Exploring IED Employment – Understanding the ‘How’ of IED Attacks

By Paul Amoroso, an explosive hazards specialist at Assessed Mitigation Options (AMO) consultancy

INTRODUCTION

As part of an ongoing series examining the 5W+H of IED attacks, this article focuses on the tactical employment,1,2 or ‘how’ of IED attacks. This series is intended to support the design, development, and sustainment of an accurate IED threat picture,3 ensuring that C-IED efforts4 remain effective and threat-aligned. By analysing IED incidents through the lenses of what, how, where, when, who, and why, the 5W+H approach offers a systematic method for understanding IED threats. This structured analysis enhances situational awareness and enables the identification of IED system strengths and vulnerabilities, ultimately guiding more effective investment in C-IED efforts.

This article begins by clarifying the distinction between the terms IED use and IED employment as they apply in this context. This introduces the key tactical data points known as tactical identifiers of IED attacks. It then presents a simple classification system based on tactical employment before advancing to a more detailed tactical characterisation of IED attacks, which involves analysis of their tactical intent and tactical design. Tactical characterisation is based on tactical identifiers. To support this, three analytical approaches will be introduced, each offering alternative methods for identifying tactical identifiers in an IED attack: 3Ys and 2 Outcomes; IDREAD analysis; TRACE-AS-ADDED framework. The next article in this series will outline the use of tactical identifiers in developing tactical design profiles and tactical signatures.

IED USE VERSUS IED EMPLOYMENT

The terms IED use and IED employment are often used interchangeably; however, they differ in analytical scope and precision. Understanding this distinction is essential for accurate reporting, threat analysis, C-IED planning and optimised decision making. Analysis of IED use provides operational and strategic level understanding of an IED threat, while analysis of IED employment provides tactical level understanding of IED attacks.

IED Use

IED use refers to the full spectrum of activities and behaviours associated with IED attack cycles,5 whether actual or threatened, across multiple incidents. It is a broad analytical term applied in strategic and operational assessments to characterise the activities of an IED system over time. IED use can include the activities:

  • Facilitation6 – establishing the enabling environment for IED attacks, which can include financing, recruitment, logistics, and communication networks being set up in parallel with other activities in an attack cycle. Facilitation helps ensure all other activities are possible and sustained.
  • Target selection – choosing a location, person, or asset that aligns with the attacker’s objectives coupled with the specific details on how a certain IED will be used against the selected target. It can include route analysis when targeting a mobile target. Targets are evaluated based on symbolic value, vulnerability, potential casualties, and media impact.
  • Pre-Attack surveillance – observing potential targets to gather intelligence, to help attackers understand routines, security measures, and identify weak points so that opportunities to attack can be identified. This phase can last days to months. Pre-attack surveillance may occur before or in parallel with acquisition, transport, manufacture and assembly activities.
  • Rehearsal – dry runs or route testing to assess attack site and vantage points with intervisibility into it, along with approaches to and escape routes from it. These are necessary to ensure the path to the target is accessible and predictable; chokepoints, surveillance cameras, or checkpoints are identified, and timings of activities can be understood such as timing traffic lights or observing patrol patterns
  • Material acquisition – procuring PIECES components or precursors chemicals needed to build the device, which may involve theft, black market purchases, acquisition through sanctioned or grey-market channels each of which may be local, external or via smuggling routes.
  • Transport – movement of components, network personnel, and propaganda material. It includes assembled IEDs from manufacturing or assembly locations to the target location, which may involve concealment efforts with routes chosen to avoid detection and minimise risk of premature detonation. It may involve, use of couriers, modified vehicles, or safe-house networks.
  • Manufacture – may involve fabricating specific components by repurposing commercial items, such as switches. It can also include the manufacture of components like improvised explosives or directional effect containers.
  • Device Assembly – involves constructing sub-assemblies, such as firing circuits or explosive trains, or assembling a complete IED using all required components aligned with the intended target effect and attack plan. Components may be manufactured across distributed locations and later brought together for final assembly at a single site. This process typically occurs in permissive or semi-permissive environments for the IED network, such as a safe house, garage, clandestine workshop, remote location, or any area that allows freedom of operation.
  • Emplacement – refers to the physical placement of the IED at the attack site or moving it in close proximity to the intended target. This action typically requires coordination with the execution timeline and may be adjusted to respond to changing conditions. Emplacement is carried out covertly to avoid detection and often involves disguising the device or deploying it during periods of low public presence. However, in some cases, depending on the attacker’s objective, emplacement may occur during periods of high public activity to reduce the likelihood of detection by security forces.
  • Remote Observation – monitoring the target area after emplacement possibly involving the use of cameras, spotters, or even drones to confirm target presence or crowd density and counter any actions by security forces or others to reveal its presence or render it safe.
  • Initiation – action to cause the device to function against the target to achieve the intended effects requiring coordination and synchronisation across all attack cycle activities. Depending on the firing switch and the attacker’s intent and escape plan, can be manual, remote, timed, or victim operated.
  • Post-attack activities – follow-up actions for strategic or operational effect:

