IED Incident Profiles

By Paul Amoroso, an explosive hazards specialist at Assessed Mitigation Options (AMO) consultancy

INTRODUCTION

In this ongoing series exploring the design, development, and sustainment of an accurate IED threat picture1 through a 5W+H analytical framework, we have thus far examined the ‘what’ and ‘how’ of IED attacks. This article consolidates information on the ‘what,’ referring to the technical complexity2 of the IEDs used in an attack, and the ‘how,’ referring to the tactical sophistication3 of the IED attack itself. Previous analysis of the ‘how’ outlined the development of tactical design profiles, based on the tactical characterisation of IED attacks.4 This process involved identifying tactical identifiers5 to inform an understanding of tactical intent and tactical design, from which tactical design profiles6 can be developed. Methodologies such as the 3Ys+2 outcomes, IDREAD analysis, and the TRACE-AS-ADDED framework can be employed to support this analysis. In the preceding article, the use of pattern analysis to reveal tactical commonalities across multiple incidents within a given threat environment was introduced to support the development of IED tactical signatures.7 Tactical profiles and signatures offer a powerful means of understanding the tactical sophistication of an IED threat, provided they are context-specific, regularly updated to remain threat-aligned, and illustrated with real-world examples when feasible. Overall, IED incident reporting that supports tactical device profile and tactical signature development through the systematic capture of tactical identifiers enables an assessment of the tactical sophistication of an IED threat. This article will explore how tactical design profiles can be integrated with other C-IED analysis products to produce IED incident profiles.

In a previous article, A Journey Through PIECES of SPICE PIES,8 a progressively detailed examination of IED components was presented using PIES, SPICE, and PIECES.9 Each serves as a memory aid to support systematic profiling of IED components.

Assessment process of the tactical sophistication of an IED threat.

These mnemonics represent increasingly comprehensive frameworks for IED technical component categorisation, with PIES being the simplest, followed by SPICE, and PIECES as the most detailed. This article will outline how technical identifiers can be used to develop technical device profiles. It will then explain how pattern analysis of these profiles supports the development of IED technical signatures. Over time, when subject to structured trend and pattern analysis, these signatures can empower technical complexity assessment of an IED threat, a key component of the overall IED threat picture. In the concluding section, a methodology will be presented for detailed profiling of individual incidents. This will involve developing IED incident profiles by integrating technical device profiles and tactical design profiles with target-specific details of location, timing, and identity. We begin by examining the concept of technical identifiers as we continue exploring how to design, develop, and sustain an accurate IED threat picture.

TECHNICAL IDENTIFIERS

Technical identifiers refer to IED components and their characteristics i.e. configuration, confinement and concealment, the detail of each based on a hierarchical construction. The PIES, SPICE, and PIECES frameworks provide suitable means to detail the components in an IED. The one chosen depends on the technical complexity of the IEDs and the level of detail desired.

Configuration characteristics of an IED refer to:

  • Container configuration to produce directed explosive effects10 which are considered a type ofenhancement.11
  • The arrangement and interconnection of the components and subassemblies such as the explosive train12 and firing circuit13 within it, which can reveal commonalities in the methods of assembly employed in their construction by certain bomb-makers, cells or networks.

Confinement, in the context of IEDs, refers to the explosive effect’s characteristics resulting from the physical containment of the main explosive charge by the IED’s container to direct or amplify its effect. This restriction significantly influences the behaviour of the energetic material upon initiation and plays a critical role in the progression of the reaction – potentially enabling a deflagration-to-detonation transition (DDT),14 which is a common mechanism in devices such as pipe bombs.

Concealment characteristics refer to the use of materials, objects, or environmental features intended ‘to prevent the discovery of an IED by visual inspection.’15 These characteristics can be categorised into two main types:

Concealment provided by the IED container – The IED container may be inherently designed or specifically selected to disguise the presence of the device. In such cases, the container functions both as a structural housing and as a concealment mechanism. Examples include:

  • VBIED – hidden within a car, truck, or motorcycle. The vehicle may appear abandoned, parked normally, or loaded with everyday items to avoid suspicion.
  • Electronic devices – laptops, mobile phones, or cassette players modified to house explosive components.
  • Packages – parcels wrapped for delivery or posted as mail may contain an IED, relying on the appearance of normal postal packaging e.g. letter, parcel and postal IEDs.
  • Luggage – suitcases, backpacks, duffel bags, or rucksacks may be deliberately placed at the attack location. Their familiar appearance and integration into the environment often render them inconspicuous, minimising suspicion and reducing the likelihood of detection.
  • Household Items – concealed inside objects chosen for their innocuous appearance like vacuum flasks, palm oil containers, radios, or toys.

