infrastructure and civil engineering and even personal transport purposes. This growth in commercial
UAS operations will pose significant challenges to the effective delivery of military C-UAS
operations. A congested airspace will offer opportunity for the malicious UAS operator to mask a
hostile UAS act within this congested operating space. Therefore, the ability to positively identify
and track hostile Class I UAS without the aid of appropriate technology and traffic management
systems will prove difficult. Moreover, the potential for UAS air proximity events with low flying
manned fixed wing or rotary aircraft will also increase. Personnel conducting C-UAS activities will
require an increased understanding of the airspace where they are operating. An awareness of future
Unmanned Traffic Management (UTM) systems which provide critical flight safety information
will be essential. This will assist in the timely identification of potential hostile operations in a
complex and dynamic UAS operating space.
Finally, legitimate hobbyist use of Class I UAS will also increase significantly. Despite mandated
licensing and training requirements, there will inevitably be an increased risk of accidental incursion
of non-hostile UAS in close proximity to military locations and operational areas. This will require
proportionate responses in order not to create negative operational effects which could have
unintended consequences such as reputational damage, reduced freedom of manoeuvre in the
operational space or the requirement to provide compensation for loss of private property.
The rapid technological advancement of UAS technology will challenge the ability of personnel to
track, identify and react to a potential UAS threat. The evolution of new engine and battery technology
will increase the endurance of Class I UAS from minutes to hours allowing Class I UAS to travel
further and loiter using pre-set way points and flight profile programmes which already enable UAS to
identify and track specific targets or record images of specific locations. Such technological
developments will also allow these systems to operate in more demanding meteorological conditions

NATO UNCLASSIFIED Page 23

 NATO UNCLASSIFIED

than is currently possible, which will offer the operator a broader range of operating conditions than
are available with current technology.
Exploitation of 5G telecommunication networks (e.g. 5G) and frequency-hopping techniques will
further complicate the delivery of effective C-UAS operations. Furthermore, Class I UAS are also
likely to increasingly adopt biomimetic technologies which copy the natural world to achieve more
efficient methods of flight. Such technologies will make these systems increasingly harder to
positively identify and distinguish from indigenous wildlife such as birds and even insects. Hybrid
UAS technologies will seek to combine both fixed wing and multi-rotor design strengths to enhance
key performance factors such as range, endurance and operator flexibility
2.4.3 Swarming Saturation attacks with CLASS I UASs
A major future challenge for C-UAS practitioners will come from the ability for one operator to
control multiple Class I UAS to overwhelm C-UAS defences – commonly referred to as swarming.
The technology to conduct UAS swarming is already available in the commercial sector, such as in the
entertainment sector to perform night-time light shows. Swarming-UAS will present a unique
challenge to the effective delivery of C-UAS operations at the tactical level, requiring a thorough,
layered defensive plan which fully exploits both offensive and defensive operations to deter, disrupt
and deny a hostile actor the opportunity to initiate such an operation. Current C-UAS technologies will
offer timely warning of such an event, but the ability to track significant numbers of Class I UAS and
affect their operation will be severely limited. Swarming may be conducted in a number of methods,
of which there are 2 main categories:
a. Dumb swarmTime coordinated, large number UAS missions. Dumb swarm is a tactic in
which multiple UAS are separately flown to a predetermined common goal via Global
Navigation Satellite Systems (GNSS) waypoint or terrain navigation on autopilot, or by
human operators in real time. In-flight activity is co-ordinated only during pre-mission
(human) planning and cannot readily respond to a changing situation without additional
operator intervention, except through limited pre-programmed responses.
b. Smart swarm. A smart, or ‘true’ swarm is an adaptive group of UAS operating within a
self-organising network as a single autonomous or semi-autonomous UAS. It has the ability to
assess a situation (including the actions or loss of other UAS) and respond without operator
intervention. A smart swarm will automatically adjust individual UAS roles to maintain the
overarching central mission aim, using some form of internal communication system across
the swarm.

Swarming UAS may be further characterised by the TTP used to fly the swarm including:
a. Tight swarm. Tight swarms are following more or less the same basic course and might
appear as single, large sensor target. Tight swarm has less than 90° arrival angle (whole front
hemisphere of the swarm), narrow approach angle and/or separation close enough for single
shot mitigation. Challenge is single target discrimination and numbers.
b. Loose swarm. Loose swarm exploit multiple access attacks and has greater than 90° arrival
angle and greater than 3 metres separation, minimising the scope for single shot mitigation.
Challenge to defender is the need to engage at the same time multiple targets in often opposed
direction.
c. Mixed swarm. Mixed swarm is a mix of small UAS types, target, size, and function (eg
rotary, fixed wing, armed, ISR only, dark, RF-enabled). Can be in conjuctionconjunction with
tight and loose swarms and even mixed with non autonomousnon-autonomous or coordinating
UAS.

NATO UNCLASSIFIED Page 24

NATO UNCLASSIFIED

NATO UNCLASSIFIED Page 25

 NATO UNCLASSIFIED

2.5 ENEMY TACTICS, TECHNIQUES AND PROCEDURES

2.5.1 Class I UAS flight profiles and TTPs continue to mature rapidly to exploit both technological
enhancements and current defence vulnerabilities in the deployed operating environment. The threat
from UAS must not be regarded as purely a kinetic one but a broad range of potential threats which
may present a risk to life, safety, information or reputation. Therefore, commanders and staff at all
levels must think laterally and innovatively to the varied challenges of Class I UAS to military
operations. The impact of an asymmetric quick-win, information operations Class I UAS attack and
subsequent reputational damage could be as much of a compromise to military operations as a more
traditional form of attack. Furthermore, the complexity of C-UAS defence will only increase as local
airspace becomes more congested with the legitimate use of recreational and commercial Class I UAS.
Such systems ease of use, proliferation, automated flight profiles and limited detection and
engagement opportunities must all be considered and mitigated against where possible, whilst
minimising the impact on military objectives and the safe delivery of operations.

2.5.2 Different tactics, techniques and procedures (TTPs) have been observed on potential adversaries,
ranging from tactical observation and targeting to disrupting infrastructures and networks. Both
asymmetric and symmetric concepts have been studied and quoted according to threat levels and the
types of platforms fitted for the attack.

For each scenario, two categories of TTPs are described:

• Reactive attacks: behaviour that necessitate little to none planning or plotting. These attacks
are based on openings and opportunities.
• Proactive attacks: elaborated and more sophisticated attacks that need reconnaissance and
planning activities. These can involve feinting, masquerading and the use of decoys.

Each category is quoted according to a classical risk analysis method:

• Risk occurrence (that represents the level of probability) can be mitigated by some
operational constraints, target access or technology feasibility. Risk occurrence is quoted
according to a mitigation indicator. The higher the indicator; the higher the occurrence risk.
For example, UAS speed, range, accuracy, and its payload capabilities may drastically
decrease the risk of occurrence if there is no attack plan.

• Effect gravity is quoted by the damage to the friendly forces: panic effect, loss of
communication assets, critical targets and so on.

Five TTPs have been selected and are described below, as illustrated in Figure 5:

• Attack or false attack by single or multiple low cost UASs with limited or advanced
capabilities (reactive) leading to panic effects,
• Vulnerable Target / Very Important Person (VIP) targeting (proactive),
• Highjack fleet of commercial UASs (proactive),
• Infrastructure disruption (reactive/proactive),
NATO UNCLASSIFIED Page 26
 NATO UNCLASSIFIED

• Saturation
attacks
(proactive)
for COMINT
or RADINT.

All these
scenarios can
be realized by a
large set of different
platforms.

2.6 ENEMY COURSES OF ACTION

2.6.1 The enemy courses of action (ECOA) are represented using a schedule of events and a template
for courses of action matching the different TTPs, including preparatory planning. This corresponds to
worse case compound attacks, with two waves of swarming UASs, one for defence disruptions and
one for the terminal attacks over multiple targets. It divides the enemy plans in the following phases:

• Intelligence collection,
• Offline planning,
• Preliminary deployment,
• Hot planning,
• Deployment, primary targets strike,
• Secondary targets.

This ECOA template complements the TTPs description, from an execution point of view. An ECOA
describes which agents operate and provide a typical schedule in months or hours. There are
preconditions to check for running an action, the post-conditions (or expected effects), and the critical

NATO UNCLASSIFIED Page 27

 NATO UNCLASSIFIED

parameters. Contingencies are events that may jeopardize the realization of an action. Go/No-go
decisions are contingent since they are decided according to the operational context and assessment of
the success of previous actions set.

2.6.2 We assume that the adversary would be organized as follows:

• An Intelligence team, in charge of targeting,

• A command team, in charge of command and control during the attack phase,
• Teams of controllers that actually operate the UASs.
• A system for finance, procurement, construction, training, deployment and adaptation.

The NATO Industrial Advisory Group SG -188 showed in a report that each ECOA action signature
could be broken down into several types of sub-signatures:

• Human: related to human footprint

• Visibility: related to UAS detection with optronics or human eyes
• Infrared: related to thermal detection
• Radar: related to active detection in the radar spectrum
• Communication: related to enemy COMINT

Each signature is assessed on a scale of high/medium/low. Note that the most discrete attacks are not
necessarily the reactive ones. Most of the signatures are revealed after a period.

NATO UNCLASSIFIED Page 28

 NATO UNCLASSIFIED

2.47 CLASS I UAS VULNERABILITIES

2.47.1 Introduction. Whilst Class I UAS offer a considerable range of options for a potential hostile
operator to disrupt, deny or attack military friendly operations, the vast majority of these systems are
commercial off-the-shelf (COTS), modified COTS or assembled from COTS components. Limitations
such as poor weather, high winds and fragility which affect most airborne systems pose a greater
limitation, in particular to the smaller Class I UAS (mini and micro), Class I UAS nonetheless have a
range of vulnerabilities that constraining their use and offering opportunities for the delivery of
effective C-UAS operations. Layered and integrated C-UAS effects, activities and measures should
seek to exploit these Class I UAS weaknesses to reduce the risks to friendly forces operations.

[a.] Technological limitations. Class I UAS are limited by current battery and engine technologies,
and dependency on both GPSGNSS, INS and an effective RF link to operate. The Class I Multi-
Rotor UAS that currently dominate the commercial market use modern LiPo batteries which, when
in perfect condition, can offer up to 30 minutes’ flying time. However, battery usage, ambient,
weather conditions and build quality will all affect the quality of the battery and its performances
factors. In essence, not all Class I UAS batteries are made the same and vary significantly in
performance. Moreover, smart batteries that provide the operator with a battery performance
indication, are limited to high end Class I UAS. Therefore, operators of cheaper, smaller UAS will
have to estimate flying time prior to operation. An experienced operator of a high-end Class I UAS
will usually initiate recovery procedures at 25% (indicated) of battery life, thus limiting flying time
to between 20 and 25 minutes. Furthermore, battery life will be significantly affected by
meteorological conditions; cold batteries generally perform less effectively than warm batteries. In
addition, these systems will use significantly more battery life in high-wind conditions to maintain
stability, particularly when in the hover. Future developments in Class I UAS technology will seek
to overcome these limitations and will require C-UAS activities to be constantly reviewed, updated
and amended to reflect increasingly capable UAS which are able to fly longer, further or without
GPSGNSS, or use frequency hopping techniques to overcome C-UAS measures.

a.[b.] Meteorology. Given the inherent vulnerabilities of Class I UAS, meteorology will be an
important determinant of the likelihood of a Class I UAS event. While weather affects all air
vehicles, the effects of wind, rain and cold weather can have a significant impact on the smaller
sized Class I UAS. Table below provides the likelihood of a Class I UAS event based on several
meteorological factors. This table can be used as a guide when determining the potential for
adversary Class I UAS activity

Factor Good Marginal Poor

NATO UNCLASSIFIED Page 29

 NATO UNCLASSIFIED

Wind 0 – 18 km/h 19 – 37 km/h 38 km/h +

Temperature > 10 °C 0 - 10 °C < 0 °C
Light Day - Night
Visibility > 500 m 150 – 499 m 0 - 150 m
Precipitation 0 – 40 % 40 – 70 % > 70 %
Cloud Cover 0 – 40 % 40 – 70 % > 70 %
Table xx Class I UAS Flying Conditions

Class I UAS operations will be limited by weather. Most COTS Class I UAS do not offer an all-
weather, day/night capability at present. Visibility, wind strength, temperature and general weather
will all impact on the operational capability of a Class I UAS. The majority of COTS systems are
not designed to operate in inclement weather and are highly susceptible to water ingress
penetration, which can adversely severely affect the engines and internal electronic components.
GCS Control handsets are often not waterproofed. Therefore, many Class I UAS will not perform
effectively in rain, snow and fog. Moreover, such conditions will also make the operation of Class I
UAS difficult for the operator who will struggle to maintain visual line-of-sight with the device in
such conditions. Optical devices may become ineffective due to water droplets, snow or misting on
the lens cover. Cold weather conditions will also adversely impact on the ability to operate a Class
I UAS: the asset is highly likely to require significantly longer to ‘warm-up’ and stabilise prior to
take off, making an operator vulnerable when preparing the system for operation. In very cold
conditions, Class I UAS will often not take-off at all and remain in stand-by mode only. Such
systems will also struggle to operate in very high winds as they continuously use high engine loads
to maintain position or fly into wind. In the event of a lost GPS signal in such conditions, the
operator is highly unlikely to be able to maintain effective control of the device, which could be
lost and/or destroyed in a subsequent uncontrolled landing or collision with surrounding
obstructions. Furthermore, in exceptionally still conditions Class I multi-rotor UAS are susceptible
to a condition known as Vortex Ring State, whereby zero wind and a hover or vertical descend
creates a turbulent airflow around the rotor blades which engulfs the rotors and leads to a
catastrophic loss of lift.

[c.] Operating environment. Whilst ambient meteorological conditions are a significant limitation on
Class I UAS operation, such devices are also significantly restricted by ambient electro-magnetic
conditions. Typically, Class I UAS operate on a principle of creating a local RF network between
the Ground ControlS and the device. Manufacturer specifications of the maximum effective range
of their product is based on ideal RF conditions and minimal background EM activity. Class I UAS
operating within a high EM environment such as an urban location will likely see significant
reductions in effective range. This will limit the operational effectiveness of the device which will
then initiate self-recovery procedures to the point of launch when the RF signal is lost. Class I UAS
are also dependent on a strong GPS GNSS signal to operate safely as the device uses GPS GNSS
signals not only for navigation purposes but also to provide stabilisation in flight. Whilst an
experienced operator can fly under lost-GPSGNSS conditions, such flying is challenging, rapidly
reduces battery life and will necessitate the immediate recovery of the asset which will be difficult
to control and land safely.

NATO UNCLASSIFIED Page 30

 NATO UNCLASSIFIED

[d.] Targeting the operator. Whilst certain vulnerabilities of Class I UAS described above can be
mitigated by the use of First Person View (FPV) goggles to increase operator effectiveness, these
also add to the potential vulnerability of the operator as a critical element of the Class I UAS
system. FPV allows the operator to ‘see’ the image from the UAS optical camera and ‘fly’ the
device from the perspective of being on-board the system. This reduces the dependence on
additional tablet devices as part of the GCS to receive images from the Class I UAS. Whilst there
are considerable benefits to flying FPV, this severely restricts the wider situational awareness of
the operator, often requiring the support of additional personnel to provide observation and security
functions, thereby increasing the footprint of the UAS team . An observer provides a number of
advantages to effective Class I UAS operations. The operator can focus on the safe control of the
device whilst the observer can provide command and control of the task, monitor the optical
images, maintain visual line of sight of the device, offer close protection to the operator and assist
in the safe deployment and recovery of the Class I UASand, consequently, exposing to a higher
risk of detection..
[e.]
[f.] High Value Assets (HVA). Despite technological developments making Class I UAS increasingly
simple to operate in a benign environment, the safe, effective tactical operation of such devices is
challenging and requires a high degree of operator tactical awareness. Experienced UAS operators
may be considered to be HVA following comprehensive training, often at considerable expense.
Therefore, hostile actors might take all necessary precautions to minimise the risk to the operator
and not unnecessarily compromise operational security.
C-UAS operators should seek to deny a UAS operator a safe, benign environment in which to
conduct a hostile UAS task. High-end Class I UAS (such as a DJI Mavic Pro, DJI Inspire or Autel
Evo 2) are likely to be regarded as HVA by some Class I UAS teams. Therefore, a Class I UAS
operator is likely to take all reasonable precautions not to compromise the safety of the device
during any task. This could restrict the circumstances in which a hostile UAS task can be
conducted, reduce flight options such as avenues of approach and restrict operator freedom of
manoeuvre. Effective C-UAS activities should therefore offer a considerable deterrence effect to a
Class I UAS operator, who will be under pressure to ensure own security and the safety of the
device. Furthermore, like all aviation systems, Class I UAS are inherently fragile, being prone to
cracked airframes, chipped or cracked propellers which become brittle with age, failed camera
gimbals and blocked sensors. Engines can be easily clogged by dust or sand and optical devices are
sensitive to rough handling. Therefore, Class I UAS must be carefully handled on the ground,
carried in protective cases and cannot be handled robustly at any time.