– Escape and evasion
– Publicising the attack for propaganda and messaging
– Lessons learned of IED targets effects and tactical successes and failings

While the order set out of these activities reflects how IED attacks often unfold in practice, this sequence is not rigid with many activities overlapping and occurring simultaneously or in parallel. Having such a framework of IED attack activities supports analysis for identifying vulnerabilities or intervention points at each phase. IED use helps characterise the full operational capacity and sustained activity of an IED system within a conflict or region.

IED Employment

IED employment, by contrast, refers to the deployment of IEDs within specific incidents. It emphasises both the tactical intent and the tactical design of an attack, which refers to how a device is brought into proximity with its intended target. Tactical intent and tactical design provide insights into the planning choices, tactical reasoning, and execution behind an individual attack. This term is especially valued in intelligence and C-IED applications, as it enables the identification of tactical identifiers within an IED incident. These identifiers provide the critical data required to understand the tactics involved in IED incidents. We will now examine tactical identifiers, the key data needed to understand IED employment.

TACTICAL IDENTIFIERS

Tactical identifiers refer to the observable and inferable tactical features of how an IED attack is planned and executed. They describe how an attacker employed, or intended to employ, a device in relation to the target, within the context of the operational environment and local factors, to achieve the intended target effect. These identifiers are derived from analysing tactical factors such as delivery mechanism, placement, use of terrain, initiation method, coordination of attack cycle elements, and the concealment employed. Tactical identifiers can be outlined under various headings, such as the 3Ys + 2 Outcomes, IDREAD7 headings and the TRACE-AS-ADDED8 framework all of which are outlined later in this article. Tactical identifiers provide the data which are used to develop IED tactical profiles and tactical signatures which are covered in the next article in this series. Both IED tactical profiles and tactical signatures are critical to informing an understanding of the IED tactical sophistication of an IED threat.

IED CLASSIFICATION BY TACTICAL EMPLOYMENT

‘Tactical employment is a means of IED classification, in which IEDs are categorised by how the device and target were brought in proximity of each other. It often refers to the method of delivery allowing an understanding of how an attack was intended to be conducted. Tactical employment of IEDs includes vehicle-borne; animal-borne; person-borne (proxy or suicide bomber); emplaced; standoff;9 water-borne; air-borne;10 and postal IED.’ 11 While IED classification by tactical employment is an important and insightful means to classify IED attacks, there are broader considerations in terms of how IEDs are emplaced and employed that are captured under their tactical characterisation.

TACTICAL CHARACTERISATION

Analysing how IEDs are employed in attacks directly supports the tactical characterisation of an IED threat within a given context. This characterisation examines both the:

  • Tactical intent – intended function of the device12 i.e. the intended immediate, or direct tactical effect of an IED.13
  • Tactical design – planning and execution of IED attacks.

By providing insight into how IEDs are used or intended to be used, tactical characterisation helps assess the level of sophistication behind these attacks, which is an essential component in an accurate IED threat picture.