Concealment using external material from the emplacement location – materials or items not part of the IED itself may be deliberately placed around, over, or near the device to obscure it from view or blend it into the environment. Examples include:

  • Debris or Rubbish – piles of rubbish, discarded clothing, or dead animals placed over roadside IEDs.
  • Natural cover – rocks, soil, vegetation, or sand used to bury or camouflage the device.
  • Infrastructure elements – guardrails, signposts, or street furniture to house or hide an IED.
  • Building features – devices hidden behind wall panels, under floorboards, or inside ventilation ducts.
IED TECHNICAL PROFILES

IED technical identifiers form the basis for technical categorisation. Technical categorisation refers to the description of an IED using a hierarchical construct to identify its key components. The components identified in this categorisation are the elements from which technical and forensic information is recovered and exploited.16 The PIES, SPICE and PIECES frameworks provide basic headings around which technical categorisation can be constructed. Whichever framework and associated headings are used, “further classification is possible, leading to a hierarchy of technology.”17 The UN IED Threat Mitigation Handbook, Second Edition 2024, Annex F, Glossary and IED Incident Reporting Guide, 6th Edition, January 2024, both provide excellent hierarchical constructs for which IED technical categorisation can be adopted or adapted to a given IED threat environment. This concept of a hierarchy of technology can be applied to categorising the components of IEDs by organising them into levels based on their functionality, complexity, and importance within the device.18 This approach helps in systematically analysing and understanding IED construction, providing a structured approach and clarity to their diverse and improvised nature of IED components.

Component Functionality

This refers to the role a component has in an IED enabling the device to operate as intended. The PIECES framework headings can be used to list component functionality. Some components may have more than one function. For example, a container may also function to confine the main charge intended to cause a deflagration to detonation (DDT) event, while containers may also function to create certain explosive effects such as directional explosive effects.

Component Complexity

IED component complexity refers to the technical sophistication, composition, and configuration of individual components or subassemblies within an IED. It includes the PIECES components along with their configuration, confinement, concealment, and integration with the other component to achieve a desired target effect. Various scales of complexity can be defined with the metrics used needing to be interpreted within the operational context i.e. what is complex in one region or threat group may be standard in another. Component complexity, metrics may include design feature considerations such as:

  • Use of advanced technologies e.g. micro-controllers, encrypted comms
  • Deviation from known IED designs such as novel configurations or concealment
  • Level of precision or control e.g. burning fuse compared to a programmable delay.

Examples of low- and high-level component complexity.

Complexity can also apply to subassemblies and their design features within an IED. The individual configuration, components and the number of such subassemblies can increase the complexity of an IED. Some consideration include:

  • Firing circuits – basic relay compared to logic-controlledmulti-pathcircuit
  • Arming mechanisms – manual sensor-triggered arming with delay toggle versus
  • Explosive trains – direct initiation in comparison to staged detonation with boosters
  • Number of integrated subsystems, for example a remotely armed integrated time delay firing sensor.

Complexity assessments can also be applied to the three characteristics of IED components of configuration, confinement and concealment. These characteristics influence a device’s lethality, detectability and defeat the device render safe options.

Examples of increasing complexity in the configuration, confinement and concealment characteristics of an IED

A process by which technical design profiles can be developed.

Component Importance

Component importance refers to how critical a component is to an IED’s overall function or effectiveness i.e. its role in enabling the device to achieve its intended outcome. The explosive charge is typically the most important component in terms of lethality, but a well- concealed switch might be vital for successful employment e.g. a hidden VO switch. Alternatively, when the tactical intent is anti-armour, a precisely fabricated shaped charge cone may be the most important component along with a high-grade main charge with a high velocity of detonation. In the case of hoax device some element of the container or simply the presence of some electronic components may be more important so that it can be found to elicit a security response.