[g.] Fixed Wing Class I UAS. Whilst multi-rotor Class I UAS dominate the commercial market and
are generally regarded as the preferred choice of device to exploit for malicious, reckless or
negligent purposes, the capabilities of fixed wing Class I UAS must be considered in any C-UAS
planning. Fixed wing Class I UAS offer the operator a number of key advantages including
increased range and endurance, increased autonomy in flight and a very stable platform from which
to conduct ISR tasks with enhanced optical sensors. Moreover, airframe flexibility enables the
device to be operated as a multi-role platform and payloads can be increased to maximise the
potential effects of a kinetic Class I UAS event. Signature wise fixed wing Class I UAS usually are
a more difficult target to detect. However fixed wing Class I UAS are may not be a perfect solution

NATO UNCLASSIFIED Page 31

 NATO UNCLASSIFIED

and present a range of tactical challenges to the operator. Besides self-made fixed-wings UAS, in
general they are :
[h.] Operator vulnerability. Aa significantly larger, more complex system which cannot be easily
concealed; they , fixed wing Class I UAS are usually more fragile and take more time to prepare
for flight. They may also require a larger site for take-off and landing, restricting the options for the
operator in the tactical operating space, despite the fact that Vertical Take-Off and Landing
(VTOL) is being implemented to small fixed wings drones, for commercial practicality. In
generalAdditionally, fixed wing Class I UAS may require additional further support, usually a
minimum of a 2-man team, creating a larger network to target.

b. C-UAS Sensors and Effectors vs Class I UAS characteristics. Based on current C-UAS
resources, the following generic tables have been provided, to compare sensors and effectors
effectiveness with Class I UAS characteristics and mode of operation:

Tilt wing and other VTOL concepts are emerging that remove some of those vulnerabilities.
Operator complexity. Fixed wing Class I UAS are more complex to operate and require a
higher degree of pilot training and flying ability. They are unable to hover and can be
severely affected by adverse meteorological conditions. Both take-off and landing require a
high degree of skill to achieve successfully and to minimise the risk of damage to the
airframe.
Cost. Fixed wing Class I UAS are may be more expensive to purchase, and specialist high-end
equipment options are more difficult to procure for specific airframe types.

Table xx Sensors vs Class I UAS

NATO UNCLASSIFIED Page 32

 NATO UNCLASSIFIED

Table xx Effectors vs Class I UAS

NATO UNCLASSIFIED Page 33

 NATO UNCLASSIFIED

2.5 FINAL CONSIDERATIONS

2.5.1 Introduction. Due to the low, slow and small signature of Class I UAS and the low-noise
propulsion that some of them have, detecting and recognizing these assets poses a great challenge to
friendly forces.
Depending on weather conditions, most of the times reconnaissance is only possible at short distances
(300- 800 m), recognition without optical aids only at distances of less than 300 m.
When UAS can be heard, it generally means that they are already close to friendly units.
Due to the small radar cross section of mini and micro UASs, reconnaissancedetection by forces
capable of radar surveillance is often difficult. Consistent implementation of permanent passive air
defence measures to protect against threats posed by UAS is essential because of short warning times
in the reconnaissance of mini and micro UAS.
Thermal imagerssensors are suitable for UAS reconnaissancedetection under most visibility
conditions. In general, their performance during daylight hours at close and medium distances is
similar to the range of daylight real-image visual aids. In limited visibility and at long distances, they
are more efficient than daylight real-image visual aids.
Since Class I UAS operators often need direct visual contact to the UAS for control and data
transmissions, operator localization should be performed after recognition of the UAS.

2.5.2 Future C-UAS operations will be further complicated by the exponential growth in the
legitimate commercial use of UAS across society. Such systems have the ability to transform the way
society operates and offer significant positive economic and social benefits. They are likely to be
operated in a number of critical areas, including law enforcement and emergency response, security,
logistics, infrastructure and civil engineering and even personal transport purposes. This growth in
commercial UAS operations will pose significant challenges to the effective delivery of military C-
UAS operations. A congested airspace will offer opportunity for malicious UAS operators to mask a
hostile UAS act within this congested operating space. Therefore, the ability to positively identify and
track hostile Class I UAS without the aid of appropriate technology and traffic management systems
will prove difficult. Moreover, the potential for UAS air proximity events with low flying manned
fixed wing or rotary aircraft will also increase. Personnel conducting C-UAS activities will require an
increased understanding of the airspace where they are operating. An awareness of future Unmanned
Traffic Management (UTM) systems which provide critical flight safety information will be essential.
This will assist in the timely identification of potential hostile operations in a complex and dynamic
UAS operating space.
Finally, legitimate hobbyist use of Class I UAS will also increase significantly. Despite mandated
licensing and training requirements, there will inevitably be an increased risk of accidental incursion
of non-hostile UAS in close proximity to military locations and operational areas. This will require
proportionate responses in order not to create negative operational effects which could have
unintended consequences such as reputational damage, reduced freedom of manoeuvre in the
operational space or the requirement to provide compensation for loss of private property.
The rapid technological advancement of UAS technology will challenge the ability of personnel to
track, identify and react to a potential UAS threat. The evolution of new engine and battery technology
will increase the endurance of Class I UAS from minutes to hours allowing Class I UAS to travel
further and loiter using pre-set way points and flight profile programmes which already enable UAS to
identify and track specific targets or record images of specific locations. Such technological

NATO UNCLASSIFIED Page 34

 NATO UNCLASSIFIED

developments will also allow these systems to operate in more demanding meteorological conditions
than is currently possible, which will offer the operator a broader range of operating conditions than
are available with current technology.
Exploitation of telecommunication networks (e.g. 5G) and frequency-hopping techniques will further
complicate the delivery of effective C-UAS operations. Furthermore, Class I UAS are also likely to
increasingly adopt biomimetic technologies which copy the natural world to achieve more efficient
methods of flight. Such technologies will make these systems increasingly harder to positively identify
and distinguish from indigenous wildlife such as birds and even insects. Hybrid UAS technologies will
seek to combine both fixed wing and multi-rotor design strengths to enhance key performance factors
such as range, endurance and operator flexibility

2.7 General remarks

- add a paragraph on loitering munition
- add something about future technologiesadd a
- Describe vulnerabilities in terms of detection and effectors technologies. Generic types of
systems.
- Use a similar table as in 3.1

NATO UNCLASSIFIED Page 35

 NATO UNCLASSIFIED

2.[3.] PROTECTION MODEL

2.1[3.1] CONCEPTUAL MENTAL MODELS FOR C-UAS PLANNING & EXECUTION

Figure 1: CUAS Spectrum of Operations

The above figure shows a spectrum of consideration from left to right to understand the levels of
complexity involved, from simple (left side) to complex/complicated (right side). For example, a
homeland Spectrum of Operations might look like:
 linear technological advancements wherein it is difficult for an adversary to obtain certain
capabilities
 might have more restrictive engagement authorities
 may involve careless/reckless operators
 wherein the risk to protected assets might be medium
 but the mission might be more force protection focused

NATO UNCLASSIFIED Page 36

 NATO UNCLASSIFIED

 the airspace ecosystem would likely be complex congested

 and many agencies could have overlapping areas of responsibility
 human involvement would include all stages of targeting & execution
 the resource or formation protected would be static
 and the focus would be area defense
 in an urban location
An expeditionary environment, on the other hand might look like:
 Exponential Growth in adversary capability
 Leading to less restrictive engagement authorities
 Due to intentional/malicious actors
 Where the risk to protected assestsassets would be high
 And the mission is more focused on Air Defense
 In an uncomplicated airspace ecosystem
 Machines would handle the targeting cycle but humans choose to execute
 The resource or formation protected would move dynamically throughout the battle area
 With a focus on point defense in specific sectors
 In a rural location
In which the military would have the leading/coordinating role

Detect & Track

Report Identify

Mitigate/
Recover/Exploit
Defeat

Figure 2: CUAS Operations Cycle

2.2[3.2] PROTECTION MODEL CATEGORIES

a. Active. The active coordination area involves measures, tasks, and activities to deter, prevent,
nullify, or reduce the effectiveness of an adversary efforts to observe, surveil, document

NATO UNCLASSIFIED Page 37

 NATO UNCLASSIFIED

movement, attack, and to counter hazards. These are primarily proactive in nature with the
core functions to provide a defence against a perceived or actual threat, and when necessary,
find, fix, and strike threats and hazards before they are realised, with the intention to further
exploit the situation wherever possible; multi-mode, layered defence is critical for mission
success.
b. Passive. The passive area involves measures, tasks, and activities to negate or minimize the
effects of enemy attacks and hazards on NATO assets by making them more survivable.
Passive measures, tasks, and activities should be proactively employed prior to any adversary
activity materializing. For the purpose of C-UAS, Passive includes both measures and sensors.
Passive measures require no specialized equipment and include common air defense/force
protection measures such as detection, warning, camouflage, concealment, deception,
dispersion, and sheltering. Passive Sensors, on the other hand, are any C-UAS sensors that do
not emit a signature measurable by adversary signals intelligence. Examples include acoustic
sensors and Electro-Optical/ Infrared Radiation Sensors. The advantages of passive measures
and sensors are the cost, relative ease of deployment, and ability to detect without spotlighting
the location of the command post/operations center; the primary disadvantage, however, is
that passive sensors are inherently reactive—that is to say that they place friendly forces in the
position of reacting and allowing the adversary to take the initiative and potentially shape the
battlespace.
c. Recuperation/Recovery. The protection model should include an overall plan for NATO-led
forces and installations to resume their primary operational roles following the effects of
adversary action. Recuperation covers those measures, tasks, and activities necessary for the
force to recover, restore essential capabilities, and enable operations to continue, with the
minimum of disruption and in the minimum possible time. Recovery may include seizure and
exploitation (in accordance with STANAG 6502 Technical Exploitation) of any and all UAS
components.

NATO UNCLASSIFIED Page 38

 NATO UNCLASSIFIED

[3.3] PROTECTION MODEL

a. The protection model against Class I UAS threat defined in this document is built on top
of four pillars:
(1) Prevent,
(2) Situational Awareness,
(3) Respond, and
(4) Post Event Actions.

Detect & Track

Report Identify

Mitigate/
Recover/Exploit
Defeat

Figure 2: CUAS Operations Cycle

b. With reference to the generic AD model, observation activities such as detect, track, classify
and identify have been grouped under a category dealing with the situational awareness. The
response step has been further de-composed in elements, to better describe level of response
adopted to prevent a threat Class I UAS from completing its mission.
(1) Prevent: it is defined in the C-UAS context as the measures taken to reduce the
likelihood of an event occurring and to minimize the effects when an event has
occurred. Vital to the effectiveness of these measures is the existence of a credible
threat of unacceptable counteraction. Potential adversaries should perceive that NATO
forces have the capability to conduct and sustain offensive and defensive operations.
This is best achieved through the possession of forces properly trained, organized, and

NATO UNCLASSIFIED Page 39

 NATO UNCLASSIFIED

equipped to counter Class 1 UAS threats. Ensuring easy integration into IAMD
architecture may ensure rapid transition from small UAS threats to larger, one-way
attack UAS threats. This may include both active and passive measures, such as:
a. Laws and regulations, authority and permissions
b. Geofencing
c. Warning signs
d. Pilot certification
e. Intelligence
(2) Situational Awareness: measures should be developed to identify the presence of an
object or an event of possible military interest. Detection may arise through
observation of the operational area or through deductions made following an analysis
of the operational area. This includes:
a. Detect: the discovery by any means of the presence of a Class I UAS or
person operating;
b. Track: display or record the successive positions of a moving object or
association of multiple detections of a single Class I UAS as it moves in space
and time;
c. Classify: the determination of the main characteristics of a Class I UAS (size,
speed, payload, type, type of guidance, azimuth);
d. Identify: determine the intent of the Class I UAS Mission (friend, neutral, foe,
neutral)

(3) Respond: the response to UAS threat is defined as measures to neutralize, isolate,
contain, and resolve a specific UAS threat. In other words, taking corrective actions in
accordance with the ROEs. The response includes Defeat, Deter, Destroy, and
Capture.
These types of responses are defined as:
a. Defeat: to diminish the effectiveness of an enemy or adversary to the extent
that he is unable or unwilling to resist or achieve its intent
b. Deter: to convince a potential aggressor that the consequences of using Class
I UAS threats would outweigh the potential gains. This requires the
maintenance of a credible military capability and strategy with the clear
political will to act
c. Destroy: to damage something so badly that it cannot be used
d. Capture: To take possession of enemy personnel, materiel and/or information

(3.1) Responses are commonly implemented through humans or equipment effectors,

which may include:

a. Jam (including GPSGNSS), kinetic, nets, spoofing.

NATO UNCLASSIFIED Page 40
 NATO UNCLASSIFIED

b. Isolate: when defeated, measures should be developed to isolate the downed

Class 1 UAS and consider it as an Explosive Ordinance Disposal (EOD)
risk until cleared. Furthermore, once cleared, it should be isolated and
secured for possible attribution and exploitation (in accordance with
STANAG 6502 Technical Exploitation) between the tactical and
operational levels.
c. Deny: measures should be taken to render a threat incapable of interfering
with operations. This includes the effective employment of coordinated,
synchronized, layered and multi-modal offensive and defensive measures,
as well as measures to counteract hazards.
d. Defend against: the asymmetric nature of terrorist tactics should be
considered by Commanders and Staffs when planning and implementing C-
UAS measures, tasks and activities, as well as the willingness of State
actors to use UAS for activities such as but not limited to EW, ISR, artillery
spotting, direct attack, or loitering munitions.
e. Defeat/Destroy: non-lethal and lethal use of force can be employed in a
CUAS role if authorized by the mission ROEs. Use of force has to be in
accordance with applicable international laws, especially, but not limited to,
the principles of distinction, military necessity, proportionality and
humanity. Non-lethal capabilities provide an additional level of escalation
and can be used in a C-UAS role to minimize civilian casualties and reduce
collateral damage.
f. Recovery: recovery actions may include, but are not limited to, EOD
declaring a downed UAS safe, executing published capability and
technology exploitation (in accordance with STANAG 6502 Technical
Exploitation), actor attribution procedures, providing medical care, and
beginning damage assessments. Recovery proceeds concomitantly with
reporting.

(4) Report: reporting is broken down into ‘operations reporting’ and ‘analysis reporting’:

a. Operations reporting should inform local Commanders and immediate

operational oversight organisations of potential UAS events that could impact
friendly operations, be indicative of an adversary’s intent or an unknown
hazard presented by a neutral party. This reporting should be consistent with
operational commander’s critical information requirements and transmitted in
accordance with published guidance.
b. Analysis reporting into a single, integrated database allows a CenterCentre of
Excellence or higher echelon unit to analyze UAS events across multiple
commands, geographic areas, or installations to potentially identify adversary
trends and TTPs, ascertain C-UAS system effectiveness, identify capability
gaps, and develop appropriate NATO C-UAS operational TTPs to counter the
UAS threat.
(4.1) UAS events are broken down into Incidents, Hazards, Incursions, and Engagements:

NATO UNCLASSIFIED Page 41

 NATO UNCLASSIFIED

a. Incident: any occurrence where UAS(s) present(s) a hazard or threat

to a NATO mission, installation, facility, or asset.
b. Hazard: a careless of unknowing operation of a sUAS without
apparent intent.
c. Incursion: any occurrence where UAS(s) penetrate established
airspace boundaries of a NATO installation, facility, asset, or
protected airspace of a mobile asset.
d. Engagement: employment of any counter-UAS system against a
known or perceived UAS.
(4.2) Of note: Quality and Speed of Upchannel Reporting is of great importance in
whichever format reports are submitted as a good description of the event or
action will assist in informing higher echelons’ decisionmaking.
c. Analysis reporting can consist of information received by visual observation
or validated system detection see Annex X “Small Unmanned Aircraft System
Reporting Execute Order”
c.

Detect

Exploit** Track

Resume/Recover* Identify

Report Decision Making

Mitigate

d. *Optional, if conditions permit recovery

e. ** Optional, this would be time consuming and may be
Figure 2: Ideal C-UAS Operations Cycle
1. Detect: Detect: the discovery by any means of the presence of a Class I UAS or person
operating;
2. Track: display or record the successive positions of a moving object or association of multiple
detections of a single Class I UAS as it moves in space and time;
3. Identify: determine the intent of the Class I UAS Mission (friend, foe, neutral)

NATO UNCLASSIFIED Page 42

 NATO UNCLASSIFIED

4. Decision Making: Countering Class 1 UAS’s, as previously stated, is dynamic and must be
done rapidly for effective defence of assets, personnel, and critical facilities. Where possible,
authorities should be delegated to a battle captain, watch officer, or troop leader to make the
decision for countering the threat. Considerations for the delegation of authority should be
based on: tactical expertise, knowledge of critical assets, legal authorities and jurisdictional
lines, base security zones and base boundaries, training, mission set, and processes for
determining hostile intent.

Country
Regulations

Base SOFA agreements

Jurisdiction
Commander Legal authority to counter UAS's

Training on technology and procedures

FP Commander Coordinating with HN for periodic training and policy
on response measures

Critical asset / facilities locations

Threat mitigation measures
Battle Captain /
Employment of technology
Watch Officer / Coordination of response with during incident
Troop Leader Cantainment location
Notifications

Figure 3: Example Engagement Authority Flowchart

5. Mitigate: UAS, particularly Class One, are considered a feature of the battlefield and thus are
no longer considered something to defeat, but instead something to keep in mind for limiting
the impact to mission. Kinetic and non-kineticsystems can be employed in a CUAS role if
authorized by the mission ROEs. Use of force has to be in accordance with applicable
international laws, especially, but not limited to, the principles of distinction, military
necessity, proportionality and humanity. Non-lethal capabilities provide an additional level of
escalation and can be used in a C-UAS role to minimize civilian casualties and reduce
collateral damage.
6. Report: operations and analysis reporting: consider on a timeline. Operations reporting
provides immediate notification to leadership whereas analysis reporting finds trends and
commonalities over a longer period.
7. Resume/Recover: There are two, concomitant, processes. The obligatory resume is resuming
normal operations following the mitigation of the threat (E.g. individuals under cover leave
hardened facilities and resume their duties). The optional recovery process is gaining physical
control of any remnants of the adversary UAS (note: assume any downed UAS is a potential
improvised explosive device; do not attempt recovery options until cleared by Explosive
Ordinance Disposal).
8. Exploit: Optional step to analyse remnants for any information of value (E.g. electronic
systems, unexploded munitions, airframe).