Tactical Intent of IED Attacks14

Within C-IED analysis, intent within an IED system can be assessed at tactical, operational, and strategic levels. In the context of IED employment, the focus is on tactical intent, the immediate objective of a specific act of violence, such as immobilising a convoy or targeting a government office to undermine local authority. While tactical intent is incident-specific, it can be aggregated across multiple events to reveal patterns of behaviour that point to an operational-level intent. For example, repeated use of time-delayed IEDs against infrastructure may suggest a deliberate effort to disrupt governance while avoiding direct confrontation. Over time, this sustained attack pattern can reveal a strategic purpose, such as weakening state structures or shaping conflict dynamics to serve ideological goals. Distinguishing between operational intent and strategic purpose is critical to designing, developing, and maintaining an accurate IED threat picture. Within such a threat picture, the IED system is assessed through its intent, capabilities, and opportunities to employ IEDs against defined targets. In this context, intent extends beyond the tactical level to operational and strategic levels.

To avoid confusion or contradictions in terminology, it is essential to clearly delineate the scope of intent being referred to. This requires distinguishing between singular tactical actions, macro-level tactical usage derived from clusters of incidents, and the overarching strategic campaign rationale. Tactical intent refers to the objective of an individual IED incident. When multiple tactical intents are observed across events and form a discernible pattern, this reveals consolidated operational-level behaviour by the IED system—best described as its operational intent. In contrast, the broader strategic ideological rationale that guides or justifies the widespread use of IEDs is most accurately characterised as the IED system’s strategic purpose.

Tactical intent, specifically, refers to the immediate or direct tactical effect15 of an IED attack. Assessing tactical intent involves identifying the target of the device and the specific objectives driving its emplacement. A previous article16 on IED classification introduced target effects as a method for categorising attacks, based on their intended primary impact. Tactical intent may include anti-armour; anti-personnel; anti-air; anti-infrastructure; anti-vehicle; anti-maritime; tactics, techniques and procedures (TTP) identification; obstacle creation; and breaching. These categories can be further specified. For instance, an anti-personnel IED may be more precisely classified as anti-EOD or anti-first responder, depending on its intended target. Additionally, descriptors such as suspicious packages, unattended packages, or bomb threats are often used to characterise IEDs within the context of TTP identification.

Tactical Design of IED Attacks

The tactical design of an IED attack outlines the various techniques and activities involved in its planning and execution. It focuses on device placement and the methods used to bring the target and device in proximity and achieve the tactical intent of the attack. Tactical design should as a minimum address the questions of ‘why here, why now, and why in this way’17 as well as assessing the outcome of an attack. This can involve applying the 3Ys + 2 outcomes tool. More comprehensive analysis of the tactical design of IED attacks are possible involving multiple tactical identifiers some of which are complementary and overlapping. Terms used to describe a specific type of device or component of a device, such as a SVBIED, are often used to describe all or part of the tactical design.18

3Ys and 2 Outcomes

As a minimum, the scene exploitation of an IED incident should answer the questions “why here?”, “why now?”, and “why in this way?”, while also determining “what was the actual outcome?” and assessing “what was the intended outcome?”. This is referred to as the 3Ys and 2 outcomes of an IED incident.

Why here? This question informs our understanding of the where of an IED attack and the exposure of the target to attack. It typically focuses on the attack geography along with consideration of the target of the attack.

Why now? This question informs our understanding of the when of an attack and the exposure of the target to attack which may include potential pattern setting by the target.

Why in this way? This question informs our understanding of the attackers’ tactical intent and aim, along with their capabilities in terms of the competency to plan, emplace and execute the attack. It can also provide insights into the various activities involved in a given attack cycle.

What was the intended outcome? This may also be considered the planned immediate, or direct tactical effect of an IED attack. It informs our understanding of who or what the intended target was and the attackers tactical intent.

What was the actual outcome?