Technical Device Profiling

Technical device profiling20 refers to the systematic categorisation of IED components,21 along with their configuration, confinement and concealment characteristics. It refers to the process by which technical categorisation is undertaken, to produce IED technical profiles. As such, a technical device profile for an IED incident represents the product of technical categorisation.

Technical Complexity Assessments

The previous article in this series provided a methodology for the development of IED tactical signatures through the pattern analysis of multiple IED tactical design profiles over time. It outlined how pattern and trend analysis of tactical design profiles offer a means of assessing the tactical sophistication of the IED threat. A similar methodology can be applied for the development of IED technical signatures from which over time IED technical complexity assessments are possible. IED technical signatures refer to clusters of commonalities in the IED components and their characteristics of configuration, confinement and concealment found in IEDs in use. Like IED tactical design signatures, when systematically developed and supported by practical examples, IED technical signatures serve as powerful communication tools within the C-IED community.

Process by which IED technical signatures can be developed over time.

Once established, monitoring IED technical signatures collectively over time through trend analysis helps reveal shifts in the threat. In particular trend analysis of IED technical signatures can reveal threat escalations that can manifest themselves as lethality escalations22 or complexity escalations.23 For example, a change from using small net explosive content (NEC) devices to IEDs with significantly higher NEC, resulting in more fatalities or severe injuries per incident, is an indicator of lethality escalation. Complexity escalations typically reflect a broader enhancement in the adversary’s operational capability. For example, transitioning from simple victim-operated pressure plates to multi-triggered devices that combine radio- controlled arming, low-metal content components, and anti-handling switches. Such complexity escalation demonstrates how IED networks evolve their systems to circumvent defeat the device efforts. Trend analysis of IED threat signatures can also reveal threat adaptations.24 For example, in a situation where high- metal-content, victim-operated pressure plates have both resulted in unintended victims as well as being vulnerable to discovery by metal detectors and subsequently rendered safe, a technical adaptation25 might include changing to low-metal-content variants armed with radio control and fitted with anti-handling switches. As C-IED measures advance, IED designs often evolve through multiple stages in a continuous cycle of adaptation. Each shift reflects an attempt to circumvent the latest countermeasure. For example, victim-operated devices, once common, can give way to radio-controlled triggers when attackers seek greater standoff capability. Subsequently as jamming disrupts these systems, command-linked configurations such as command wires can emerge to ensure reliable initiation. In some cases, hybrid configurations – such as radio-armed victim-operated devices – can appear to combine remote arming with improved target selection. This progression is not strictly linear, and earlier methods can re-emerge when conditions favour their use, underscoring the persistent, adaptive nature of the threat. Together, pattern and trend analysis of IED technical signatures offer insights into the technical complexity of an IED threat which directly contributes to C-IED understanding and decision-making. Technical complexity assessments directly support the design, refinement, and adaptation of the IED threat picture, thus enhancing clarity around the specific IED threat being countered in given contexts.

Assessment process of the technical complexity of an IED threat.

Methodology for the development of IED incident profiles from technical and tactical identifiers along with target location, time, and target identity details.

INCIDENT PROFILES

By integrating established methods for categorising IED components and characterising tactical behaviour, incident profiles offer a standardised approach to threat profiling. An incident profile can be constructed by combining:

  • Technical identifiers
  • Tactical identifiers
  • Incident location (where the incident occurred)
  • Timing (when the incident took place)
  • Target information (who the target was)

Technical identifiers are obtained from the technical device profile, while the tactical identifiers are obtained from the tactical design profile of an incident. Further discussion on the who, where and when of IED attacks will be provided in subsequent articles in The Counter-IED Report. This composite profile provides a structured way to represent and compare IED incidents across contexts. It supports analytical consistency, threat classification, consistent communication of threats across the C-IED enterprise as well as, C-IED planning and response.