NATO UNCLASSIFIED Page 43

 NATO UNCLASSIFIED

a. Prevent-Measures should be developed to deter adversarial actions. Vital to

the effectiveness of these measures is the existence of a credible threat of
unacceptable counteraction. Potential adversaries should perceive NATO
forces have the capability to conduct and sustain offensive and defensive
operations. This is best achieved through the possession of forces properly
trained, organized, and equipped to counter Class 1 UAS threats. Ensuring
easy integration into IAMD architecture may ensure rapid transition from
small UAS threats to larger, one-way attack UAS threats.
[a.] Detect-Measures should be developed to identify the presence of an object
or an event of possible military interest. Detection may arise through
observation of the operational area or through deductions made following an
analysis of the operational area.
[b.] Isolate-When defeated, measures should be developed which isolate the
downed Class 1 UAS as an Explosive Ordinance Disposal (EOD) risk until
cleared. Furthermore, once cleared, it should be isolated and secured for
possible attribution and exploitation (in accordance with STANAG 6502
Technical Exploitation) between the tactical and operation levels.
[c.] Deny-Measures should be taken to render a threat incapable of interfering
with operations. This includes the effective employment of coordinated,
synchronized, and layered and multi-modal offensive and defensive measures
as well as measures to counteract hazards.
[d.] Defend against- The asymmetric nature of terrorist tactics should be
considered by commanders and staffs when planning and implementing
CUAS measures, tasks, and activities as well as the willingness of state actors
to use UAS for activities such as but not limited to EW, ISR, artillery
spotting, direct attack, or loitering munitions.
[e.] Defeat/Destroy-Non-lethal and lethal use of force can be employed in a
CUAS role if authorized by the mission ROE. Use of force has to be in
accordance with applicable international law, especially, but not limited to,
the principles of distinction, military necessity, proportionality and humanity.
Non-lethal capabilities provide an additional level of escalation and can be
used in a CUAS role to minimize civilian casualties and reduce collateral
damage.
[f.] Recovery- Recovery actions should include, but are not limited to, EOD
declaring a downed UAS safe, executing published capability and technology
exploitation (in accordance with STANAG 6502 Technical
Exploitation)/actor attribution procedures, providing medical care, and
beginning damage assessments. Recovery proceeds concomitantly with
reporting.
ANNEX x : REPORTINGeport- (CUI//REL FVEY, NATO, AUT, CHE, FIN, IRL, SWE)
Reporting is broken down into operations reporting and analysis reporting

NATO UNCLASSIFIED Page 44

 NATO UNCLASSIFIED

[(2)] Operations reporting should inform local commanders and immediate operational
oversight organisations of potential UAS events that could impact friendly operations,
be indicative of an adversary’s intent or an unknown hazard presented by a neutral
party. This reporting should be consistent with operational commander’s critical
information requirements and transmitted in accordance with published guidance.
[(3)] Analysis reporting into a single, integrated database allows a Center of Excellence or
higher echelon unit to analyze UAS events across multiple commands, geographic
areas, or installations to potentially identify adversary trends and TTPs, ascertain
CUAS system effectiveness, identify capability gaps, and develop appropriate NATO
CUAS operational TTPs to counter the UAS threat. UAS events are broken down
into: Incidents, Hazards, Incursions, and Engagements:
[a.] Incident: any occurrence where UAS(s) present(s) a hazard or threat
to a NATO mission, installation, facility, or asset.
[b.] Hazard: a careless of unknowing operation of a sUAS without
apparent intent.
[c.] Incursion: any occurrence where UAS(s) penetrate established
airspace boundaries of a NATO installation, facility, asset, or
protected airspace of a mobile asset.
[d.] Engagement: employment of any counter-UAS system against a
known or perceived UAS.

RAnalysis reporting can consist of information received by visual observation or validated system
detection and should include information such as:
Incident or incursion reports should be completed within in a timely manner (ideally, US direction is
within 24 hours) and should include:
(1) Base or Facility Name; State/Province, Country
(2) Date Time Group (DTG) of incident or incursion (UTC/GMT) and duration:
DDHHHH UTC/GMT MMMYYYY
(3) Reporting Geographic Area: Location
a. Reporting Strategic Command
[b.] Which Reporting Operational/Tactical Command
(4) Unit/Organization Contact Information (Unit/Organization, Name, Rank/Grade,
Email, Phone Number)
(5) Location of the Incident
a. Geo-location (MGRS/Lat Long)
b. Location Name (standardise naming convention)
(6) Environment (Country/Theatre/International Waters)

NATO UNCLASSIFIED Page 45

 NATO UNCLASSIFIED

(7) Total Number of UAS detected (1-XXX)

(8) First Detection: Outside installation/Outside installation- Restricted Area/ Within
Installation- Within Installation/Within Installation- Restricted Area/ Mobile
(9) Detection Method: Visual/Radar Electronic/ EO-IR/ Acoustic/ Other (eg. external
reporting)
(10) UAS Airframe: Fixed Wing/ Rotary/ Unknown/ Other
(11) UAS Detailed Description: number of rotors, number of lights, light pattern
(solid/blinking), Color of lights, Payload, movement pattern etc
(12) CUAS Equipment Operational: Yes/ No/ Unknown/ N/A
(13) UAS engaged: Yes/ No/ N/A
(14) UAS Incident or incursion has a mission impact (Commander’s assessment)
Yes/No
(15) UAS Incident or incursion unsafe/unprofessional: Yes/No (Commander’s
assessment)
(16) UAS Incident narrative to include detailed information on CUAS system of
systems detection and tracking effectiveness

Reporting of an engagement (the employment of any C-UAS capability, kinetic or non-kinetic) should
be completed within in a timely manner (ideally,US direction is within 48 hours) and should include:
(1) Base or Facility Name; State/Province, Country
(2) Date Time Group (DTG) of engagement (UTC/GMT) and duration: DDHHHH
UTC/GMT MMMYYYY
(3) Total time of initial/Follow-on Engagements: HHMM
(4) Type of Engagement: RF (C2)/Kinetic/C-PNT/Other
(5) CUAS Engagement Effective? Yes/ No/ Unknown
(6) Any confirmed electronic/ collateral affects from CUAS system? Yes/ No/ Unknown
(provide details in narrative)
(7) Was UAS confiscated and/or captured? Yes/ No/ Unknown (Provide details in narrative)
(8) Attribution: was the UAS operator located and/or interviewed? Yes/ No/ Unknown/ N/A
(provide details in narrative)
(9) Controlling aviation authority notified? Yes/ No
(10) Is video and/or photo available? Yes/ No/ N/A
(11) UAS engagement narrative

General remarks
NATO UNCLASSIFIED Page 46
 NATO UNCLASSIFIED

- Align the Protection Model with the Handbook

- Reporting:
o Move some of the prescriptive information in annexes
o Quality of reporting is important, good description of the event/action is important
o More descriptive on operational reporting and other types of reporting
o Add explicit description before

NATO UNCLASSIFIED Page 47

 NATO UNCLASSIFIED

3.[4.] STRATEGIC CONSIDERATIONS

3.1[4.1] INTRODUCTION

STRATEGIC ENVIRONMENT
TECHNOLOGICAL IMPACTS TO SECURITY
Emerging disruptive technology is fundamentally changing the conception of security and
conflict. Unmanned Aircraft Systems (UAS) are an example of this change prominently
displayed across the spectrum of conflict, they frequent the skies of many domestic points of
interest, and aid myriad criminal endeavors. The low cost of high-quality platforms now
available on the civilian market has led to rapid proliferation of technological capabilities
previously unavailable to anyone except state-sponsored actors. Consider, for example, the
conflicts in Nagorno-Karabakh and Ukraine wherein leveraging the use of UAS changed the
balance of power and influence. Many similar zones of conflict or influence competition
border NATO member states and potentially threaten the security of the alliance.

GREAT POWER COMPETITION

The United States National Security Strategy describes Russia as an acute threat: Russian
attempts to influence foreign elections, performs information operations designed to
destabilize NATO partner nations, and repeatedly invaded of sovereign nations. The
utilization of loitering munitions to elicit desirable outcomes from Kyiv’s government,
however, demonstrates a startling new methodology to undermine national infrastructure,
terrorize a civilian populace, and—by crippling the electrical grid—weaponize the climate.
Advances in UAS technology and accessibility have directly enabled the maximization of
trauma against a civilian populace.
China continues to advocate for theunification of Taiwan with the People’s Republic. Chinese
UAS incursions into Taiwanese airspace are now commonplace and are expected to
continue; This further heightens cross-strait tensions. The Belt and Road initiative, as well as
debt trap diplomacy, shows an intent to deepen relations with raw material producers far
abroad of the previous Chinese areas of interest. Chinese attempts to compete for influence
—including support for controversial conflicts through provision of UAS technology–as
observed in the recent Ethiopian civil war.
Iran’s actions throughout the Middle East are typically designed toward encircling its greatest
and nearest perceived threats: Israel and Saudi Arabia. Continued supply of arms, training,
and funding to groups such as the Houthis and Hezbollah destabilize the region, often
leading to humanitarian crisis, and can easily spin out of control, affecting NATO nations and
their allies. Most recently, the use of Iranian manufactured and supplied drones by Iranian-
trained Russian forces against civilian infrastructure in Ukraine illustrates the negative
potential effects of UAS technology in modern conflict.
NATO UNCLASSIFIED Page 48
 NATO UNCLASSIFIED

NON-STATE ACTORS
The intentional alteration for misuse of hobby UAS may still negatively impact government
entities or infrastructure. Criminal organizations utilize UAS to facilitate activities, such as the
transport of illicit drugs, which typically undermine public order and rule of law.

The strategic value of Class I UASs is relatively low and It is unlikely that Class I UASs these targets
will make it into a prioritized list of targets when it comes to managing a contested airspace, facilitate
the freedom of movement or enhance counter intelligence. However, the overall effect Class I UASs
can have on expeditionary, civil-military and host nation operations is of strategic value and clear
strategic guidance is important for effective countering these threats.
This strategic foresight shall allow the commander to properly asses the threat, prioritize targets and
identify actions, which are employed prior to, during and post C-UAS events in order to ensure the
success of operations. The spectrum of this guidance is of transactional nature and covers both the
physical or cyber domains. Also strategic guidance is needed ahead of time to enable all resources are
appropriately configured and optimised.
The doctrine, organization, training, materiel, leadership and education, personnel, facilities – policy
and interoperability (DOTMLPF-P/I) framework is used to provide define NATO’s C-UAS strategic
foresight by also providing a checklist of planning items to be tailored to the C-UAS problem.
Without due planning of resources ahead of engagement time, any operational effort will fall short of
the execution of the operations.

3.2[4.2] STRATEGIC GUIDANCE

Analysis recent military operations around the globe and of the future operational environment and,
clearly illustrates the seriousness of the Class I UAS threat.
C-UAS capabilities require that many joint, inter-organizational, and multinational (JIM) partners play
a role in neutralising the UAS threat. A strategy to align C-UAS efforts across the force is discussed in
the following paragraphs.
The strategy focuses on Class I UASs since they pose challenges to the force that are less effectively
countered by existing Integrated Air and Missile Defence (IAMD) capabilities. Class I UAS are more
challenging targets to neutralize due to their ease of proliferation, low signature and low/slow
kinematic profile. The challenge is even larger in congested airspace with standoff surveillance
capabilities and with limited detection and engagement windows. C-UAS is positioned in the Air
Defence (AD) world given the impact of air superiority risk posed by the threat UAS. This placement
is supported by existing NATO policies (and related NATO defence planning documents) in the
Integrated Air Missile Defence (IAMD), Counter Rocket, Artillery, and Mortar (C-RAM), Ballistic
Missile Defence (BMD), or Surface Based Air Missile Defence (SBAMD). Force Protection must be
considered holistically, as directed within NATO doctrine (MC 0656 [45], AJP 3.14 [41]) and Air
Defence is a fundamental element of Force Protection. The Force Protection doctrine (AJP 3.14 [41])
states that “Air defence operations are normally the responsibility of an Air Defence Commander…”

NATO UNCLASSIFIED Page 49

 NATO UNCLASSIFIED

and C-UAS should are identified as one of the Air Defence measures, tasks and activities under the
responsibility of Air Defence Commander.
The strategy seeks to provide forces at all echelons with solutions across the DOTMLPF-P/I
framework that will enable neutralize of UAS threats. It seeks to combine arms solutions, utilizing
capabilities from every operational function in a coordinated, synchronized way. It promotes cross-
domain solutions, recognising that the C-UAS mission set exists in every domain, not just in the air.
Finally, it seeks a whole-of-government approach, recognising that a comprehensive C-UAS
capability will involve JIM partners from all areas of government (that is, not only military but also
civil protection) and even private actors (e.g. industry) along the supply chain preventing UASs to be
used for harm, working together towards a common goal.
The ways to implement it are nontrivial, since there is no single, comprehensive materiel solution that
will make the UAS problem disappear; nor does a single force, joint, or multinational capability that
can, from either a proficiency or sufficiency standpoint, neutralize the UAS threat by itself.
Successfully countering adversary use of UAS requires integration of numerous capabilities that
stretch across seven operational functions (command and control, fires, force protection, information,
intelligence, logistics, civil military cooperation and manoeuvre).
Three broad strategic objectives are identified to support military commanders and guide the
allocation of future efforts and resources:
 Enhance protection of forces and assets through innovation and cooperation,
 Pursue joint combined arms solutions, integrate capabilities across all domains, and
 Adopt a whole-of-government approach.

Figure 1 Strategic objectives, approach and lines of effort.

These objectives are graphically depicted in Figure 1 and further explained in more detail below.

a. Enhance protection of forces and assets through innovation and cooperation.

NATO UNCLASSIFIED Page 50

 NATO UNCLASSIFIED

NATO commands and nations will rely on innovation and cooperation to develop C-UAS capabilities
and use a coordinated risk-based approach to guide the efficient and rapid development of a suite of
solutions to address emerging requirements. The NDPP process will be use as the main framework to
develop capabilities in a coordinated way.
To protect NATO forces, facilities, and assets, the C-UAS systems will enable actionable UAS
reporting, identification, and dissemination to the appropriate authorities to support attribution and law
enforcement efforts.
As technological advancements and emergent threats continue to evolve, we will position ourselves
for the future by focusing on systems with an interoperable architecture. We will adopt advanced
acquisition processes to ensure the timeliness delivery of capabilities into operations.

b. Pursue Joint Combined Arms Solutions; Integrate capabilities across all domains.
Joint combined arms operations seek to synchronise capabilities in such a way that mutually
complementary effects are achieved; this includes both traditional military combat systems and the
broad range of JIM capabilities necessary to accomplish a given mission.

The C-UAS mission must be viewed as an inherently combined arms operation in the context of All
Arms Air Defence (AAAD). While air defence forces play a key role in C-UAS, Army, Navy, joint
and multinational air defence formations are insufficient in both quantity and capability to address the
threat alone. In the JIM realm, fires forces integrate surveillance capabilities, identify targets, and
facilitate and conduct engagements. Protection and intelligence forces integrate cover, concealment,
and deception (CCD) and situational awareness capabilities. C-UAS is part of Integrated Air and
Missile Defence (see NATO IAMD policy), so the air defence principles apply also for C-UAS.
Choices about who is responsible to counter UAS will be country specific and most probably will
depend on the scenario under consideration.

Electronic Warfare and other Cyber Electro-Magnetic Activity (CEMA) type cells exploit and
integrate cyberspace operations, Electronic Attack (EA) and Electronic Protection (EP) capabilities.

Manoeuver forces contribute to surveillance and identification while conducting engagements of threat
systems. At the same time disperse manoeuver reduce the risk to be identified by enemy UAS.
Command and Control integrates capabilities, implements plans, enhances situational awareness and
understanding, and enables leaders’ decision-making.

The goal of this solution is to seek an end state where a rapid and seamless integration of capabilities
aggressively addresses the entire spectrum of the UAS threat, from the national strategic level down to
the individual soldier.

Once operations commence, the objective is to disrupt threat UAS operations “left-of-launch” both
kinetically (strike) and non-kinetically (e.g. CEMA, disrupting supply chains, influence operations)
using both passive and active measures seek to neutralize UASs before their effects can be employed.
Effective intelligence, including support from technical exploitation, will play a key role in this aspect
of C-UAS.

This strategy emphasises the role of integrating capabilities that cut across multiple domains,
illustrating the joint combined arms approach necessary for a successful C-UAS capability. This
includes air defence, direct fire, force protection and EW, along with CCD efforts.

c. Adopt a Whole-of-Government Approach.

Multinational partners have already begun implementing ambitious C-UAS plans of their own, and by
combining efforts and sharing knowledge. NATO can maximise the effects of combining limited

NATO UNCLASSIFIED Page 51

 NATO UNCLASSIFIED

resources; however, joint efforts must be coordinated and synchronised with JIM efforts to avoid
redundancies and conflicts.

Multinational partners will, as always, be important participants in the C-UAS efforts. Strategic
considerations (basing, sustainment, etc.) will set the stage for successfully countering UAS. These
require building partner capacity long before hostilities commence.

Inter-organisational partners play a prominent role in the C-UAS mission set and inter-organisational
partners must be coordinated and synchronised in much the same way as the joint services. In the case
of counter use of UAS by non-state adversaries, effective civil-military cooperation will be a key
element in limiting non-state adversaries’ capacity to acquire and use UAS.

At strategic level, the DOTMLPFI considerations are commonly concentrated on doctrine,

organization, training, materials and interoperability. Some details in these strategic areas to be
considered by civil and military leaders (e.g. head of state, chief of the defence, commanders etc.) in
order to plan and execute within operations containing Class I UAS threats as shown in Table 1.