There are several considerations to address when answering this question:

  • Is there a difference between the intended and actual outcome? If so, why?
  • Does this difference reflect the attacker’s lack of competence or professional capability? If so, what did they fail to do that prevented them from achieving their intended outcome?
  • Is there a gap between the attacker’s intent and capability?• Are current C-IED efforts effective in preventing the attacker from achieving their objective? If so, what specific actions did the target take to disrupt or counter the attacker’s intent?
  • Who were the actual casualties? Is there a difference between the intended target and the casualties? If so, why? Was this due to indiscriminate targeting, poor attack execution, C-IED measures in place, or a combination of these factors?
  • How do the casualties break down between injured and killed? What were the mechanisms of injury? Why did some casualties die while others survived?
  • What assets and infrastructure were damaged, and what was the level of damage? What capability was lost due to the attack?
IDREAD Analysis

A straightforward method for undertaking IED tactical characterisation is to use the IDREAD headings, which categorise IED attacks according to the tactical identifiers of Intent, Delivery method, Role, Emplacement location, Attachment method, and Device Orientation.19 Each of these tactical identifiers is also included within the more comprehensive TRACE-AS-ADDED framework. However, in this framework, emplacement location and device orientation from the IDREAD headings are encompassed within attack geography in the TRACE-AS-ADDED headings.

TRACE-AS-ADDED20 Framework

The acronym TRACE-AS-ADDED offers a structured framework for assessing the tactical characterisation of IED attacks. It presents a set of tactical identifiers that can be adapted to meet specific analysis needs, whether during on-scene exploitation or off-site evaluation. While comprehensive, the framework is flexible, and not all identifiers will necessarily be documented in every case. The tactical identifiers included in the TRACE-AS-ADDED framework are Tactical intent; Role; Attack geography; 21 Condition when found; Environmental conditions; Atmospherics; Sensor defeat; Attachment method; Delivery; Domain; Employment method; and Discovery method. Beyond its analytical role, this tool also holds operational value, supporting trend and pattern analysis to deepen insights into the tactical sophistication behind IED attacks. Below is a breakdown of each of the tactical identifiers that make up the TRACE-AS-ADDED framework.

Tactical Intent

Possibilities include the following descriptors alone or in combination: anti-armour; anti-personnel (anti-EOD or anti-first responder); anti-air; anti-infrastructure; anti- vehicle; anti-maritime; TTP identification (suspicious packages, unattended packages, or bomb threats); obstacle creation; and breaching.

Role

What was the role of the device in an attack if more than one was used or present? Was the device part of a more complex event? e.g. “immobilize the lead convoy vehicle in the middle of the kill zone of an ambush.” The role of an IED should be characterised as primary, secondary, or subsequent form of attack if more than one IED was utilised or intended to be utilised in a sequential manner. Primary is used for an IED assessed as the most tactically significant IED within an incident while a secondary IED refers to any additional IED(s) used to attack individuals or vehicles after an initial event.22 Such IEDs should be independent of each other in terms of being unlinked in their explosive train and firing circuits.

Attack Geography

A description of the location of an IED attack providing insights into how the terrain was employed to bring the device and target into proximity, optimise the moment of initiation, slow or canalise target movement, channel tactical responses to the attack, or hinder the pursuit of the attacker.23 Attack geography can be broken down under the headings of:

Device Placement Characteristics

  • Device placement – can include subsurface,24 surface,25 elevated26 and embedded27
  • Device distance to target at initiation
  • Concealment at contact point
  • Angle of attack28 – consider in which direction was the device pointed/orientated and why. This describes the part of a target that an IED is designed to attack. It can include underbelly,29 top attack, or side-attack.

Contact Point Characteristics

  • Contact point description – key features and notable aspects of the surroundings
  • Routes in locality – important in assessing the ingress and egress of the attacker for device emplacement
  • Obstacles in locality – important in assessing the ability to pursue an attacker and their level of ground appreciation in planning an attack.

Command IED Specific Considerations

  • Firing point – distance to contact point, line of sight to contact point, visibility of approaches to contact point, egress and ingress relative to contact point and escape route
  • Aiming marker (s) – type and location
  • Antenna orientation and location – important for any RCIED

Post Blast Data

  • Blast dimensions in terms of crater diameter and depth along with debris field radius
  • Estimated net explosive weight of charge initiated
  • Blast crater material e.g. soil, sand, concrete etc

Condition When FoundIn situations where an IED is discovered prior to initiation, capturing its readiness to initiate is important in providing insight into why a successful attack was not achieved. Options to describe the status of an IED when found include, armed, unarmed, dormant, poised, non-functional and malfunction.