CONCLUSION

Within this article, the use of technical identifiers, specifically in terms of components and the characteristics of configuration, confinement, and concealment, has been shown to provide the foundational data upon which IED technical profiles can be constructed. IED technical profiles can vary in detail and structure depending on the data available and level of insight being sought. They are typically based around the components in use and their functionality. Component importance can also be reflected within a profile, with component complexity often providing the most insightful data. Through pattern analysis of multiple IED technical profiles over time, IED technical signatures can be developed. These signatures, when subject to trend and further pattern analysis, support the assessment of technical complexity of the IED threat.

The fusion of technical categorisation and tactical characterisation of an IED incident, when combined with target-specific details such as location, timing, and identity, enables the development of incident profiles. These profiles offer a structured means to represent and compare IED incidents across operational contexts. The next article in this series will explore how analysis of IED incident profiles can support a technical/ tactical level understanding of the IED threat. ■

Footnotes
  1. An IED threat picture is an assessment of the use or threatened use of IEDs in terms of the technical complexity, tactical sophistication, the IED system employing them and local context. The IED system is assessed under its intent, capabilities, and the opportunities it has to employ IEDs against defined target(s). Local context is defined by a geographic area, the target of the attacks and other local factors.
  2. Technical complexity refers to the detailed composition and arrangement of an IED’s components – Power source, Initiator, Energetic material, Container, Enhancements (if present), and Switches (PIECES) – as well as their configuration, confinement, and concealment characteristics to achieve a desired target effect.
  3. Tactical sophistication refers to an assessment of the ability of an IED attacker to successfully employ IEDs in support of their intended outcome.
  4. Tactical characterisation of an IED incident examines both the:   → Tactical intent – intended function of the device i.e. the intended immediate, or direct tactical effect of an IED.  → Tactical design – planning and execution of IED attacks.
    By providing insight into how IEDs are used or intended to be used, tactical characterisation helps assess the level of sophistication behind these attacks, which is an essential component in an accurate IED threat picture. Source: Exploring IED Employment – Understanding the ‘How’ of IED Attacks, The Counter-IED Report, Autumn 2025.
  5. Tactical identifiers refer to the observable and inferable tactical features of how an IED attack is planned and executed. They describe how an attacker employed, or intended to employ, a device in relation to the target, within the context of the operational environment and local factors, to achieve the intended target effect. These identifiers are derived from analysing tactical factors such as delivery mechanism, placement, use of terrain, initiation method, coordination of attack cycle elements, and the concealment employed. Source: Exploring IED Employment – Understanding the ‘How’ of IED Attacks, The Counter-IED Report, Autumn 2025.
  6. Tactical design profiles offer a structured and systematic method of summarising the key tactical identifiers of an IED attack. Tactical design profiles can be developed using one or more of the three primary methods for tactical characterisation: the 3Ys+2 Outcomes approach, IDREAD analysis, and the TRACE-AS-ADDED framework. They may be applied individually, in combination, or selectively. Source: Insights into IED Employment – IED Tactical Design Profiles and Signatures, The Counter-IED Report, Autumn 2025;
  7. IED tactical signatures are narrative tools that provide insights into specific objectives, modus operandi, and other tactical behaviours within a given context. Source: Exploring IED Employment – Understanding the ‘How’ of IED Attacks, The Counter-IED Report, Autumn 2025.
  8. A Journey Through PIECES of SPICE PIES, What Components Make up an IED – Technical Component Classification, The Counter-IED Report, Spring/ Summer 2025.
  9. PIECES is an acronym for Power sources, Initiators, Energetic materials, Containers, Enhancements and Switches component used in IEDs.
  10. A term used to describe explosive effects produced by the initiation of explosives in intimate contact with a liner which is projected forward with varying effects depending on many factors resulting in either shaped charge jets, Explosively Formed Projectiles (EFP) or platter charges.
  11. A Journey Through PIECES of SPICE PIES, What Components Make up an IED – Technical Component Classification, The Counter-IED Report, Spring/ Summer 2025.
  12. A succession of initiating and igniting elements arranged to cause a charge to function. Source: UN IED Threat Mitigation Handbook, Second Edition 2024, Annex A. IED Lexicon, A.6, Glossary (p.136)
  13. In the context of an IED, a firing circuit refers to an improvised electrical or pyrotechnic configuration designed to cause the initiator to function. It may include firing and arming switches, power sources, sensors and associated wiring, configured to activate the device based on the attacker’s chosen method, such as command, time-delay, victim operation or a hybrid combination of these. Advanced configurations may include anti-handling features or failsafe triggers.
  14. Transition to detonation from an initial burning reaction.
  15. Source: The IED Incident Reporting Guide, 6th Edition.
  16. Source: The IED Incident Reporting Guide, 6th Edition.
  17. The term “hierarchy of technology” refers to the structured arrangement or classification of different technological systems, tools, or components basedon their complexity, functionality, or importance. This hierarchy often highlights the relationship between foundational technologies that serve as building blocks and more advanced technologies that depend on or are built upon them. Source: A Journey Through PIECES of SPICE PIES, What Components Make up an IED – Technical Component Classification, The Counter-IED Report, Spring/Summer 2025.
  18. A Journey Through PIECES of SPICE PIES, What Components Make up an IED – Technical Component Classification, The Counter-IED Report, Spring/Summer 2025.
  19. A microcontroller-based initiator is an electronic triggering system that uses a programmable microcontroller to cause the initiator to function, allowing precise control, sequencing, and conditional logic before initiation. Only after set conditions are met does it activate the initiator.
  20. The author acknowledges that some references A use the terms device profiling and event signature (development) interchangeably. The author makes a distinction between these terms. Technical device profiling is used instead of device profiling to refer only to the process by which technical categorisation is undertaken, to produce IED technical profiles. While, event signature development, refers to analysing the technical and tactical identifiers of an IED incident support C-IED understanding to in turn inform C-IED decision making. Note A: The IED Incident Reporting Guide, 6th Edition, and UN IED threat mitigation handbook, 2nd Edition.
  21. The PIECES headings can be adopted or adapted under the appropriate hierarchy construct of technical detail needed.
  22. An increase in the destructive power or casualty rate from IED attacks.
  23. A systematic increase in the threat posed by IEDs, reflected in changes in components, configuration, concealment, or confinement characteristics.
  24. Threat adaptations involve reactive technical or tactical modifications made in efforts to circumvent C-IED countermeasures.
  25. In C-IED analysis, a subtle but important distinction exists between complexity escalation and technical adaptation. Complexity escalation refers to a systematic increase in the threat posed by IEDs, driven by changes in components, configuration, concealment, or confinement characteristics. These changes typically reflect a broader enhancement in the adversary’s operational capability. In contrast, technical adaptation involves targeted modifications made in response to specific countermeasures. These adaptations may also affect components, configuration, concealment, or confinement, but are generally more limited in scope and are designed to circumvent particular C-IED responses rather than elevate the overall threat level. While complexity escalation may signal a strategic evolution in IED design, technical adaptation is more tactical and reactive in nature.