Table 1 DOTMLPFI Considerations

Strategic Detailed Content
Considerations
Regarding:
Doctrine C-UAS Doctrine must focus on the threat, not just the platform
- Maintain a high innovation pace. It is important to recognise the
rapid evolution of the threat, and the need to adopt a Continuous
Innovation (CI) – Continuous Deployment (CD) of C-UAS
capabilities.
- The threat from UASs extends beyond direct strikes (e.g. Command
and Control, ISR, Propaganda).
- Must understand that adversaries’ UASs are disposable.
- C-UAS doctrine can include active and passive measures of
protection (see AJP-3.4).
- Doctrine must consider local laws and coordination with local law
enforcement.
- Doctrine is extended to all units/formation, not only for C-UAS
assets.
Organisation Effective C-UAS Organisation recognises that the Class I threat is
primarily a local threat
- Class I UAS are a force protection threat that fall within the IAMD
target-set, requiring similar Air Defence and Force Protection
measures as those taken against any RAM attack for example. Force
Protection, CEMA and All-Arms Units dealing with Class I UAS
must make organisational provisions for safe delivery of coordinated
effects in the air domain.
- Force Protection must include the local air domain
o Effective organisation depends on integrated systems.
- Force Protection must include intelligence functions, incorporating
local UAS threat picture
o Must organise with local law enforcement stakeholders.
- UAS employment varies
o Analysis must happen at the strategic level to provide
effective trend analysis.

NATO UNCLASSIFIED Page 52

 NATO UNCLASSIFIED

Training Incorporate C-UAS into collective training

- Innovative concepts with innovative training
o Representative UAS threats must move beyond novel
training or experimentation to be routinely incorporated into
collective training.
o Specialised systems require specialised personnel.
o Effective C-UAS requires effective “Red-Teaming”, which
can be achieved with organic UAS.
o EW training requires permission to employ effectors.
- C-UAS is inherently a joint, combined, coalition, civ-mil mission
and must be trained appropriately
o Strategic Commanders must focus on the threat network, not
the platform and senior level training is paramount.
o C-UAS training must recognise that NATO forces cannot
count on air superiority.
Materiel Deliver appropriated and effective sensor, effectors and command
and control capabilities
- Assess the effectiveness of C-UAS equipment to clearly understand
the residual risk when employing in operation.
- Facilitate deeper Consultation and Coordination between national
and NATO procurement efforts.
- Adopt innovative procurement strategies to shorten the timelines of
capability delivery process.
Interoperability Requires a common understanding of the comprehensive approach
to the C-UAS challenge
- Interoperability of policy and doctrine:
o TTPs, Lexicons, ROEs.
o Legal Framework-Host Nation Agreements, Host Nation
Policies.
- Interoperability of technology.
o Define standards and architectures.
o Conduct exercises, trials and demonstrations.
- Integrate civil authorities into campaign planning:
o Supply chain intervention.
o Active civil military cooperation.
- Alliance-wide information sharing:
o Common Security Communication.
o Agreed-upon & evolving regulations, test protocols,
software, etc.
o Communication between allies, entities, military commands
and units. For example when a unit is facing a UAS threat,
this has to be reported through interoperable C2 means.

Strategic objectives needed in a planning guidance document as strategic implementation steps to

enable future operationalisation.

DISCUSSION

An alternative set of strategic objectives could be from the handbook:

NATO UNCLASSIFIED Page 53

 NATO UNCLASSIFIED

Strategic Objectives
- Counter the threat on all levels (Layered defence architecture).
- Terminate the attack at the local level.
- Institutionalise C-UAS education across the Alliance.
- Design with intent to share:
 Doctrine, Training, Policies, Terminology, Info Sharing. System Architecture, Lessons
Learned.
 Across entire Civil-Military Spectrum.

NATO UNCLASSIFIED Page 54

 NATO UNCLASSIFIED

4.[5.] OPERATIONAL GUIDANCE

4.1[5.1] INTRODUCTION
C-UAS mission planning and execution has a direct impact on the activities at the operational level.
This chapter provides general guidance on how to account for the UAS threat in the operational
planning process.

5.1.1 Planning
JFC objectives, guidance, and intent drive Class I C-UAS planning. The guiding principle for planning
is effective and efficient employment of processes, assets, communications, and data link architectures
needed for C-UAS operations to achieve the protection requirements of the JFC from air and missile
threats. Operational planning is a continuous process that takes place throughout the course of an
operation. During the conduct of an operation, the commander, assisted by the staff, assesses the
forces employment, assesses risks, and measures progress toward mission accomplishment by using
the operations. assessment process. They adapt and adjust operations as required ranging from minor
adjustments in execution to radical changes in the overall plan. A significant change of the operating
environment may require a review of the operation and discussions with higher authority to determine
if the end state is still viable.
It is likely that the proliferation of UAS will mean that C-UAS procedures may need to be enacted
immediately upon deployment or operation initiation, therefore C-UAS planning must be conducted as
soon as possible. There is considerable overlap between specialist and IAMD C-UAS actions,
therefore the planning of C-UAS activities for Class I Small and above (Class II and III UAS) should
be conducted as part of the broader Counter-Air planning process. C-UAS planning should
complement and enhance existing Integrated Air and Missile Defence (IAMD) plans to ensure all
threats within the Joint Air Defence Target Set are mitigated.

5.1.2 Command and Control

Successful military activities, missions and operations demand a robust and effective Command and
Control (C2). The future dynamic environments require a task-based model with flexible and
tailorable command relationships. Effective C-UAS defence requires robust C2 structures to support
C2 functions and effective information exchange with assigned C-UAS assets as well as
supported/supporting components. These C2 structures should provide the requisite levels of
flexibility, accuracy, specificity, timeliness and effectiveness.
Effective liaison between forces is essential for coordinated operations and is a key factor in the
success of joint operations. Liaison elements serve as their parent commanders’ representative on
matters of capabilities and limitations.

5.1.3 Execution/Employment
C-UAS execution entails using active and passive C-UAS capabilities and adheres to the principle of
decentralized execution. To meet challenging engagement timelines, with a distributed force, sensor
control and engagement authority should be delegated to the lowest practical level, consistent with
ROE and operational necessity. Commanders executes C-UAS operations through subordinate C2
nodes.
Within an operating environment, Class I UAS present a number of critical challenges which must be
fully integrated as part of the planning process at all levels. Such systems pose a significant threat
when integrated with an adversaries’ Indirect Fire Capability.

NATO UNCLASSIFIED Page 55

 NATO UNCLASSIFIED

C-UAS mission planning and execution has a direct impact on the activities at the operational level.
This chapter provides general guidance on how to account for the UAS threat in the operational
planning process.
5.1.2 Planning
JFC objectives, guidance, and intent drive Class I C-UAS planning. The guiding principle for planning
is effective and efficient employment of processes, assets, communications, and data link architectures
needed for C-UAS operations to achieve the protection requirements of the JFC from air and missile
threats. The impact of an asymmetric quick-win, information operations Class I UAS attack and
subsequent reputational damage could be as much of a compromise to military operations as a more
traditional form of attack. Furthermore, the complexity of C-UAS defence will only increase as local
airspace becomes more congested with the legitimate use of recreational and commercial Class I UAS.
Such systems’ ease of use, proliferation, automated flight profiles and limited detection and
engagement opportunities must all be considered and mitigated where possible, whilst minimising the
impact on military objectives and the safe delivery of operations.
5.1.3 Employment
C-UAS execution entails using active and passive C-UAS capabilities and adheres to the principle of
decentralized execution. To meet challenging engagement timelines, with a distributed force, sensor
control and engagement authority should be delegated to the lowest practical level, consistent with
ROE and operational necessity. Commanders executes C-UAS operations through subordinate C2
nodes. Class I UAS employment in operations continues to mature rapidly to exploit both
technological enhancements and current defence vulnerabilities in the operating environment. The
threat from UAS must not be regarded purely as a kinetic one but as a broad range of potential threats
which may present a risk to life, safety, information or reputation. Therefore, commanders and staff at
all levels must think laterally and innovatively about to the varied challenges of Class I UAS to
military operations. The impact of an asymmetric quick-win, information operations Class I UAS
attack and subsequent reputational damage could be as much of a compromise to military operations
as a more traditional form of attack. Furthermore, the complexity of C-UAS defence will only increase
as local airspace becomes more congested with the legitimate use of recreational and commercial
Class I UAS. Such systems’ ease of use, proliferation, automated flight profiles and limited detection
and engagement opportunities must all be considered and mitigated where possible, whilst minimising
the impact on military objectives and the safe delivery of operations.
Within an operating environment, Class I UAS present a number of critical challenges which must be
fully integrated as part of the planning process at all levels. Such systems pose a significant threat
when integrated with an adversaries’ Indirect Fire Capability.
[5.2] OPERATIONAL SITUATIONS
Operational commanders should follow strategic foresight to align operational objectives to strartegic
guidance, prioritising operational efforts and actions. They should utilize the opportunities coming
from adoption of a whole-of-government approach at the strategic level, exploiting the posibility to
coordinate and sinchronize operational actions with inter-organisational partners. Strategic guidance
allows commanders to plan and optimise properly available resources, integrating C-UAS options
from all domains into a comprehensive C-UAS capability.
NATO operations are categorized with reference to essential characteristics that differentiate from one
another. Within the spectrum of operations, all types of operations may be developed for reaching
Alliance purposes. The same type of operation may take place at different points of the spectrum and
be related to different themes depending on the level of affect faced in the operating environment.
UAS threat including surveillance and attacks might occur at any stage of a joint operation throughout
force generation and preparation, build-up, assembly and pre-mission training, and deployment. To
this end, sufficient C-UAS protection of joint forces should be timely planned and executed.
Rules of Engagement (ROE) are authorized by the North Atlantic Council (NAC) on approval of an
operation plan. An initial set of ROE designated to C-UAS should be identified, delegated and applied
at the earliest stage of a joint operation.
NATO UNCLASSIFIED Page 56
 NATO UNCLASSIFIED

Combat operations may be required to directly defend NATO against an aggressor. Combat operations
tend to be characterized by a series of battles and major engagements, and therefore involve intense
activity and high logistic consumption. The tempo of activities is usually high, with a need to prioritize
resources, generate additional fighting power and involve large-scale manoeuvre by complex and
multi-faceted joint forces. Forces are generally organized and commanded as functional components.
Crisis Response Operations (CROs) include multifunctional operations, which contribute to conflict
prevention and resolution, humanitarian purposes or crisis management towards declared Alliance
objectives. CROs may be as demanding and intense as combat operations.
At the operational level, three situations have been identified as being the most relevant in countering
UAS threats. Operational situations listed in these sections can be also decomposed into operational
themes such as:
 Warfighting,
 Security,
 Peace support.
In many operations, these themes occur simultaneously.

5.2.1 Expeditionary
In this case, the area of concern could be an expeditionary airbase in a relatively flat and open area,
with possibly mountains and urban structures nearby. The aim of the adversary is to damage/destroy
the fighter jets that are deployed at the airfield to reduce airpower capability by the employment of
relatively low-cost UASs and weapons.
Another scenario in the land domain is to target high-value assets with a lower density of lethal
capabilities such as command posts or logistics support nodes. The aim of the adversary is to
damage/destroy the ability to command and sustain operations by the employment of relatively low-
cost UASs and weapons.
In the maritime domain, a possible situation is when the area of interest is an expeditionary maritime
component in Seaport of Debarkation (SPOD). The aim of the adversary is to damage/destroy a
frigate’s sensors and helicopter on the deck by the employment of relatively low-cost UASs and
weapons. Naval operations including littoral, sea lines of communications (SLOCs), and amphibious
operations are included in this operational situation.

5.2.2 Host Nation

In this operational scenario, a NATO country ship is attacked by UASs, in a port of another NATO
Nation. The main point of consideration is the share of responsibility between the Host Nation and the
deployed forces.
Legal common understanding and globally defined legal procedures would facilitate better
coordination and more time for reaction against UAS threats.

5.2.3 Civil-Military
The civil military mission type could be explained by assuming that a sports stadium or large outdoor
venue is attacked by UASs, in an attempt to drop payloads of explosives, chemical or biological
agents. Another opportunity includes events like summits, or other special events such as song
festivals, or events with high political or royal family attendees where the C-UAS lead is often with
homeland security and requires the cooperation of military force with inter-agencies.

NATO UNCLASSIFIED Page 57

 NATO UNCLASSIFIED

[5.3] OPERATIONAL PLANNING

Some of the key operational topics to be addressed in missions where the UAS threat is present are
discussed in this section.

4.1.1[5.3.1] Mission Statement Analysis

Mission analysis consists of an in-depth analysis of the crisis situation to determine the operational
problem that must be solved and the operational conditions that must be established. It identifies the
key operational factors that will influence the achievement of those conditions and any limitations on
the operational freedom of action for the development of an overall operational design.
Main considerations for planning C-UAS Operations:
 Threat: Considering an operation, that has a Class I UAS threat and Counter-UAS
aspect.
 Scenarios: Expeditionary, Civil-Military, and Host Nation operations.
 Users: NATO commanders across all levels, Partners, military and non-military.
 Approach: Solution needs a comprehensive, cross service, civil-military, inter-agency
approach.
 Planning: C-UAS operations need to be planned at the tactical level using both NATO
Comprehensive Operations Planning Directive (COPD) and Host Nation National
Guidelines.
 Response: Application of Protection Model (Prevent, Detect, Track, Classify, Identify,
Neutralize, Exploit) in Mission Planning Objectives and Mission Types, and
Functional Synergies.
 Assessment: Class I UASs can be considered a disposable asset. Leaders need to
consider how disposability may enable new concepts for suppression of advanced air
defence capabilities.
 Feedback: UAS employment varies according to location. Analysis must happen at
the strategic level to provide effective trend analysis.
C-UAS planning should adhere to the following principles:
 Centralized Planning and Direction.
 Decentralized Execution.
 Pre-planned Responses.
 Effective and Efficient Communications.
 Variety of Weapons. Variety of Weapons should provide multiple engagement
opportunities, ideally beginning at the maximum range from friendly forces and areas.
 360-Degree Coverage.
 Early ID and Tracking. If Identification is not possible, correlation with Pre-Defined
Procedures for Class I UAS should be applied.
 Timely Alert and Warning.

5.3.2 Operating Environment

Defining the operational environment allows the staff to focus their planning efforts on defending
against low-level air threats and assists the unit in creating an effective C-UAS training strategy.
Within the deployed operating environment, Class I UAS present several critical challenges which
must be fully integrated as part of planning process at all levels.
Commanders and staff responsible for C-UAS procedures must ensure that all C-UAS responses are
fully considered during the planning stage of an operation and subsequently incorporated into

NATO UNCLASSIFIED Page 58

 NATO UNCLASSIFIED

overarching plans and directives. These plans and responses must then be thoroughly rehearsed at all
levels, validated and refined.
C-UAS planning should be based on the delivery of integrated active, passive, security and
recuperation effects, activities and measures which will enable the most suitable response to a
potential Class I UAS event. Any responses must be closely coordinated with any ongoing air /
aviation activity in order to maintain safe air operations. C2 lines of communication must be clear,
robust and effective given the unpredictable, rapid and confusing nature of a Class I UAS event.
The operational environment is the composite of the conditions, circumstances, and influences that
affect the employment of capabilities and bear on the decisions of the commander. It encompasses
physical areas and factors (of the air, land, maritime and space domains) and the information
environment (which includes cyber domain). Included within these are the adversary, friendly, and
neutral systems that are relevant to a specific joint operation. Understanding the operational
environment helps commanders understand the results of various friendly, adversary, and neutral
actions and how these affect the mission accomplishment.
To reach those targets, all plans and procedures must be revised regularly and/or unregularly. All pre-
defined plans must be considered as required living actions - not a static plan and must adapt changing
environment & situation with the aim of always being up to date.

5.3.3 Active C-UAS Defence

Active C-UAS measures are those which seek to deter, prevent, nullify or reduce the effectiveness of a
potential Class I UAS event against own troops and to counter its hazards.
Active defence must consist of defence in-depth against all classes of aerial platforms. Defence in-
depth provides commanders multiple opportunities to negate threats with different effector’s options,
increases probability of kill, and prohibits the enemy from countering the defensive system with a
single technique. A successful JIPOE will produce the information necessary to plan for an in-depth
active defence with the friendly AMD assets available for the mission. Active defence plans should be
coordinated with airspace managers and air defence personnel.
Active defence planning measures taken in support of the mission must adhere to the commander’s
ROE and consider potential collateral damage. Early detection and neutralize of threat UAS also
increases the chance of capturing or destroying both the threat UAS and its ground station.
a. Active Air Defence components
 Multi-tiered AMD assets configured to provide multiple engagement opportunities throughout
threat flight.
 Active Electromagnetic Warfare (EW) to disrupt remote or on-board guidance systems
 Electronic Protection (EP) and Electronic Counter-Counter Measures (ECCM)
 Defensive Operations. Develop comprehensive JIPOE. Redefine characteristics for threat
UAS. Establish ROEs. Sensor planning and integration. Identify NAIs.
SBAD and C-RAM weapon platforms have the ability to counter UAS threats and should be
exploited by operational commanders along with existing C-UAS systems. Sensors, effectors and
C2 components of those systems contribute to the layered, active AMD system-of-systems and
should be designed to optimize the individual capabilities of each AMD element.
Any active reaction to a Class I UAS event must be proportionate, rapidly delivered and
conducted in accordance with ROE, national limitations, HN legal jurisdiction and legal
requirements. ROE must be clearly understood by all personnel and are likely to include an
inherent right to self-defence, positive threat ID criteria, weapon control status and an engagement
authority to counter the threat. Active C-UAS measures should follow the phases of Observe,
React and Recover.