Environmental ConditionsRefers to variables such as weather and oceanographic conditions, along with those present in the electromagnetic and terrestrial environment.30 These conditions may impact the performance of IEDs, the effectiveness of detection sensors, and the success of countermeasures.

AtmosphericsA description of the environmental mood of an area, including how it appears, sounds, feels, and smells, compared to an established baseline for what is considered ‘normal.’ Shifts in the atmosphere within a community or in individual behaviour may signal impending hostile action, such as an IED attack.

Indicators of such a threat can include noticeable changes in an individual’s behaviour, change in usual routines, patterns, and attitudes among the local population, or the emergence of abnormal activities. When considering atmospherics, it is insightful to consider if there was absence of the normal and presence of the abnormal and if so why.31

Sensor Defeat

Refers to technologies incorporated into a device construction as well as methods used to defeat their detection, identification, and C-IED TTPs.32 Such technologies may relate to the components used and as such this may be captured under the technical complexity of an IED.

Attachment Method

Description of how an IED is placed in contact with a target or its location of emplacement. Options include, magnetic, tied, mechanical and adhesive.

Delivery

Was the device static, mobile or launched/released in a controlled or uncontrolled manner towards its intended target? Options include emplaced, vehicle- borne; animal-borne; person-borne (proxy or suicide bomber); standoff (ground-based/terrestrial, waterborne, and airborne); and postal IED.

Domain

Characterisation of the physical environment in which the IED is employed and covers air, land, maritime surface and maritime subsurface.

Employment Method

A key descriptor contributing to the overall tactical characterisation of an IED, providing a description of how a device and target were brought in proximity of each other.

Discovery Method

It is important to record, in as much detail as possible, information related to how an IED was discovered, as this can significantly assist in informing defeat-the-device efforts, including investment in search and detection capabilities and IEDD render-safe procedures. The method of discovery serves as a tactical descriptor of an IED incident and can include visual observation, working animal (e.g., dogs), search and detect sensors, and human tip.

CONCLUSION

A 5W+H analysis of IED attacks enables a comprehensive understanding of the threat. This analytical approach informs the development of tools used to design, develop and maintain an accurate IED threat picture. Understanding how IED attacks occur requires classification based on either or both of their tactical employment and tactical characterisation. Tactical characterisation involves examining the tactical intent and tactical design of attacks. To ensure consistent and systematic data capture, standardised reporting formats must be implemented at the lowest tactical level. This reporting should include various tactical identifiers documented for each IED incident. Three analytical methods can support the tactical characterisation of IED attacks:

  • 3Ys and 2 Outcomes model
  • IDREAD analysis
  • TRACE-AS-ADDED framework

These methods can be used individually or in combination. However, relying solely on one analytical method is discouraged, ‘certain IEDs can fall under multiple categories, depending on the perspective or the lens through which they are being examined.’ 33, 34

The next article in this series will explore the concept of IED tactical profile and tactical signatures to support our understanding of the tactical sophistication of an IED threat. ■

 

