12.1 Introduction

The United States and its Coalition partners concluded combat operations in Iraq in August 2010. Rather surprisingly, little empirical evidence exists as to the factors that contributed to localized patterns of Improvised Explosive Device (IED) attacks. To compensate somewhat for this dearth in evidence, this chapter investigates an increasingly relevant yet understudied phenomenon in counterinsurgency (COIN) policy-making: the dilemma governments face in determining how best to balance the use of various coercive actions when attempting to minimize the threat posed by campaigns of violence carried out by non-state actors. This study is carried out by assessing the co-evolving space and time (hereafter, space–time) distributions of insurgency and counterinsurgency in Iraq in 2005. To do so, we employ a novel analytic technique that helps us to assess the sequential relationship between these two event types.

Forty years have passed since the emergence of a modern wave of transnational terrorism and insurgency (Hoffman, 2006; Wilkinson, 2001) with the rise of hijackings of Israeli airliners by Palestinian organizations. Israel's preferred approach to countering the threat of Palestinian violence in the four decades since has been to retaliate with military strikes against terrorist cells, munitions stores and leadership hideouts. Israel has commonly compared their approach to the ‘tit-for-tat’ strategy (cf., Axelrod, 1984), while critics have argued that it is, in fact, more accurately, disproportionate in scope and deadliness. Empirical evidence suggests that episodes of heightened retaliation by Israel are associated with short-term decreases but long-term increases in subsequent violence (Maoz, 2007).

The Israeli–Palestinian case neatly parallels the expectations of the body of formal, game-theoretic models that identify a proactive response dilemma faced by governments countering the threat of terrorism and insurgency (see, e.g. Arce and Sandler, 2005; Bueno de Mesquita, 2005a, 2005b, 2007; Bueno de Mesquita and Dickson, 2007; Rosendorff and Sandler, 2004; Siquiera and Sandler, 2007). These studies derive propositions suggesting that when responding to being attacked by non-state actors, governments are expected by their constituents to respond proactively in order to demonstrate that they are making an active effort to counter the threat. At the same time, however, it has been shown that if the government's response is too harsh, it is likely to increase antigovernment grievances, aid recruitment to violent non-state organizations and, ultimately, increase the number of spectacular attacks against the state (e.g. Rosendorff and Sandler, 2004). Take the ongoing COIN operations in Afghanistan and Iraq, for instance. A number of commentators (e.g. Ryu, 2005) and scholars (e.g. Pape, 2003, 2005) have posited that continued use of coercive COIN tactics (such as the cordoning off, searching and raiding of city blocks and buildings) help to explain the apparent increase in grievances among local populations and the observed increase in recruitment to insurgent and terrorist organizations in both countries. This process is highlighted, for instance, in the case of Northern Ireland (LaFree et al., 2009a).

However, with very few exceptions (e.g. LaFree et al., 2009a), the literature lacks empirical testing of the propositions garnered from game-theoretic models. Moreover, there is a distinct absence of robust and reliable recommendations regarding the costs and benefits of maintaining significant coercive presence on the ground in such theatres of combat. Accordingly, military and political analysts attach great value to information about empirical trends in ongoing campaigns of terrorism and insurgency. The aim of the present study is to inform decision-making regarding the optimal allocation of coercive and conciliatory measures in COIN operations, and to examine whether coercive COIN policies motivate new attacks in the vicinity of their deployment. The longer-term goal of the research is to advance efforts to predict the location of hot spots and to explain, more specifically, what timing and location of COIN operations are most effective in countering the emergence of new attacks and hot spots.

The chapter proceeds as follows. First, we offer a discussion of the dynamics of the US/Coalition counterinsurgency in Iraq. This discussion draws upon some common claims about the interaction between insurgent violence and COIN operations and is used to derive some testable hypotheses. We then offer up a discussion of the rich source of data to be utilized in the remainder of the study before moving on to specify a number of analytical techniques for modelling the spatial, the temporal and, most crucially, the space–time distributions of insurgency and counterinsurgency, along with the co-evolution of these two types of events. Finally, we offer a discussion of the findings, touching upon possible implications for military operations and future avenues for research on this topic.