NATO UNCLASSIFIED Page 59

 NATO UNCLASSIFIED

The first three ROE are applicable to all combined armed forces while the others are primarily for
AMD forces. These are:
a. Right to self-defence.
b. Establishing ID criteria.
c. WCS.
d. Level of control.
e. Modes of control.
f. Autonomous operations.
g. Fire control orders.
b. Warn and Report
A potential Class I UAS event will develop rapidly, be unpredictable and is likely to be very short
in duration. Decision-making and reactions will need to be decisive at all levels and based on
thorough training and rehearsal. Target identification will be exceptionally challenging and almost
impossible given the nature of Class I UAS and the various environmental challenges presented to
military personnel. The presence of dedicated C-UAS detection equipment must not be assumed
and, if deployed, should be regarded as complimentary to the effective application of active C-UAS
measures.
c. Active Situational Awareness & Intelligence
Active C-UAS patrolling will be critical to providing a robust deterrence and deter a potential Class
I UAS event from occurring. Awareness of the potential threat and common combat indicators
include a broader framework of counter threats patrolling, security and reassurance, local
engagement and intelligence gathering activities.
Air surveillance must be adjusted to reflect the dynamic nature of the Class I UAS threat and
require a 360-degree arc of observation to cover vital ground and critical assets that a Class I UAS
may seek to exploit, observe or target. Organic ISR capabilities should be fully integrated into C-
UAS active measures and should include the use of friendly UAS.
d. React
All reactions to a potential Class I UAS event must be proportionate, effectively controlled and
integrated across multiple agencies to minimise the risk to operational output or unintended
consequences such as fratricide or collateral damage. All active C-UAS measures will form part of
a broader, integrated plan but are likely to include:

i. Quick Reaction Forces

Commanders might employ quick reaction forces as a reserve to react to any Class I UAS
activities to disrupt an event or act as a screen to engage and destroy an imminent threat.
Whilst commanders must balance conflicting priorities, QRF may be tasked to deploy to
known or likely Class I UAS take-off / landing sites or react to reports of a confirmed
Class I UAS operator location
Neighbour – Commanders utilise watch systems as an option of civil people cooperation
and reporting nearby facilities via telephone or other means. However, this option
includes risks for false alerts and scams.
ii. Counter ISR
Class I UAS offer a significant ISR capability to an adversary and may be considered as
the primary operational function, in support of other concurrent activity. In such a
capacity, a Class I UAS may conduct a broad range of ISR taskings to preserve

NATO UNCLASSIFIED Page 60

 NATO UNCLASSIFIED

operational security is essential. A detailed IPE will help operational staff identify named
areas of interest, key terrain or decision points on which appropriate C-UAS pro-active
measures should be focused. The freedom of manoeuvre of an adversary to operate Class
I UAS from these locations must be restricted through the use of all available organic ISR
capabilities. Furthermore, the advantage of deliberate observation activities from forward
positions may be effective in providing vital intelligence, warning and engagement
opportunities to disrupt or deny a potential Class I UAS threat.
iii. Attack Class I UAS threats
The option to use organic fire assets should be considered to support proactive C-UAS
activities. The targeting of a Class I UAS at range using all-arms-air defence will present
significant challenges and may prove to be inappropriate in many operating
environments. Indirect fires could provide a flexible response to a known Class I UAS
operator location.

5.3.4 Passive C-UAS Measures

Passive C-UAS activities are intended to reduce our vulnerability to a Class I UAS event and enable
the ability to continue operations despite adversary action or the presence of a Class I UAS hazard.
Whilst proactive measures will seek to prevent a potential Class I UAS event from occurring, such as
the unpredictable nature of Class I UAS operations this is not always going to be possible. Therefore,
a range of standard resilience measures will be essential to provide robust and effective protection
against a Class I UAS event. Well planned and flexibly executed resilience measures must form the
foundation to credible C-UAS posture, particularly in the absence of C-UAS protective capabilities,
highly restrictive ROE or limited freedom of manoeuvre. Operational planners should integrate C-
UAS resilience measures into a broader defensive posture and will complement or enhance existing
measures.
No UAS Fly Zones for High Value Assets and Critical Infrastructure must be pre-defined via
cooperation with responsible authorities.
a. Counter Surveillance
The primary strength of a Class I UAS is its capability as a flexible ISR platform. All passive C-UAS
measures should be focused on minimising the effectiveness of the Class I UAS to gather intelligence
or oversight of friendly forces operations and routine activities. Disciplined application of fundamental
counter-surveillance measures will be vital to providing protection against a potential Class I UAS
event, preserving OPSEC and denying critical information which may support other hostile actions
against friendly forces. Commanders may wish to consider:
i. Day / night routine. Most Class I UAS devices are rendered non-effective at night.
Particularly, very few COTS Class I UAS are currently fitted with night vision or IR-capable
cameras. Therefore, commanders should consider conducting operationally essential, sensitive
activities during darkness to mitigate the risk of observation. This will prove challenging in
large base locations such as airfields, naval ports and locations where light can be used as an
effective screening method. Similar effects may also be achieved during periods of inclement
weather.
ii. Minimising movement. A typical Class I UAS event will be relatively short in duration
given the limited performance factors of Class I UAS. The use of flexible movement control
measures during a potential Class I UAS event will minimise both the risk to personnel and the
level of valuable information that can be obtained during an ISR flight profile.
iii. Camouflage and concealment. Whilst a basic military skill, the value of effective
camouflage and concealment must not be underestimated in C-UAS defensive measures.
Critical assets, locations and activities should all be camouflaged, concealed or screened where
possible to minimise the effectiveness of a Class I UAS as an ISR platform.

NATO UNCLASSIFIED Page 61

 NATO UNCLASSIFIED

iv. Deception. The effect of deception, to force an adversary into an alternative course of action,
must be exploited to support a C-UAS defence plan. Deception should seek to exploit the
inherent weakness in Class I UAS optical systems and Class I UAS performance limitations
which will limit the time to conduct an ISR task.
b. Physical Protection and Obstacles
Physical protection will offer a number of mitigations against the threats posed by a potential Class I
UAS event. FP engineering works will provide established protection against the kinetic effects of
potential Class I UAS attack against a unit location. However, given the small and relatively slow
speed of Class I UAS, most buildings will offer sufficient protection against an unarmed device.
i. Dispersal
Within certain locations the options for the dispersal of critical assets and personnel will be
limited. However, within a large location, the widest possible dispersal of assets will exploit the
limited range and endurance of a Class I UAS and minimise the effectiveness of the optical
sensors to conduct a collect of information over a large, dispersed area. Dispersal options may
also be constrained by operational impacts, increased security and manning requirements and
geographical constraints.
ii. Recuperation
Rapid and focused recuperation measures will be critical to resuming operations as quickly as
possible. A potential Class I UAS event is likely to be unpredictable, short and confusing. It is
paramount that units do not become operationally constrained by self-imposed, protracted post
event actions which significantly outweigh the impact of the original Class I UAS event.
Adversarial UASs pose several risks to a commander:
 First, there is the risk to personnel. Adversarial UAS can identify and then directly
target or provide information to other strike assets to target friendly forces.
 Second, there is the risk to the mission. Adversarial UAS can provide intelligence,
surveillance, and reconnaissance to adversarial forces that enable them to block
friendly forces’ operational objectives.
All flying objects in a battlespace should be detected, tracked, classified and identified as friend
or foe. Defence (neutralization) covers the use of kinetic or non-kinetic means to prevent harm
to friendly forces or infrastructure. Without detection, efficiently defending against UAS is
unlikely; without defensive actions, mitigating known threats becomes unattainable. Detection
is the first step in a comprehensive C-UAS strategy; without knowing what type of threat is
present, or where the threat is, any efforts to defend are likely futile.
Joint Intelligence Preparation of the Operating Environment (JIPOE) provides the commander
and staff with specific threat information on known enemy locations, tactics, and threat
capabilities. Threat UAS information is critical and likely differs between adversaries.
Knowledge of the threat UAS tactics may not always be available.
JIPOE is a continuous three steps process, that when applied properly, it provides for the timely
and effective neutralization and/or destruction of the aerial threat, while minimizing the
requirements for friendly AMD assets. JIPOE defines the operating environment, describes
environmental effects on operations, key terrain, weather, civil considerations, determines
adversary’s course of actions.

NATO UNCLASSIFIED Page 62

 NATO UNCLASSIFIED

5.3.5 Integration
Integration of C-UAS units into IAMD should provide efficient information control and exchange to
all DCA and OCA forces. C-UAS planning requires integration across JFC staff elements, Component
Commanders, Active and Passive AMD, Joint electromagnetic spectrum operations, and Multinational
and coalition partners.
JFC establishes objectives and guidance for employment of C-UAS in OPLAN and CONOPS. They
serve as a framework for planning. Other inputs may include COM JFAC guidance, current CAL and
JPDAL, ROE and law of armed conflict.
C-UAS integration is guided by, and should be in compliance with, ATO, ACO, SPINS, real-time
alerts, WCS, and control data. Coordination synchronizes CDR’s priorities and resolves conflicts of
intent.
Understanding and intelligence underpin the pillars of activity that define the C-UAS employment. C-
UAS considerations should be fully incorporated into JIPOE, and Class I UAS threats and hazards
should be included as part of COP within the operating environment.
Liaison and integration with other C-UAS stakeholders will be critical. Integration with HN or civilian
organisations should be established to exploit respective C-UAS capabilities such as civilian Class I
UAS detection equipment.
A dedicated C-UAS Integration Cell might be established in order to facilitate the following activities:
 Ensure the integration of C-UAS defence considerations and provide advice and support
during all stages of the planning process.
 Develop all C-UAS TTPS and plans and ensure routine review and development through the
analysis of C-UAS events, intelligence and adversary TTPs.
 Provide detailed Class I UAS threat analysis and advice to commanders and demonstrate a
broad understanding of Class I UAS capabilities, performance, vulnerabilities and
technological development.
 Understand and advise on Class I UAS TTPs, flight profiles and likely operator behaviours.
 Support and advise on the integration of C-UAS defence capabilities. Advise commanders on
the critical operational, logistical and technical support requirements.
 Support the planning and delivery of effective C-UAS training
 Acts as a focal point for all C-UAS engagement and delivery.
 Provide technical advice and support on C-UAS defence equipment capabilities, limitations
and support requirements.
 Provide technical advice and support on friendly UAS operations and tasks, equipment
capabilities, limitations and support requirements. Ensure integration and deconfliction where
necessary.
 Support the development of appropriate C-UAS defence information operations products
Maintain effective awareness of developments in the wider Class I UAS community including Class I
UAS usage in the commercial, security and entertainment sectors, technological developments and
evolution of Class I UAS legislation

5.3.6 Joint Prioritized Critical Asset List (JPCAL) and Joint Prioritised Defended Asset List
(JPDAL)
a. Overview. JFC and staff should develop a JPCAL consisting of assets and vital areas for the joint
force to defend (in priority of importance) for each phase of an operation. JFC staff develops the
JPCAL with input from the component commands and nations at risk. Assets that need C-UAS
protection should be included and integrated in the JPCAL development process. Within each phase,
subordinate JFCs or component CDRs may establish additional phases fitting their CONOPS (for

NATO UNCLASSIFIED Page 63

 NATO UNCLASSIFIED

which there may be separate JPCALs). The JPCAL may be useful in providing a preliminary baseline
for JFCs for various operational scenarios within a JOA. The number of assets requiring some level of
AMD, including C-UAS, may be greater than the resources available to defend them. Due to the
dynamics of joint operations, priorities may change over the course of the operation or campaign.
b. JPCAL Development. All assets nominated for the JPCAL are prioritized based on a methodology
of assessing the four major factors of criticality, vulnerability, recuperability and threat. The
Criticality-Vulnerability-Recuperability-Threat (CVRT) methodology process is objective and
considers intelligence, air operations, ground combat operations, maritime operations, and support
operations. Each asset is evaluated against defined criteria, and the criteria are weighted based on
consideration of the JFC’s intent, CONOPS, and COG (Centre of Gravity) concerns.
b.1 JPCAL Development Factors.
i. Criticality. Criticality is the degree an asset is essential to accomplishing the mission.
It is determined by assessing the impact any damage or destruction to the asset will have
on the success of the operation or campaign. Damage to an asset may prevent,
significantly delay, or have no impact on success of the plan.
ii. Vulnerability. Vulnerability is the susceptibility of an sset to damage if attacked.
Vulnerability is further divided into two subparts - hardness and dispersion. Hardness
consideration is the degree of hardening of an asset. Dispersion is the degree of
distribution across a geographic area of an asset.
iii. Recurepability. Recuperability is the degree to which an asset can recover from an
inflicted damage in terms of time, equipment, and available manpower to continue the
mission. Recuperability is further divided into two subparts – time and replicate. Time is
the duration required for an asset and its infrastructure to recover from attack. Replicate is
the ability to duplicate a capability, unit or function from attack. CDRs should consider
the time to replace personnel, equipment, or entire units, and whether other forces can
perform the same mission.
iv. Threat. Assess the probability an asset will be targeted for surveillance or attacked
by a capable adversary. Determination of adversary’s intent and capability are key
determinants of assessing the probability of attack. A thorough JIPOE focused on
adversary’s air and missile capabilities is essential to an accurate threat assessment.
Examples include targeting information provided by intelligence estimates, past
adversary surveillance and attack methods, and threat doctrine.
b.2 JPCAL. Joint Prioritized Critical Asset List (JPCAL) is forwarded to the AMDC (Air and
Missile Defence Commander), who will allocate available capabilities to defend the prioritized assets
listed. The product of this effort is the Joint Prioritized Defended Asset List (JPDAL). The JPDAL is a
list of assets on the JPCAL that receive AMD coverage, including C-UAS protection. The JFC uses
available AMD and C-UAS forces and capabilities to provide the required coverage. Each asset in the
JPDAL should be prioritized as requiring active AMD, or passive measures if that is all that is
available. After initial active AMD allocation, CDRs should consider “clustering” assets to conserve
AMD forces, and assess if passive measures alone satisfy the required defensive posture. If passive
measures alone are insufficient to defend an asset on the JPDAL, the issue should be resolved by the
JFC.
c. Joint Prioritized Defended Asset List Development.
JPDAL is developed by applying the CVRT methodology, AMD and C-UAS resources, and defence
design to the JPCAL while identifying the risk. It identifies the prioritized assets from the CAL to be
defended with available resources. For developing the JPDAL, considerations include the following
levels of protection and levels of engagement effectiveness:
c.1 Levels of Protection. A level of protection is an aggregated probability an asset will not suffer
mission-critical damage from an air or missile attack. It encompasses all joint force capabilities used to

NATO UNCLASSIFIED Page 64

 NATO UNCLASSIFIED

defeat the air and missile threat. A level of protection is assigned to each entry on the JPCAL list
based on the outcome of CVRT analysis.
c.2 Levels of Engagement Effectiveness. The COM JFAC implements the JFC directed
protection level for each defended asset on the JPDAL based on the threat capabilities and proximities,
terrain and weather, support available–time available, and civil considerations. Implementation may
include active and passive AMD measures. After a level is established, the defence design is
developed. Levels of engagement effectiveness are achieved using tiers or methods of coverage with
some employing multiple tiers and varieties of active and passive measures. Tiers are commonly
categorized as upper and lower. The COM JFAC should recommend offensive operations against
anticipated threats when an asset cannot be adequately defended from an attack due to the threat
composition, strength, or proximity.

The COM JFAC and staff must continuously assess the JPDAL, especially in a dynamic, multiphased
campaign. The COM JFAC may delegate further assessment of the JPDAL to a working group (WG)
or coordination board with appropriate staff and component representation. The WG or board will
present its assessment and recommended adjustments for the JPDAL to the COM JFAC for
concurrence and the COM JFAC will forward it to the JFC for final approval. Changes to the JPDAL
should be anticipated with changes in phases of an operation or campaign due to changes in the
priority of defended assets by phase, loss of AMD assets due to attrition, inventory depletion, or the
arrival of additional AMD forces.

5.3.7 C-UAS Capabilities

Any C-UAS Class I architecture must include three key elements:
 Weapon Diversity and Coordination.
 A graduated response.
 Comprehensive focus on all components of the Class I UAS.
Kinetic and non-kinetic weapon systems will require an adaptation of existing air defence systems to
account for the Class I UAS threat characteristics.
In addition to specially designed and fielded C-UAS capabilities, a number of other capabilities, both
kinetic and non-kinetic, are available to the JFC and should be leveraged and integrated to provide a
coordinated and wholistic C-UAS approach. Depending on the UAS component (aircraft, payload,
control element, data link, human element, support element), the domain the UAS is operating in, and
its potential distance to NATO forces, there are different points of attack for the employment of
countermeasures, all should complement each other and contribute to a comprehensive, multi-domain
C-UAS effort. The main resources needed to counter the threat are:
 Force Protection (FP) FP Measures should primarily be aimed at denying access to
UAS to the protected area (safety of friendly forces and critical infrastructure).
 Countering Rockets, Artillery shells and Mortar rounds (C-RAM) capabilities
C-RAM provides additional low-level very short-range air defence capable of
engaging UAS to protect mission essential assets and forces.
 Air Defence (AD) Short-Range Air Defence and even legacy Anti-Aircraft Artillery
may provide an effective, but also efficient, defence against UAS.
 Air Interdiction (AI) Identify the Launch and Recovery Element (LRE) will bring
UAS operations to a halt in the respective area. This is mainly applied to Class II and
III UASs, but must be also apply to Class I UASs operators and infrastructure
associated.
 SOF The logistic supporting the Class I UAS can be located outside the mission area,
and SOF may be employed as a mean to attack it: the SATCOM ground nodes, kill
operators, etc.