Footnotes
  1. A description of how the device and target were brought in proximity of each other. Source: The IED Incident Reporting Guide, 6th Edition.
  2. The term tactical deployment of IEDs is often used synonymously with the tactical employment of IEDs.
  3. An IED threat picture is an assessment of the use or threatened use of IEDs in terms of the technical complexity, tactical sophistication, the IED system employing them and local context. The IED system is assessed under its intent, capabilities and the opportunities it has to employ IEDs against defined target(s). Local context is defined by a geographic area, the target of the attacks and other local factors.
  4. C-IED efforts may be responsive, preventative or crosscutting in nature. Such efforts include, inter alia, legal instruments, training, mentoring, advice, operational and tactical or technical assistance, technology and equipment provision, intelligence activities, investigations and actions against an IED system, interagency and international cooperation, control of explosives and other IED components as well as any other investment made to respond to and ultimately prevent IED use. Source: Managing a C-IED Enterprise, The Counter-IED Report, Winter 2024/25
  5. Attack cycle refers to the repeatable series of activities, actions or decisions that IED networks typically follow before, during, and after an attack. These steps form a recognisable operational rhythm, often reflecting standard operating procedures or learned behaviours within threat networks. A typical cycle may include facilitation → target selection → pre-attack surveillance → rehearsals → material acquisition → transport → manufacture → device assembly → emplacement → remote observation → initiation → post-attack activities. While each attack may vary, understanding common activities helps identify exploitable vulnerabilities and informs where C-IED countermeasures should be focused. The term ‘attack cycle’ can be misleading, as it implies a strictly linear process. In reality, many activities occur concurrently or in flexible sequences. However, timing and synchronisation, especially in the final stages, are often critical to maximising operational impact.
  6. Facilitation refers to the range of enabling actions or support mechanisms that help IED networks plan, coordinate, and execute their activities, even if the facilitators themselves are not directly involved in attacks. Facilitation can include: –a) Providing safe houses or storage locations for IED components, manufacturing paraphernalia, personnel, or propaganda material. –b) Supplying intelligence or surveillance support, such as observing movement patterns or habits or a target or identifying vulnerable routes. –c) Offering transportation, whether for materials or network personnel. –d) Managing communications and logistics to ensure timely and secure coordination between nodes, cells, or actors. –e) Recruiting individuals with technical, operational, or local knowledge. –f) Creating false documentation or exploiting legal loopholes to evade detection. –g) Facilitation is often conducted by peripheral actors, such as sympathisers, coerced individuals, or criminal partners, who enhance an IED system’s capabilities without being the actual bomb-makers or attackers.
  7. IDREAD is an acronym for six tactical identifiers of an IED attack which covers Intent; Delivery method; Role; Emplacement location; Attachment method; Device orientation.
  8. Acronym for, Tactical intent; Role; Attack geography; Condition when found; Environmental conditions; Atmospherics; Sensor defeat; Attachment method; Delivery; Domain; Employment method; and Discovery method.
  9. Standoff IEDs refer to a method of IED employment in which an explosive device is launched or released by an attacker from a safe location and travels to its point of contact. This approach allows attackers to engage a target without being present at the point of contact at any stage of the attack. Standoff IEDs also enable the bypassing of physical security measures, such as barriers that would otherwise prevent emplacement or delivery by conventional means. They can be employed across land, air, and maritime domains. Classifying an IED as standoff provides valuable insight into its tactical employment. This classification can be further refined by incorporating details such as the domain of operation, launch method, arming method, and, where applicable, the specifics of primary and secondary firing switches. This expanded approach adds greater depth and precision to the classification.
  10. Both water and air-borne refer to their domain of use as much as any other characteristic and are often considered types of standoff IEDs.
  11. Source: IED Classification–Breaking Down Bomb Attacks, The Counter-IED Report, Spring /Summer 2025.
  12. Source: The IED Incident Reporting Guide, 6th Edition. p.3
  13. Source: The IED Incident Reporting Guide, 6th Edition. p.3
  14. The IED Incident Reporting Guide, 6th Edition, defines tactical characterisation by stating that the intent of a device is its purpose.It further specifies that the purpose of a device is “the intended immediate, or direct tactical effect of an IED” (p. 15). This circular use of intent and purpose suggests the terms are interchangeable within the guide. However, for the purpose of this article series, intent is used to describe the specific objective behind an individual act of violence, such as an IED incident. This refers to the tactical aim, or the immediate result the attacker seeks to achieve. In contrast, purpose represents the strategic or ideological rationale behind the use of IEDs by a threat actor. It relates to the attacker’s broader motivations, such as advancing a cause or influencing the trajectory of a conflict.
  15. The IED Incident Reporting Guide, 6th Edition.
  16. Source: IED Classification – Breaking Down Bomb Attacks, Counter-IED Report, Spring /Summer 2025.
  17. Source: Understanding & Maximizing C-IED Information Sharing, The Counter-IED Report, Autumn 2023
  18. Source: The IED Incident Reporting Guide, 6th Edition. p.8
  19. Device orientation is a tactical description of where an IED is positioned and located in its emplacement relative to the intended target which may be mobile or static at the intended moment of initiation. It is equivalent to angle of attack.
  20. The listed IED tactical identifiers along with the definitions provided are based upon and adapted from those provided in The IED Incident Reporting Guide, 6th Edition.
  21. Attack geography of an IED attack can be broken down under the subheadings of Device placement characteristics; Contact point characteristics; Command IED Specific considerations; and Post blast data.
  22. Source: Adapted from, The IED Incident Reporting Guide, 6th Edition
  23. Source: Adapted from, The IED Incident Reporting Guide, 6th Edition
  24. Also referred to as buried IEDs, referring to IEDs emplaced below the surface at an emplacement location. Buried IEDs are usually emplaced subsurface along routes against a moving target.
  25. Surface IEDs are emplaced on top of the surface at an emplacement location. Surface laid IEDs may be positioned along the sides of routes of movement and concealed using vegetation, rubbish, or any material available within the vicinity. In some cases, surface laid IEDs are housed within specially fabricated or adapted containers designed to mimic the natural or man-made features of their surroundings – such as “rock bombs” observed in South Lebanon and Yemen – pioviding enhanced camouflage against detection. The colloquial term roadside IEDs is often used to describe this type of emplacement. Broadly, surface laid IEDs can be either omnidirectional or directional-effect IEDs.
  26. IEDs emplaced in a raised position relative the intended target and can involve trees, rooftops, bridges or overpasses. Elevated IEDs are emplaced after observing the routine of the target. They may be positioned on rooftops of places frequented by target groups, such as tea shops or cafés or other meeting locations. Additionally, they are often placed atop trees where security forces pause during travel or use as shade near checkpoints. Overpasses along routes travelled by the target are also common placement locations.
  27. Embedded IEDs may be hidden in any space that contains a void or provides concealment from view – such as inside walls, street furniture, or light posts. They can be encountered in both urban and rural environments. They may be deployed against moving targets or placed in locations likely to be occupied by a target, such as rest locations, checkpoints, or buildings.
  28. Also referred to as device orientation.
  29. IED emplacement intended to target the underside of a vehicle. Source: The IED Incident Reporting Guide, 6th Edition.
  30. Examples of terrestrial environment descriptors include urban, rural, peri urban, woodland, forest, jungle, desert, tundra, mountainous. It can also describe terrain composition in the locality such as the nature of the soil, sand, gravel, stone or other ground material.
  31. Source: Adapted from, The IED Incident Reporting Guide, 6th Edition.
  32. Source: Adapted from, The IED Incident Reporting Guide, 6th Edition.
ABOUT THE AUTHOR