12.2 Counterinsurgency in Iraq

A total of 4,738 Coalition troops (4,420 US troops) died during the 7 years of combat operations in Iraq. Reports suggest that by the end of 2007, approximately 63% of casualties resulted from IED attacks.¹ IED attacks have presumably risen to the fore in the Iraqi insurgency and have become the preferred choice of insurgents because of their ease of manufacture and use, as well as their considerable affordability. IEDs typically require little more than modest amounts of materials that are common to agriculture and the production of paint, such as potassium chlorate and ammonium nitrate aluminium mix. Easy access to these materials also provides an opportunity for insurgents to get around the otherwise significant restrictions on and monitoring of sales of commercial explosives.

As with earlier work (Johnson and Braithwaite, 2009), we consider terrorist and insurgent violence in Iraq to be sufficiently similar in form as to not look to differentiate between them – choosing to focus, instead, upon the population of IED attacks. The reason for this is that where differences do exist, they tend to be in terms of the intended target of violence. Traditionally, the intended target of terrorism is the public, while insurgent violence is employed against military and government targets. Given that many violent tactics employed by non-state actors across Iraq commonly have a joint impact upon public, military and government targets, any effort to draw a clear distinction between these two strategic options would likely prove futile. Thus, while we will refer to insurgency and counterinsurgency, we are actually focused more broadly upon all violent attacks carried out by non-state actors (and catalogued by US/Coalition forces) and the operations the US/Coalition forces have employed in response to this violence.

Building upon a tradition of criminology scholarship (e.g. Johnson and Bowers, 2004; Johnson et al., 2007) recent work (Townsley et al., 2008; Johnson and Braithwaite, 2009) has demonstrated that insurgent attacks in Iraq in 2004 and 2005 clustered in space–time, spreading much like an infectious disease (and crime). These studies were motivated by basic principles regarding human mobility and theories of insurgent strategy (see Johnson and Braithwaite, 2009), but all converge on the prediction that insurgent attacks cluster in space–time. In essence, such conclusions parallel those found for campaigns of terrorism and insurgency in Spain (LaFree et al., 2009b), for general global patterns of transnational terrorism (Braithwaite and Li, 2007) and for militarized interstate disputes (Braithwaite, 2010). In the current study, for the purpose of comparison with the novel analyses discussed later, we present findings that demonstrate that IED explosions cluster simultaneously in space and time (these results were previously reported in Johnson and Braithwaite, 2009) and illustrate the precise patterns, but this is not our primary focus.

One weakness of previous studies is that while they examine insurgent activity, they do so without reference to other factors that might influence insurgent decision-making, such as counterinsurgent action. Consequently, it is difficult to ascertain whether the patterns observed – that IED attacks cluster in space-time – are the result of insurgents adopting particular strategies, or whether they emerge as a result of tit-for-tat interactions whereby an IED attack provokes a swift military response in the local area, which subsequently provokes further insurgent activity, and so on.

Accordingly, the present study looks to extend extant work by examining a key correlate of these observed patterns – the individual activities of the COIN operations of the Coalition forces. Specifically, we hypothesize that similar to attacks, COIN operations will occur closer in time and space than would be expected on a chance basis. Such an expectation is clearly in line with doctrinal approaches to COIN practice. For instance, an unclassified field manual on IED defeat operations clearly states that it is a working assumption of US/Coalition COIN practices that insurgents will continue to target locations at which they have previously been successful and that this behaviour will continue unabated until such a time as COIN actions force a change. Thus, logically, doctrine dictates that COIN efforts be aimed at disrupting insurgent activities at the locale of prior attacks (Dept. of the Army, 2007).

H1: Given their strategic deployment in response to or pre-empting IEDs (which are known to cluster in space–time), COIN operations also cluster in space–time.

Naturally, of course, we might also anticipate that insurgent attacks cluster in areas proximate to and at times after various COIN operations are carried out. Such an expectation would certainly align with the tit-for-tat hypothesis. To explain when and under what conditions COIN operations are likely to prove effective in countering the threats they are designed to tackle (i.e. when and where they are more or less likely to successfully reduce subsequent levels of insurgent attacks in the vicinity), in what follows we combine the concept of the Proactive Response Dilemma derived from game-theoretic work on terrorism and insurgency with the central tenets of Situational Crime Prevention (SCP) theory. Crucially, both approaches – from distinct disciplinary backgrounds – are grounded in rational choice.