NATO UNCLASSIFIED Page 65

 NATO UNCLASSIFIED

 Cyber Warfare COTS UAS being operated via a GSM network are likely only
accessible through the cyberspace domain since countermeasures in the
electromagnetic spectrum may be off limits, e.g. if frequencies are publicly used.
 Electromagnetic Operations (EMO) Electromagnetic Operations can be used
throughout all tiers of UAS to hinder and disrupt C2 and PNT transmissions or even
to spoof PNT information to divert or land the UAS. Directed Energy Weapons such
as High-Power Microwaves or High Energy Lasers may add kinetic capabilities to the
electromagnetic portfolio and could be used to render sensor payloads inoperable or
destroy the UA itself.
 ISR Reliable identification of the intruding UAS and its capabilities, as well as
identifying the origin of the C2 transmission, is critical for selecting appropriate
countermeasures. For example, this includes information about the capabilities and the
level of autonomy of the UA, locations of adversary LREs and MCEs, as well as
SATCOM assets and frequencies used. C-UAS systems have to be fed with this
information, preferably in real-time, to process a suitable target solution.
 The Space Domain COTS UAS also utilize PNT signals provided by respective
satellite constellations. Within the limits of the ‘Outer Space Treaty’, countermeasures
against space-based communications and PNT may be a legitimate option to defend
against an entire fleet of adversary UAS.
AJP-3.14-Allied Joint Doctrine for Force Protection- define Force Protection as: “…measures and
means to minimize the vulnerability of personnel, facilities, equipment, materiel, operations, and
activities from threats and hazards in order to preserve freedom of action and operational
effectiveness, thereby contributing to mission success”.
Timely dissemination of air threat early warning to the lowest echelon to counter the C-UAS threat is
critical. Upon detection and classification of an enemy UAS, the unit must relay alert information on
locations, altitudes, and time to surrounding forces. This information could be vital to protecting
forces and possibly capturing the UAS and its ground platform.
FP must be considered holistically, as directed within MC 0656, “Policy for the Force Protection of
Alliance Forces”, and the C-UAS mission should be integrated seamlessly within FP and AD and
conducted by the units aligned to SBAD Domination (Active Defence) and Security in accordance
with ATP 3.3.6, NATO Force Protection Doctrine for Air Operations.Any C-UAS Class I must
include three key elements:
 Weapon Diversity and Coordination.
 A graduated response.
 Comprehensive focus on all components of the Class I UAS.
Kinetic and non-kinetic weapon systems will require an adaptation of existing air defence systems to
account for the Class I UAS threat characteristics.
In addition to specially designed and fielded C-sUAS capabilities, a number of other capabilities, both
kinetic and non-kinetic, are available to the JFC and should be leveraged and integrated to provide a
coordinated and wholistic C-sUAS approach. Depending on the UAS component (aircraft, payload,
control element, data link, human element, support element), the domain the UAS is operating in, and
its potential distance to NATO forces, there are different points of attack for the employment of
countermeasures, all should complement each other and contribute to a comprehensive, multi-domain
C-UAS effort. The main resources needed to counter the threat are:
 Force Protection (FP). FP Measures should primarily be aimed at denying access to
UAS to the protected area (safety of friendly forces and critical infrastructure).
 Countering Rockets, Artillery shells and Mortar rounds (C-RAM) capabilities. C-
RAM provides additional low-level very short-range air defence capable of engaging
UAS to protect mission essential assets and forces.
 Air Defence (AD). Short-Range Air Defence and even legacy Anti-Aircraft Artillery
may provide an effective, but also efficient, defence against UAS.

NATO UNCLASSIFIED Page 66

 NATO UNCLASSIFIED

 Air Interdiction (AI). Identify the Launch and Recovery Element (LRE) will bring
UAS operations to a halt in the respective area. This is mainly applied to Class II and
III UASs, but must be also apply to Class I UASs operators and infrastructure
associated.
 SOF. The logistic supporting the Class I UAS can be located outside the mission area,
and SOF may be employed as a mean to attack it: the SATCOM ground nodes, kill
operators, etc.
 Cyber Warfare. COTS UAS being operated via a GSM network are likely only
accessible through the cyberspace domain since countermeasures in the
electromagnetic spectrum may be off limits, e.g. if frequencies are publicly used.
 Electromagnetic Operations (EMO). Electromagnetic Operations can be used
throughout all tiers of UAS to hinder and disrupt C2 and PNT transmissions or even
to spoof PNT information to divert or land the UAS. Directed Energy Weapons such
as High-Power Microwaves or High Energy Lasers may add kinetic capabilities to the
electromagnetic portfolio and could be used to render sensor payloads inoperable or
destroy the UA itself.
 ISR. Reliable identification of the intruding UAS and its capabilities, as well as
identifying the origin of the C2 transmission, is critical for selecting appropriate
countermeasures. For example, this includes information about the capabilities and the
level of autonomy of the UA, locations of adversary LREs and MCEs, as well as
SATCOM assets and frequencies used. C-UAS systems have to be fed with this
information, preferably in real-time, to process a suitable target solution.
 The Space Domain. COTS UAS also utilize PNT signals provided by
respective satellite constellations. Within the limits of the ‘Outer Space Treaty’,
countermeasures against space-based communications and PNT may be a legitimate
option to defend against an entire fleet of adversary UAS.
AJP-3.14-Allied Joint Doctrine for Force Protection- define Force Protection as: “…measures and
means to minimize the vulnerability of personnel, facilities, equipment, materiel, operations, and
activities from threats and hazards in order to preserve freedom of action and operational
effectiveness, thereby contributing to mission success”.
Timely dissemination of air threat early warning to the lowest echelon to counter the C-UAS threat is
critical. Upon detection and classification of an enemy UAS, the unit must relay alert information on
locations, altitudes, and time to surrounding forces. This information could be vital to protecting
forces and possibly capturing the UAS and its ground platform.
FP comprises a number of distinct but inter-related fundamental elements, which may contribute to the
overall FP function. The contribution of these fundamental elements will be determined by the
operational environment, for instance, by the threat, scale of the operation, climate, civil environment,
the composition of the NATO-led force, and the availability of host-nation support (HNS) or support
of local security forces.
FP must be considered holistically, as directed within MC 0656, “Policy for the Force Protection of
Alliance Forces”, and the C-UAS mission should shall be integrated seamlessly within FP and AD and
conducted by the units aligned to SBAD Domination (Active Defence) and Security in accordance
with ATP 3.3.6, NATO Force Protection Doctrine for Air Operations.
It is likely that the proliferation of UAS will mean that C-UAS procedures may need to be enacted
immediately upon deployment or operation initiation, therefore C-UAS planning must be conducted as
soon as possible. There is considerable overlap between specialist and IAMD C-UAS actions,
therefore the planning of C-UAS activities for Class I Small and above (Class II and III UAS) should
be conducted as part of the broader Counter-Air planning process. C-UAS planning should
complement and enhance existing Integrated Air and Missile Defence (IAMD) plans to ensure all
threats within the Joint Air Defence Target Set are mitigated.
Implementation of a C-UAS capability would require some fundamental changes to the SBAD
organizational structure. This will necessitate a revision of the SBAD Reference Architecture to reflect

NATO UNCLASSIFIED Page 67

 NATO UNCLASSIFIED

the integration of the C-UAS capability at the TOC level. Integration of the C-UAS capability is more
appropriate at a Battery TOC than at the Battalion TOC. There should also be a common BMC4I
system, with integration of the SHORAD/VSHORAD, C-RAM and C-UAS missions. Changes will
also be necessary in Force and Engagement Operations (e.g. Airspace Co-ordination Measures and
Weapon Control Orders).
Any solution will therefore, comprise a combination of the extant SBAD and C-RAM sensors and new
sensor technologies, specifically selected for the C-UAS role. These sensors would need to be
integrated in the SBAD Force Structure but could also have a secondary stand-alone capability for use
where a full SBAD Force deployment is either not necessary or inappropriate.
Friendly & Neutral Forces Situational Awareness
C-UAS technology poses a wide range of practical, legal, and policy challenges in all operating
environments. In addition to the DOTMFPI factors, it is necessary to consider additional factors.
These factors affect the security scenario of the national territory, due to the greater weight of aspects
such as the urban environment, the presence of civilians, the proliferation of recreational use of these
systems, the responsibilities of the homeland security forces, or the social alarm that it could provoke
this threat in national territory. These new factors to be considered in a C-UAS scenario are:
 Awareness.
 Integrated Airspace Management.
 Improve legal regulations for the use of Class I UAS.
 Armed Forces and Home Land Security coordination.
 Legal and Etic aspects.
5.3.6.1 LOGISTICS
For any unit operating UASs, friendly/adversary, logistics covers the capability required to supply the
UAS system with all its consumables and expendables as well as with power and other logistic support
functions. Logistic capabilities include:
 Field support facilities
 Launch and recovery operations
 Payload, weapon and expendables installation & removal
 Provision of shutdown & turn-around
The C-UAS system must comply with the requirements of a VSHORAD/SHORAD system (or C-
RAM) concerning tactical mobility, supply, maintenance, power, storage requirements, temperature
limits, environmental and operational conditions. The incorporation of fire on the move is a desired
requirement and should be taken into account.

NATO UNCLASSIFIED Page 68

 NATO UNCLASSIFIED

5.3.74 COMMAND AND CONTROL (C2)

C-UAS C2 elements should be integrated into existing IAMD architecture by establishing dedicated
C-UAS cells at the appropriate levels. This C2 integration should be robust and flexible to overcome
the challenges of Class I UAS operations and ensure that all actions and activities are appropriate,
proportionate, monitored and controlled.
C-UAS defence is a joint effort. COM JFC exercises operational control, as delegated by SACEUR,
over designated force components provided to them, coordinates C2 arrangements and liaison between
component commands for effective and efficient operational planning and execution of assigned
missions.
The CFACC (Combined Force Air Component Commander) is given the authority to accomplish
missions and tasks assigned by SACEUR for theatre-wide air missions and in support of COM
JTF/JFC. The CFACC typically exercises OPCON over assigned assets and tactical command
(TACOM) over other air capabilities and forces made available for tasking. The CFACC will exercise
his/her responsibilities from HQ AIRCOM, or from the NCS JFAC, when activated.
The AMDC (Air and Missile Defence Commander) will have overall responsibility to plan and
execute integrated air and missile defence operations integrating and coordinating the air and missile
defence forces of each component by developing a coherent joint air- and missile defence plan
(AMDP). This includes establishing weapons control procedures and measures for all defensive
counter-air (DCA) weapon systems and forces, including C-UAS, coordination with regional/host
nation air and missile defence systems, and the exchange of information necessary to support civil
defence activities.
SACEUR or the COM JTF/JFC may also establish supported/supporting relationships between the
CFACC or DCDR-Air and other components to facilitate operations. Operational C2 relationships will
vary depending upon the size, complexity, and location of the mission. C2 relationships are
established by SACEUR and specified in the OPLAN. CFACC or DCDR-Air execute the air plan
through a periodic air operations directive (AOD), and the air tasking order (ATO) and related
documents such as the Airspace Control Order (ACO). C-UAS forces are included in the joint battle
rhythm, the air battle rhythm, ATO and ACO.
Components have ready access to the CFACC or DCDR-Air, the NCS JFAC or DCDR-Air (CS) and
the other components through their liaison officers (LOs).During preparation for operations, as well as
during execution, significant coordination and de-confliction between the COM JTF/JFC and
Component Commanders will be required.
A component liaison element serves as the conduit for coordination between its functional components
and the supported/supporting components. The liaison element represents its component commander’s
perspective and ensures understanding of relevant considerations for the employment and integration
of air power within joint operational planning and execution. The liaison element should possess the
authority to represent its commander regarding time-sensitive and critical issues, and must be
equipped and authorized to communicate directly with its commander. A component liaison element
must be familiar with the details of all component space, cyber, air, surface and subsurface missions.
It should possess the expertise and/or ability to plan and effect tasking of component capabilities.
The air liaison element (ALE) is an air entity staff under the command of the CFACC or DCDR-Air
located within either the joint force land component command (JFLCC), the joint force maritime
component command (JFMCC), the theatre space component (TSC), the joint forces special
operations component command (JFSOCC) or other relevant component commands.
The maritime liaison element (MLE) staff is the maritime entity staff under the command of the
JFMC. It is located within the NCS JFAC or DCDR-Air (CS) and acts as the representative of the
JFMC. The overall role of the MLE is to integrate the maritime plan with that of the COM JFAC,
thereby ensuring an effective and efficient joint execution of the JFC’s campaign plan.
The Land liaison element (LLE) staff is the land entity staff under the command of the JFLC. It is
located within the NCS JFAC and acts as the representative of the JFLC within the NCS JFAC.

NATO UNCLASSIFIED Page 69

 NATO UNCLASSIFIED

The special operations liaison element (SOLE) is aware of the activities of special operations units in
the battlespace and provides a special operations force presence within NCS JFAC or DCDR-Air
(CS). The SOLE coordinates, integrates, de-conflicts, and synchronizes special operations force air,
surface, and sub-surface operations with conventional air operations.
Other military forces, international organizations, other government agencies and NGOs may be
conducting activities near or in areas of military operations, and LOs from these organizations to the
CFACC or DCDR-Air may be appropriate. To the maximum extent possible, commanders should
assure that these organizations’ efforts and the military efforts are integrated, complementary, or not in
conflict.
CFACC as Airspace Control Authority organises airspace control management of C-UAS employment
using all available airspace control means.
Airspace control (ASC) is the implementation and coordination of the procedures governing airspace
planning and organization to minimize risk and allow for the efficient and flexible use of airspace. The
objective of ASC is to maximize the effectiveness of military operations while minimizing fratricide.
ASC provides a commander with the operational flexibility to effectively employ forces according to
mission priorities.
Airspace users participate in the planning of ASC and adhere to the procedures and measures in effect.
Depending on the scenario, this includes planners for military aircraft (manned and unmanned), ASC
agencies, AD forces, C-UAS forces, indirect fires (e.g., cruise missiles, artillery systems), and civil
aviation and ATS (air traffic services) in neighbouring nations or other affected areas.
The joint airspace coordination centre (JACC) is the ACA's primary ASC facility for coordinating the
use of airspace within the designated ASC-area. When the COM JFAC is also the ACA, the JACC is
in the combat plans division of JFAC. The JACC generally performs the following functions and
tasks:
 Coordinate requests for coordination measures (CMs).
 Resolve conflicting requests for CMs, referring those that cannot be resolved through the
ACA to the JFC for final determination.
 Promulgate activation/deactivation/modification of CMs by dissemination of the ACO. The
ACA may delegate to an air operations centre (AOC) the authority to coordinate airspace
changes dynamically with affected airspace users before a change to the ACO is formally
promulgated.
 Coordinate with NATO/national military commanders, component commanders, adjacent
ASC authorities, and affected national/international civil and military agencies, when
necessary.
It is often likely that the jurisdiction for a potential Class I UAS event may cross a number of military
and civilian agencies which require further control by C2 elements. There must be a clear
understanding and application of agreed areas of responsibility for a Class I UAS event between host
nation and/or allied partners to ensure an effective, co-ordinated approach. Sharing of critical C-UAS
information must also be instinctive to ensure that all relevant agencies are prepared to offer a co-
ordinated response to a potential Class I UAS event.
The ACA exercises ASC authority through a variety of agencies:
 Control and reporting centres (CRCs) are fixed or mobile ground-based units with long-
range air surveillance radars and voice and data communications capabilities.
 Military ATC and civil ATC facilities (as required) providing terminal and en route control.
 Air Support Operations Centres. Collocated with a corps headquarters or an appropriate land
force headquarters, the Air Support Operations Centre plans, coordinates, and directs close
air support and other tactical air support.
 Other Component airspace control elements. These activities (e.g., maritime tactical air
coordination centre, army aviation airspace controllers, fire support coordination centres)
provide airspace control within component assigned airspace.

NATO UNCLASSIFIED Page 70

 NATO UNCLASSIFIED

Critical to effective C-UAS C2 is the ability to detect, track and ID a potential Class I UAS event as
early as possible and the means to provide early warning across the unit. Organic, specialist C-UAS
defence capabilities will offer the most effective early warning but, as a defence level asset, cannot be
assured to be available. Therefore, commanders must be reliant on the application of existing
resources to achieve the required C-UAS effects, utilising any existing sensors innovatively and
flexibly to detect and even track a potential threat. This must be supported by a robust, layered
communications system to disseminate detection and threat warnings and updates across the unit. A
simple reporting system will be essential given the dynamic nature of a Class I UAS threat but must be
reliable and accurate to minimise the propensity for confusion or conflicting reporting which is likely
to occur during a potential Class I UAS event. Standardized reporting formats, visual recognition
training, and basic threat awareness should all serve to reinforce effective C2 during an event. The
NATO C-UAS reporting format to this note, should be used at all levels as a basic aid to enable timely
reporting of an event. Moreover, C2 should have pre-planned and standardized tannoy and J-Chat
messages which will further support rapid responses across the unit to a potential Class I UAS event.
Operational commanders should be supported by a C2 system which allows to execute control
(through surveillance, detection, identification and action if necessary) and coordination of the
airspace layer that includes the Class I UAS, as well as the integration of C-UAS subsystems through
the principle of centralized control, decentralized execution (or Mission Commands as described in
AJP-3, AJP-3.2, ATP-3.2.1 and ATP-3.2.2). The C2 system should allow exercising control and
coordination responsibilities in a modular and scalable way; the growth should be carried out
prioritizing the most critical areas and subsequently expanding to the rest of the AO. This system
should be integrated into the Air Command and Control System to the extent possible and should be
integrated with systems used by civilian and homeland security organizations, especially from Air
Traffic Control (ATC) agencies.
In addition, the C2 system must support:
 Airspace Control and Airspace Management.
 Rules of Engagement and Risk Management.
 Tactical Air Picture and Early Warning.