Paul Amoroso is an explosive hazards specialist and has extensive experience as an IED Threat Mitigation Policy Advisor working in East and West Africa. He served in the Irish Army as an IED Disposal and CBRNe officer, up to MNT level, and has extensive tactical, operational, and strategic experience in Peacekeeping Operations in Africa and the Middle East. He has experience in the development of doctrine and policy and was one of the key contributors to the United Nations Improvised Explosive Device Disposal Standards and the United Nations Explosive Ordnance Disposal Military Unit Manual. He works at present in the MENA region on SALW control as well as in wider Africa advising on national and regional C-IED strategies. He has a MSc in Explosive Ordnance Engineering and an MA in Strategic Studies. He runs a consultancy, Assessed Mitigation Options (AMO), which provides advice, support, and training delivery in EOD, C-IED, WAM as well as Personal Security Awareness Training (PSAT) and Hostile Environment Awareness Training (HEAT). This article reflects his own views and not necessarily those of any organisation he has worked for or with in developing these ideas. LinkedIn profile: https://www.linkedin.com/in/paul-amoroso-msc-ma-miexpe-60a63a42/

 

Download PDF: 19-27 Paul Amoroso article – Exploring IED Employment – COUNTER-IED REPORT, Autumn 2025

Counter-IED Report, Autumn 2025