 

ABOUT THE AUTHOR

Paul Amoroso is an explosive hazards specialist and has extensive experience as an IED Threat Mitigation Policy Advisor working in East and West Africa. He served in the Irish Army as an IED Disposal and CBRNe officer, up to MNT level, and has extensive tactical, operational, and strategic experience in Peacekeeping Operations in Africa and the Middle East. He has experience in the development of doctrine and policy and was one of the key contributors to the United Nations Improvised Explosive Device Disposal Standards and the United Nations Explosive Ordnance Disposal Military Unit Manual. He works at present in the MENA region on SALW control as well as in wider Africa advising on national and regional C-IED strategies. He has a MSc in Explosive Ordnance Engineering and an MA in Strategic Studies. He runs a consultancy, Assessed Mitigation Options (AMO), which provides advice, support, and training delivery in EOD, C-IED, WAM as well as Personal Security Awareness Training (PSAT) and Hostile Environment Awareness Training (HEAT). This article reflects his own views and not necessarily those of any organisation he has worked for or with in developing these ideas.

LinkedIn profile: https://www.linkedin.com/in/paul-amoroso-msc-ma-meng-miexpe-60a63a42/

 

Download PDF: 37-45 Paul Amoroso article – IED Incident Profiles – COUNTER-IED REPORT, Autumn 2025

Counter-IED Report, Autumn 2025