NATO UNCLASSIFIED Page 71

 NATO UNCLASSIFIED

Figure 2 Command and Control component of the C-UAS system

Effective cross agency liaison and communication must be assured during a potential Class I UAS
event, in particular in the air operating environment where air safety must be maintained at all times.
Co-ordination with airspace management, air operations, frontline aviators and any joint fires staff
must be instinctive. This will require co-location, where possible, to enable detailed understanding of
the situation and air picture, co-ordinated and proportionate action, application of relevant Rules of
Engagement (RОE) and to minimise the risk of an air-safety infringement or fratricide. However, the
Right of Self Defence must be predominant in case of Class I UAS attack. In the event of engagement
of the Class I UAS, clear engagement zones, weapons control and engagement lines of authority must
be fully understood and applied.
Basic considerations:
 To stress the importance to integrate the different systems from not only the different joint
forces, but also of different troop contributing Nations, and logistics aspects of how the
nations will be able to bring their resources to the operating area.
 Situational Awareness, Information, and Knowledge Management are interrelated. They are
further aided or hindered by how well systems are integrated. Therefore, task force
organisation needs to consider the C-UAS requirements and possible adaptation of the
existing C2 architecture, and integrate their command and control requirements into the
organisational structure, which will have an effect on SA and IKM.
 Having the common operating picture is key, especially the ground picture in order to avoid
fratricides. Additionally, a Battle Management Concept of Operations (CONOPS) would
make mission execution much more efficient and effective.
 Decision-making is crucial in countering Class I UAS because the short reaction/action time
between detection and neutralization. There is the command and control process very
important and within the shortest time possible, a defence/neutralisation proposal must be
provided to the operator. Some nations will always have a man in the loop for the
neutralization step. In a dynamic situation or a Class I C-UAS saturation attack, pre-defined
procedures for de-centralised and autonomous mode of operation of C-UAS effectors should
be considered and established.
UAS Command and Control (C2) Architecture. A key component of UAS capabilities integration is
the need for a common approach to command and control architecture to support Line of Sight/Radio
Line of Sight (LOS/RLOS) and Beyond Line of Sight/Beyond Radio Line of Sight (BLOS/BRLOS),
and Satellite C2 operations. This architecture of many UAS can be complex, may have multiple nodes
on the ground and in space, can be expensive to establish and operate, and comes with unique security
concerns.
Armed Forces and Home Land Security coordination. The degree of coordination will depend on the
possibility of integration of the respective C‐UAS systems in a single C2 system, or interoperability
between C2 systems of both organizations. Other aspects to consider are joint training to know each
other's capabilities and TTPs, as well as the intelligence exchange relative to the threat. It is also
beneficial for legal implications for interception.

5.4.1 Interoperability
Interoperability at the operational and tactical levels is where strategic/political interoperability and
technological interoperability come together to help Allies shape the environment and manage crises.
The benefits of interoperability at these levels, generally derive from the interchangeability of force
elements. There are many operational and tactical challenges to interoperability (e.g. technological,
command and control, doctrinal differences and resource gaps), a lot of which can be addressed
through the establishment of common tactics, techniques, and procedures (TTPs) .

NATO UNCLASSIFIED Page 72

 NATO UNCLASSIFIED

Information & Knowledge Management (IKM)

The main operational principle in C-UAS operations should be the “joint effort” and collective
self-defence of all of the actors involved in countering the threat, with the central idea of
“interoperability” of all the means employed to neutralize it. To achieve success it will also be
necessary:
 Capability to operate in an interconnected and integrated environment.
 Flexibility to adapt to a threat dynamically. Does not exist a single C-UAS operational
solution. One C-UAS configuration does not fit all the operational scenarios.
 Strengthen coordination among the military services, and between them and all the
homeland security forces. Centralized planning – Decentralized execution.
 C-UAS systems must be interoperable with Air Defence and Force Protection
systems.
Observation, Indication, Intelligence collection and reportin g of threat UAS detection is also
critical for the support of survival of all units in the operation area. (Horizontal and Vertical
Cooperation, Information Exchange and Reporting each other)

Figure 1 C-UAS intersection with other domain

Interoperability among C-UAS systems and the above layer of Air Defence systems as well as civil
ATM systems is fundamental at least for the following reasons:
 to keep the airways next to airports clear from unauthorised UAS.
 to rely on C-UAS systems as an air-defence gap filler, occasionally to enrich the COP at the
above layers.
 to signal defending UAS activities to C2s external to C-UAS systems themselves.

5.4.2 Rules of Engagement (ROEs)

While the law of armed conflict governs the ethical behaviour in all conflicts, ROEs focus on
additional, specific limitations that address concerns that are more political. ROE provide the
constraints for military action in every crisis. These rules strive to ensure that the military will not
escalate a situation beyond the political aim of the intended conflict. ROE seek to mitigate risk for the
politician by limiting the commander’s actions during conflict. For the military, these regulations
provide authority when operating outside the home nation. In sum, ROE for C-UAS are likely to vary
by conflict.

NATO UNCLASSIFIED Page 73

 NATO UNCLASSIFIED

The time that commanders need to send authorization for engagement to the weapon platforms limits
the time for reaction. Moreover, because of the nature of Class I UAS, sometimes identification is not
possible in a dynamic operational environment. It is critical to develop and establish simple
procedures that allow immediate engagement.
In peacetime, countering UAS will be bounded by specific legal constraints, which may differ from
these applicable to expeditionary missions. Depending on the country and its domestic law, which is
applicable during peacetime, circumstances may prohibit certain types of countermeasures and limit
the options for defending against UAS. These possibly prohibited countermeasures include kinetic
engagement of airborne unmanned systems, jamming of publicly used frequencies, such as GSM or
wireless networks, or interference with the commercial Positioning, Navigation and Timing (PNT)
signals.
The specific type(s) of defence employed will depend on the ROE and available technology. Once
detection of a UAS occurs, the appropriate weapon system should ensure that a low probability target,
like a Class I UAS, does not always receive a high-cost ordinance like a surface-to-air missile.
Different unit sizes should consider different types of defence depending on the anticipated enemy
threat and the ROE. The advantage of a kinetic system is that it typically destroys the UAS
immediately; however, it also risks collateral damage, fratricide, or violation of ROE. Non-kinetic
defensive systems maintain the integrity of the UAS and are less prone to collateral damage or
fratricide; however, are over reliant on electronic systems. Commanders need to have guidance to
consider this type of ROE issue before approving defensive measures. Commanders need to combine
guidance with the conflict-specific ROE to develop an effective operational plan to apply to state or
non-state conflicts.
It is necessary to establish and disseminate clear ROEs to counter Class I UAS, defining the
circumstances, conditions, degree and manner in which it may or may not be applied force, with
special attention to possible collateral damage that could be caused by the neutralization of the UAS.
The application of ROE will be difficult when the UAS payload cannot be identified, or it is not clear
who is piloting the aircraft (its state origin or not state). Depending on the readiness posture and/or the
infrastructure/area of operations, one ROE could state that any system not providing a transponder
signal could be classified as potentially hostile.
5.4.2.1 Deconfliction
Basic Considerations:
 Friendly and neutral UAS. Mutual interference. Identification registry, matrix.
 Comprehensive approach. Integrate civil authorities into campaign planning. More than civ-
mil cooperation.
 Interoperability of doctrine & policy with all the actors, especially within NATO: TTPs,
lexicon, ROEs.
 Legal framework, Host Nation Agreements and Policies.
 Alliance-wide information sharing. As unclassified as possible.
 Deconflict EME. Coordinate with all actors jamming possibilities.
Defeat adversary UASs without interfering with friendly operations. Airspace control and fires
deconfliction are tough to do with enemy UAS in your airspace. Synchronization/Deconfliction
employment of capabilities/forces, and matching appropriate weapons against enemy critical
vulnerabilities are essential functions for the Area Air Defence Commander. Effective UAS defence
operations require the joint force to fuse air and ground based sensors in a real time common operating
picture enabling the force to detect and engage threat UAS using lethal and non-lethal options.
Command and control of air defence assets must allow rapid UAS engagement while simultaneously
providing threat warnings and controlling individual UAS attacks without fratricide. All of this must
occur while integrating UAS defence operations with airspace control and fires. If this sounds hard, it
is because it is.
The following concepts must be applied to UAS/C-UAS operational planning:

NATO UNCLASSIFIED Page 74

 NATO UNCLASSIFIED

 Base Defence Zone (BDZ). A BDZ is an air defence zone established around an air base and
limited to the engagement envelope of short-range air defence weapons systems defending
that base. BDZs have specific entry; exit; and identification, friend or foe (IFF) procedures
established.
 Short-range Air Defence Engagement Zone (SHORADEZ). A SHORADEZ is airspace of
defined dimensions within which the responsibility for engaging air and missile threats rests
with short-range, air defence weapons. It may be established within a low- or high-altitude
missile engagement zone. A short-range, air defence engagement zone is established for the
local air defence of high-value assets. Commanders should plan to employ decentralized
control of short-range, air defence weapons within the SHORADEZ. Short-range is based on
a combination of geographic factors and altitude limit tailored to the threat and capabilities
of the assigned SHORAD weapon systems.
 Weapons Free Zone (WFZ). A WFZ is an air defence zone established to protect key assets
or facilities, other than air bases, where air defence weapon systems may fire at any target
not positively recognized as friendly. A WFZ is used for high-value asset defence in areas
with limited C2 authority. The area air defence commander declares weapons free with the
airspace control authority establishing the zone.

5.4.3 Standardised Reporting

Commander's Critical Information Requirements (CCIR) is information identifed by operational
commanders as being critical in facilitating timely information management and the decision-making
process that affect successful mission accomplishment. From C-UAS perspective, the C-UAS
reporting model identified two types of reports: operations reporting and analysis reporting.
Commander should set conditions allowing forces at all echelons to recognize and report airspace
violations and confirmed enemy action that occur within their area of operations. Unit planning should
include current threat sets and standardized reporting guidance. Reporting information for C-UAS
activities must be standardized. This information should include model, capabilities, and flight
profiles. Unit standard operating procedures may include model and capability profiles found within
Class I UAS. These profiles will provide C-UAS planners with the suite of capabilities associated with
each group.
Flight profiles associated with threat UASs can assist C-UAS planners in planning for a specific Class
I UAS threat. This can assist in conducting unit-specific C-UAS TTP. Timely detection of Class I
UASs can determine its flight headings and travel calculations (flight profile). Detection of threat UAS
by organic sensors or through observation can assist in determining its model and flight path.
Calculating speed, heading, and knowing the threat UAS’s endurance based on flight profiles
improves a unit’s chance of mitigating the UAS’s ability to conduct reconnaissance, surveillance,
intelligence gathering operations, and execute attacks on friendly forces.

5.4.4 Training Requirements

When conducting a training needs analysis for C-UAS operations the following points should be
considered:
 C-UAS is inherently a joint, combined, coalition, civ-mil mission, and must be trained to
accordingly in multi-national exercises.
 Senior level training in C-UAS operations is paramount.
 Close cooperation and coordination between civilian law enforcement agencies and the
armed forces are essential for a comprehensive C-UAS approach.
A challenge that must be dealt with by training authorities concerns the greater use of autonomous
systems. As systems become more autonomous, there is a risk that their operation will become less
transparent but the requirement to understand how systems work will remain.

NATO UNCLASSIFIED Page 75

 NATO UNCLASSIFIED

ETECTION EFFECTIVENESS.
Every detection system has drawbacks. For example:
Radar systems may struggle to pick out small UAS and UAS flying very close to the ground.
Camera systems might confuse a UAS with a bird or an airplane, and may struggle in adverse
weather with low visibility, or if the drone is backlit by a strong light source such as the sun.
Electro-magnetic interference can degrade the detection capabilities of RF sensors. In urban
environments, there are many potential sources of such interference, including communications
antennae, two-way radios, telemetry systems, and even power lines and LED lights.
Certain RF sensors, including some systems marketed as “passive” may likewise emit RF signals
that could interfere with other communications, making them potentially dangerous to deploy in
some environments.
Radar, certain RF systems, and EO/IR sensors must have a direct line of sight with the
intruding drone in order to make a detection. This could be particularly problematic in urban
environments, where a UAS may only appear within a sensor’s line of sight for a couple of
seconds before disappearing again.
Certain flight patterns, most notably hovering and moving vertically, can make UAs harder to
detect with automated tracking algorithms applied to radar or camera data.
Acoustic sensors rely on a library of sounds emitted by known UAS, while RF detection systems
likewise only detect certain frequency bands in a pre-established library. Given the rapid rate at
which UAs are emerging on the market and proliferating, even libraries that are updated often
will never cover 100 percent of the UAS that might be operating at any given time.
In order to be useful, C-UAS detection systems must generate LOW levels of false negatives and
false positives. This will require an appropriate level of sensitivity by the sensors and a high level
of labour to distinguish true-positives from false-positives in cluttered environments.
Distinguishing legitimate and illegitimate UAS use. A C-UAS system that cannot tell the
difference between allied and adversary-unmanned aircraft could accidentally shoot down
friendly UAS.
Response window. C-UAS operators may only have a very brief window of time to make a
decision as to whether an incoming UAS is indeed malicious. Thanks to advances in propulsion
technologies, commercially available UAS will become much faster in years ahead, further
reducing the viable response window for C-UAS.
5.5 4 OPERATIONAL CONDUCT

5.5.1 Engagement Procedures

Once a Class I UAS is detected and identified as a threat, mitigation begins. Mitigation is a denial of
the success of the mission, including the potential destruction of the Class I UAS target.
NATO UNCLASSIFIED Page 76
 NATO UNCLASSIFIED

There are various types of effectors that could be used to deny a Class I UAS mission, for example:
missiles, guns, laser systems, electronic counter measures/high power microwave/high power
electromagnetic weapons, and non-destructive techniques.
Although it is often very difficult to shoot down an unmanned aircraft, route, altitude, and entry/exit
points should be considered in pre-mission planning to minimize/avoid threats.
When implementing engagement procedures the key points to consider are:
 Threat identification,
 Engagement plan,
 Fire on-the-move and defence of manoeuvring combat units.
Important key points regarding effector choice:
 Some types of weapon systems may not be appropriate because of safety constraints and the
risk of collateral damage near to civilian infrastructure during peacetime.
 The intercept range, or the range of influence of an effector, must be greater than the potential
standoff range of the UAS, in the event that the UAS is carrying a threat payload (i.e. the UAS
is not the payload itself).
 The effector may dictate requirements of the sensor. For instance, certain detectors may
require target designation, tracking, and high sampling rate. This is also true in the opposite
direction, where the most effective sensors may restrict the type of mitigation methods. In
essence, the two must complement one another so that the system is most effective.
In addition to stopping an attack in progress, a coherent defence strategy should also include ways to
prevent an attack from occurring, and should an attack occur, it should consider recovery and forensics
to prevent further damage. Eight layers are identified: regulation, prevention, readiness, detection,
identification, passive defence, active defence, and post-attack recovery and forensics. These will
address three stages of an attack: preparation, execution, and exploitation

Figure 3 Defensive measures and attack stages

In the figure below, it is identified the threat components and capabilities to be countered, depending
on the altitude/location of it.

NATO UNCLASSIFIED Page 77

 NATO UNCLASSIFIED

Figure 6 Future GBAD Airspace

5.5.2 Desired Effects

5.5.2.1 Threat Neutralization
Depending on the type of threat/s identified in the deployment area, the mission analysis, the risk
assessment, and the study of collateral damage, would determine the most appropriate neutralization
segment (s) (SBAD-SHORAD, C-RAM and C-RPAS kinetic or non-kinetic) to be deployed.
Neutralization is the phase of the Class I UAS defence with the aim of disturbing, controlling or
destroying the threat, using kinetic and non-kinetic weapons systems.
Desired effects of countering efforts are:

NATO UNCLASSIFIED Page 78

 NATO UNCLASSIFIED

 Neutralize. Render the target ineffective.

 Deny. Hinder the adversary's use of their UAS.
 Destroy. Render the UAS unusable.
 Exploit. Deception measures in order to use UAS to track back to the ground control station or
to give the enemy deceptive information.
 Blind. Render surveillance capabilities of the UAS ineffective.
 Spoof. Trick the UAS into not achieving its goals.
 Overwhelm. Render the surveillance capabilities of the UAS ineffective.
 Steal. Control the UAS to access what information it has on board.
 Deceive. Trick the UAS into believing in something that is not true.
Main C-UAS interdiction methods (kinetic) are:
 Jamming (RF, GNSS, or Both),
 Net,
 Spoofing,
 Laser,
 Small Arms Fire,
 C-UAS designed munitions (40 mm proximity rounds, 12-gauge shotgun),
 Microwave Effector,
 Electromagnetic Pulse,
 Water Projector,
 Sacrificial Collision UAS..
5.5.2.2 Collateral Damages
UASs that have their flight interrupted by physical means may fall to the ground at considerable speed
(net effectors may eliminate this risk). Some interdiction systems, such as kinetic, jammer or high
power electromagnetic, are likely to be inappropriate for use over crowds, and are likely to be limited
to operations in remote areas. Depending on the payload, e.g. biological toxins, chemical gases or
explosives, it may be required to maneuverer the UAS out of range of friendly forces or civilians
before the actual countermeasure comes into force. Therefore, ‘traditional’ C-UAS approaches which
take effect on the spot need to be reviewed and should consider new approaches such as capturing
aerial vehicles and neutralizing payloads. Taking over C2, manipulation payload or jamming of an
adversary UAS, transfer legal responsibilities of flight safety and collateral damages to the controlling
authority. All C-UAS measures of that nature should consider and completely avoid all possible
negative consequences to civilians and own forces.

5.5.3 Post-Engagement Actions

Post-engagement technical exploitation of UAS provides essential information to support of a variety
of outcomes including force protection, air defence, targeting, component and material attribution,
signatures and observables and even civilian rule of law actions. As a part of the C-UAS reporting
process, analysis reporting enables exploration of data in order to extract meaningful insights. These
post-engagement outcomes contribute significantly to tactical, operational and strategic efforts to
counter adversarial use of UAS beyond the scope of single engagements.

NATO UNCLASSIFIED Page 79

 NATO UNCLASSIFIED

The UAS Technical Exploitation Lexicon (2nd Edition, 16 AUG 2019) published by USA DTRA, and
recently adopted by NATO, suggest the following technical exploitation process flow:

Figure 8 UAS Technical Exploitation Lexicon

Elements to consider in post events actions are:

 Effectiveness of Engagement.
 Analysis / Forensics.
 Lessons Learnt for Technical Exploitation.
 Recover and examine methodically in order to assess and exploit.
 Recover through appropriate means. If required CIED, CBRN, etc.
 Effectiveness of Engagement.
 Analysis, Forensic, Technical Exploitation.

Depending on the circumstances, once a UAS is intercepted the device may need to be isolated and
retrieved. If the UAS is potentially armed, an explosive ordnance disposal team may be called in to
assess and, if needed, disable the device. Unarmed UAS must likewise be treated with caution. If the
NATO UNCLASSIFIED Page 80
 NATO UNCLASSIFIED

device is damaged, its lithium-ion battery poses a risk of combustion. If the device continues to be
functional, its rotors can pose a risk of injury. Those wishing to perform forensic analysis on the
device may need to follow a series of steps to ensure that the integrity of the system and the potentially
valuable data it carries are not compromised.
==== ----------- ====
5.4.8.1 PLANNING TASK LIST
A notional C-UAS mission planning tasks is included, with the observation that it does not address
every conceivable task associated with C-UAS operations, but rather captures and codifies key
planning elements (e.g. it only mentions RF jamming effector).

Table 2 Planning Activities

Activity Description

Mitigation Selection Determine primary (and if applicable) secondary or tertiary

mitigation mechanisms for UAS threats. Determine how the
employment of various mitigations will be determined.
Determine engagement authority and coordination
requirements, if required.

Communication Plan Identify communication requirements modalities and

limitations. Establish primary (and secondary) means of
communication. Codify coordination plan for authorized
UAS flights. Articulate communications purpose and
information flow (should be responsive to who, what, where,
when, why, how communication should occur).

Coordination Plan Identify how C-UAS activities integrate into overall security
plan. Describe capabilities and other stakeholders. Determine
coordination requirements.

Social Media and Public Information Identify means of public information dissemination,
including the applicability of TFRs, NOTAMS, etc. Identify
how information will be disseminated and how
communication modalities will be monitored and responsive
to public inquiry.

Identify Mission Objectives Determine primary objectives such as area or target to be

protected, duration and other requirements.

Site Survey Conduct site survey to determine likely areas of UAS launch,
ingress and egress routes. Correlate site locations with
established NOTAMS/TFRs, etc. Determine areas where
UAS-disabling mitigation strategies would be hazardous
(area of vehicular traffic, crowded areas, etc.)

NATO UNCLASSIFIED Page 81

 NATO UNCLASSIFIED

Observation Point Selection Determine areas of best visibility for UAS visual detection.
Consider sun positioning, background contrast, and lighting.
Establish visual landmarks references and determine the
distance to aid in threat distance estimation and coordination.

C-UAS Equipment Deployment Determine line of sight for RF detection and interruption
equipment. Determine equipment deployment limitations,
based on logistical requirements (availability of electricity,
control cord length, communication coverage, etc.). Identify
likely coverage gaps based on equipment capabilities and
effectiveness.

Probable Threat Assessment and Identify possible threat platforms based on probable threat
Taxonomy intent (attack, video recording, hobbyist flight, etc.),
consumer availability, prior encounter experience, local
knowledge, environmental favourability (i.e. open areas are
favourable to fixed wing UAS, whereas obstacle dense are
not).

Risk Assessment/ Risk Tolerance Determine risk tolerance to protect target. Codify measurable
criteria to determine risk elevation (standoff distance, UAS
type, size, speed, etc.), establish risk assessment matrix.

Identification Matrix Development Determine means to identify authorised vs. unauthorized

UAS flights. Integrate elevated response matrix triggers
based on risk tolerance and risk assessment.

5.4.9 ENGAGEMENT MODEL

This engagement matrix provides a holistic approach to the C-UAS response. The model represents a
long-chain decision-making process, and certain steps could be hastened or even skipped, based on
operational environment, the relative severity of the threat, and timeliness of response

TABLE 3 ENGAGEMENT TASKS

Task Description

Detection Detect unauthorized UAS operation.

Track Fix location, speed, course, altitude and track visually or via other means.

Threat Assessment Confirm regulatory or airspace violation and threat potential of UAS system.

Search Conduct hasty search for UAS operator; if found communicate requirement to
disengage activities and land UAS.

NATO UNCLASSIFIED Page 82

 NATO UNCLASSIFIED

Identification Determine identification of brand/model UAS (if possible).

Evaluate Evaluate UAS brand/model vulnerabilities.

Selection Determine appropriate countermeasures/mitigation system to engage UAS.

Situational Analysis Evaluate situation and environment to determine hazards or potential collateral
effects of engagement.

Risk Assessment Determine risk level associated to determine hazards or potential collision
effects of engagement.

Decision Make engagement decision

Engagement Perform engagement.

Effectiveness Determine effectiveness of countermeasure/engagement strategy. Confirm if

UAS threat has been neutralized or disabled. If ineffective, return to Evaluate
step.

Disengagement Discontinue employment of countermeasure system.

Locate Locate UAS platform or wreckage.

Examine Examine UAS for collateral threats or effects (i.e. attached IED, CBRNE,
HAZMAT, fire, etc.)

Respond Respond to collateral threats or effects.

Investigation Collect applicable evidence, including scene photos, UAS identifying

markings, testimony of witnesses or other relevant information.

Secure Secure the UAS platform, as appropriate.

Enforce Locate and report/coordinate detainment/citation/trespass offending individual,

as appropriate.

Document Document threat, circumstances, engagement, results, and investigation

findings.

Report File applicable reports with appropriated agency or jurisdictional authority

Reconstitute Reequip for subsequent response or engagement, as required.

NATO UNCLASSIFIED Page 83

 NATO UNCLASSIFIED

XX – EDUCATION, TRAINING AND EXERCISES

Introduction
The emergence of a new type of threat, at the moment more developed in the third dimension,
has changed our established view of military operations. The introduction of UAS, in its
broadest sense, has confronted us with challenges and technologies for which we were not
fully prepared, neither conceptually nor operationally.
The introduction of concepts, strategies, doctrines and whatever else is necessary to counter
such threats, is evolving more slowly than the threat itself. In this sense, it is indispensable to
assume an adaptive and predictive resilience posture (in addition to the “reactive” one) that,
without any doubt, must be corroborated by a structured, mandatory education and training
capacity and framework.
The following paragraphs will briefly describe some strategic, operational and tactical-level
considerations, with a focus on education, training and exercises.

Overview. Without a single solution to counter Class I UAS threat, leaders and operators must
be aware on UAS capabilities, associated adversaries TTPs, all potential risks and dangers
that these UAS may cause to personnel, infrastructures, equipment and, at the end, to the
success of the operation.
In this sense, C-UAS training is becoming increasingly important as the use of drones in both
civilian and military contexts continues to grow.
The importance of C-UAS education and training (E&T) is crucial for law enforcement,
military, and security personnel, as well as for those working in critical infrastructure and
other high-risk industries.
In light of this, it is recommended that all NATO countries establish C-UAS E&T programs.
These programs should focus on a wide range of topics, including drone technology, flight
patterns, and sensor capabilities, as well as tactics and strategies for detecting and neutralizing
UAS threats.
Hands-on training, using simulated scenarios, table-top exercise and live ones, should be a
key component of these programs to give policy makers, Commanders and students real-
world experience.

Additionally, C-UAS education should include legal and regulatory aspects to ensure that
trainees understand the laws and regulations surrounding the detection, tracking, and
neutralization of UAS threats.

As the C-UAS technology and the threat are constantly evolving, education and training must
also be adaptable and up-to-date.

NATO UNCLASSIFIED Page 84

 NATO UNCLASSIFIED

At Strategic level.

C-UAS capabilities require that joint, interagency, multinational and public partners have a
role in countering the UAS threat. A strategy to align these efforts across partners is required
for success. Strategic requirements must promote cross-domain solutions (maritime, land, air),
recognizing that UASs and future Autonomous Systems may affect all environments. A
whole-of-government approach is required, recognising that a C-UAS capability will involve
partners from Government and from industry. There is no single comprehensive material
solution that addresses the C-UAS challenge, and no single joint or multinational capability
that may neutralize the C-UAS threat by itself. Success for C-UAS defence requires the
integration of numerous capabilities, across three broad principles to guide future resources
and efforts:

- Open innovation, foresight and CD&E. .

 Common and trasversal efforts and understanding. The right solution comes from
the synergy of different brains. A mutual, interdisciplinary, innovative effort must
be the result of cooperation between civilian and military sectors. In this sense
Academic discoveries, concepts and experimentations (in general R&T) shall be
coniungated in a single prospective, characterized by shared lines of effort and
objectives.

 Whole-of-Government Approach. The C-UAS challenge exists not only at the

military level, but also for several governmental departments and agencies.
Governmental partners play a significant role in C-UAS defence. Efforts should
be coordinated and synchronized as in military partnerships and alliances.

 Joint and Combined Solutions. Joint and combined solutions should be pursued in
order to synchronize C-UAS capabilities to deliver mutually complementary
effects. This would include both national military systems and solutions
developed within the Alliance

 Integrate Capabilities Across All Domains. The interoperability requirement to

integrate solutions that cross multiple domains represents the approach necessary
for an effective C-UAS capability. It includes C2, GBAD (including C-UAS
weapons), EW, direct fire, air operations and appropriate surveillance systems.

In this respect, education and training opportunities and events should be actively promoted
across NATO, partner Nations, Governmental Institutions and Industry, to develop a threat
awareness culture, share the knowledge and stimulate innovative solutions.

NATO UNCLASSIFIED Page 85

 NATO UNCLASSIFIED

At Operational level.

The operational level is where campaigns and major operations are planned, conducted and
sustained within a theatre or area of operation. It is the link between the strategic and tactical
levels. C-UAS defence planning and execution has a direct impact on activities at the
operational level, and C-UAS defence concepts and plans should be developed, introduced,
rehearsed and applied throughout the whole spectrum of operations, from major combat
operations to peacetime military engagement.

Introducing Class I C-UAS events into Exercises would offer training opportunities to
develop and apply planning principles and considerations, like for examples:

- Joint & Combined understanding and awareness. Military operations are nowadays
characterized by multidimensional, layered and trasversal interactions. A whole of
approach must be taken in account. Cyber and space capabilities are often the backbone of
many other systems and interoperability becames a crucial need and risk, at the same time.
Including C-UAS activities inside an operational planning means understand and predict
all possible interactions with different domains and operations.

- Centralized planning Centralized planning ensures a unified approach to the C-UAS

challenge. E.g., a threat database could be used to identify and classify adversarial UAS.
Intelligence reporting may include adversarial UAS flight profiles, which may be of
assistance to planners when conducting air intelligence preparation of the operational
environment (IPOE), to identify likely locations for ground control stations and launch
locations.

- Decentralized execution. Hostile act criteria (HAC) and Rules of Engagement (RoE),
established at the theatre level for C-UAS defence, enable operators to take appropriate
actions against the UAS threat. The speed of these aerial threats, coupled with likely short
detection and reaction times by friendly forces, necessitates a decentralized approach
against the Class I UAS threat. Considering a no-fly zone around bases on expeditionary
operations will assist with force protection. As Class I UAS are increasingly being used
by recreational and commercial users, these same systems may be used by adversarial
forces for surveillance, reconnaissance or attack purposes.

- Alert and Warning. This involves planning, integrating and networking resources to
develop the threat UAS situational awareness and provide early warning, including
identification of adversaries’ ground control stations and launch and recovery areas.
Establishing early warning by networking air surveillance radars will provide better
warning and reaction time for friendly forces.

NATO UNCLASSIFIED Page 86

 NATO UNCLASSIFIED

- Layered Defence. A layered defence provides multiple engagement opportunities, ideally

at the maximum range from friendly forces and installations. Layered defence would
involve allocated GBAD assets, as well as C-UAS sensors and effectors, to ensure
protection of forces and installations from an omni-directional threat. This can be
achieved by integrating C-UAS capabilities with GBAD and Early Warning. It may also
include the positioning of “air sentries” for observation and early warning.

- Threat exploitation. Availability of technical exploitation assets would be essential

during a C-UAS post action event. Recovering a downed or captured UAS would allow
further forensic investigation, assessment on adversarial capabilities and TTPs, appraisal
of C-UAS effectiveness, instillation of a LI/LL process.

At Tactical level.

Commanders must prepare, plan, execute and assess their tactical units’ skills in the context
of the Class I UAS threat in the operation environment.

The units should develop and refine C-UAS training and associated procedures tailored to the
expected threat environment. Individual and collective tasks should be identified, planned,
practised through field training exercises, command post exercises, computer-assisted
exercises, constructive simulations and table-top exercises and evaluated during exercises and
rehearsals.

The most effective C-UAS defence is achieved through proper planning, education, training,
and coordination and execution of unit training plans. Units must plan for, train for, and
execute operations as an integrated combined arms team employing all forms of available
passive and active air defence techniques. Airspace management and coordination is another
key component of C-UAS training. When training, units must be aware of and conduct
integration and synchronization with airspace management agencies, air defence elements,
aviation and fires to successfully defend against the UAS threat.

At unit and subunit level, there may be limited organic sensor capabilities that may assist with
C-UAS operations. Therefore, to conduct a successful C-UAS operation, unit and subunit
operations staff must have access to information about aerial threats. Aerial threat warnings
for all aerial threats are transmitted via the early warning network, established by the air
defence cell at formation level. Unit command posts must receive this information so that the
aerial threat warning may be transmitted to their dispersed, subordinate forces. The initial step
in identifying threat UASs begins with timely and accurate spotting reports. These can be
reports that are transmitted on the early warning network or soldier reports based on visual
observation. Unit training for soldiers and staff is key to create the appropriate structure and
TTP capable of mitigating the UAS threat. Rehearsals must be carried out and reporting
procedures must be understood in order to ensure that timely and relevant information is

NATO UNCLASSIFIED Page 87

 NATO UNCLASSIFIED

provided to conduct successful C-UAS operations and limit the adversary’s possibility to
inflict damage on friendly forces.

Visual identification is detection by observation to confirm adversary activity. Visual

identification provides early warning and intelligence information for use in decision-making.
Visual identification and confirmation of Class I UASs is one of the most challenging tasks
that soldiers may be required to perform. Soldier training focused on “air sentry” procedures,
aircraft recognition training and timely reporting processes will help counter the Class I UAS
threat. Once the UAS has been visually identified, the risk to friendly forces increases
dramatically and immediate actions must be taken in order to mitigate the threat of
reconnaissance, surveillance and intelligence-gathering operations and direct attack.

C-UAS exercises and rehearsals can identify gaps in education, improve training and present
solutions to address the threat posed by adversary UASs. These rehearsals will assist in
understanding the actions needed to mitigate the UAS threat at unit level and below. C-UAS
rehearsals may consider the following activities:

- Prepare leaders and soldiers to understand that C-UAS defence requires timely and
actionable information flow;

- Establish passive defence (camouflage, concealment, hardening, movement discipline,

etc);

- Conduct active defence measures (engagement areas, target identification, open fire
policy, etc);

- Integrate surveillance capabilities such as air sentries into the formation-level surveillance
plans and C-UAS operations.

- Establish a communications link for C-UAS battle drills with soldiers at every level in the
unit;

- Conduct training scenarios for various adversary’s courses of action.

NATO UNCLASSIFIED Page 88

 NATO UNCLASSIFIED

Administrative remarks
Next meetings
[1)] 1221 FebJul 20232 at NATO HQ connected to C-UAS WG on 22 Feb (another doctrine
workshop),
1) 23 Mar 2023 at NATO HQ connected to JCGUAS (this is relevant for terminology)
[2)] Week of the 17 of Oct in ITA (C-UAS WG on 18-19 Oct) – tentatively

Tasking
[1)] JCO (NicoleBryan) will support
[a.] Reporting in the protection modelDevelop Chapter 4, Strategic Consideration – linked
to the Strategic Framework developed for NATO. -
[b.] Will provide input for strategic partUpdate the GBAD image in Chaptor 5.
a. Sean will update The complete Chapter 3, Protection Model
b. Merge protection Model into the
[2)] IAMD COE in lead with support from JFC, AIRCOM, MARCOMUSA
[a.] Chapter 5 on Operational Guidance - Troy
[b.] Remove parts related to Protection Model - NCIA
[c.] JCO in coordination to provide support with the rapid response kitNikolay will
continue to address some of the points in Chapter 5 (e.g Interoperability).
c. NATO HQ/SHAPE to issue a tasking to MARCOM, AIRCOM JFC to support with
this doctrine work.
[3)] NATO HQ, NCIA in lead with support from the tiger team
[a.] Chapter 4 on Strategic considerations
[b.] Bring this earlier in the document and rename as guiding principle
[4)] NCIA in lead with support from DEU, FRA and JAPCC
d.[a.] Chapter 2 on Threat Environment – NCIA,
e. Add the Class 1 UAS – Component Decomposition (Mario)
f. ITA CUAS COE will help with the review of section 2.1.1
2)[5)] NATO HQ and NCIA in lead
a. Chapter 1 Introduction
3) JCO (ops) and JFCB (Katie)
a. Add a section on the organization of C-UAS, with specialised and no specialised
players. Include a note on the chain of commands and information flow (e.g Battle
Captain, delegation of authority.
b. Add a generic example that can isllustrate the differences between GBAD and C-
UAS.
4) NCIA with support from ITA CUAS COE
a. Add a chapter on training
5) Terminology
a. JCO, TNO and DNK will review the 200 terms – this is not part of the doctrine but a
related task.
6) NATO HQ and JCO to draft a few lines of strategic considerations

NATO UNCLASSIFIED Page 89