Many common characterizations of insurgent campaigns point towards a strong element of strategic interaction between insurgents and the governments that they challenge (Pape, 2005; Kydd and Walter, 2006). It is important to note, for instance, that insurgent decisions to engage in violent activities are not the result of a singular desire for destruction but, rather, are intended to alter the decision-making and capacity of their opponent (Kydd and Walter, 2006; Bueno de Mesquita, 2007). IEDs are favoured, in particular, because they reduce the mobility of the opponent's troops and, therefore, reduce their ability to engage with the local population, thereby undermining the more holistic ambitions of COIN operations.

Evidence of an evolution in campaigns of insurgency and of a strategic interaction between state and non-state actors would align with certain expectations from the terrorism literature. A debate pervades this literature in which it is argued, on the one hand, that military force as part of a COIN campaign works. The opposing view identifies a distinct tension related to such applications of force in which they are seen as merely provoking additional subsequent attacks. These studies identify a dilemma faced by governments that need, on the one hand, to engage in some proactive kinetic COIN practices in order to provide a basic level of national security, yet are conscious of the fact, on the other hand, that uses of military force can have the effect of mobilizing popular support for the non-state actors they are attempting to eradicate (Bueno de Mesquita and Dickson, 2007; Rosendorff and Sandler, 2004; Faria and Arce, 2005).

Rosendorff and Sandler (2004) address the costs and benefits of proactive policy responses to terrorist activities. They develop a two-player proactive response game in which the government's level of proactivity and the terrorist's subsequent choice of target (normal or spectacular) are endogenized. If the government responds too harshly, it runs the risk of inadvertently empowering the terrorists by motivating a wider aggrieved population – ultimately leading to the potential for spectacular events. Bueno de Mesquita (2005b) demonstrates, however, that while aggressive responses can have the effect of increasing support for terrorists, counterterrorist policies occasionally do not radicalize popular support. This varying response depends upon the amount of damage caused by the government's actions and, perhaps most crucially, the perceptions and reactions of the ‘aggrieved population’. Kalyvas (2006) reiterates this logic by noting, specifically, that the state's reliance upon the collective targeting of combatants was responsible for increased levels of insurgent violence in 45 historical cases of insurgencies.

In the specific context of the Iraqi insurgency, it is possible to identify this very dilemma in the strategic choices of the US-led Coalition. In the early period of the insurgency (from the intervention in 2003 to the surge in 2007), Coalition forces faced violence based upon both attrition and intimidation strategies (Kydd and Walter, 2006). These strategies combined sustained general violence designed to wear down the willingness of the foreign occupying forces, with targeted assassinations and attacks, designed to intimidate coalition and local security forces and encourage them to retreat from specific, high-value targets. The Coalition-led forces had a range of possible options that they could have employed in response. These included making concessions on inessential issues, narrowly targeting their retaliation against the leadership of the insurgency, hardening key targets, and engaging in public education to undermine the prevalent fear among the populations local to the violence (see Kydd and Walter, 2006, pp. 64–67). In other words, the Coalition forces had a range of proactive and reactive, coercive and conciliatory options available.

Kydd and Walter (2006, pp. 67) quote US Secretary of State, Condoleezza Rice, in October 2005, saying that the appropriate response to the insurgent use of intimidation in Iraq, ‘…is to clear, hold, and build: clear areas from insurgent control, hold them securely, and build durable national Iraqi institutions’. In particular, this COIN strategy of ‘Clear and Hold’ manifested itself in the employment of the following key tactics: cordon searches of areas and buildings, raids on buildings, the clearing of weapons caches and the search for and clearing (where possible) of deployed IEDs.

In extending previous work, the current study not only examines the underlying distribution of COIN operations individually but also examines the co-evolution of COIN operations alongside IED attacks. This interest is derived from a simple question as to whether or not COIN operations are designed and executed to simply respond to observed insurgent attacks or also with a view towards reducing subsequent levels of insurgent attacks – as is clearly argued in the US military doctrine (Dept of the Army, 2007). In the aggregate, we anticipate that in addition to clustering individually, the two types of events – IEDs and COIN – will cluster sequentially.

H2: By virtue of their design to deal with IEDs, COIN operations will cluster in a manner that follows that of IEDs.

Given the logic of the literature on the proactive response dilemma, however, we anticipate that certain disaggregated COIN operation choices may reduce or exacerbate subsequent levels of insurgent attacks in the vicinity of their operation. In particular, three key characteristics of a COIN operation might, according to this logic, help determine whether COIN operations are followed by higher or lower levels of insurgency. First, operations can be distinguished along a spectrum from discriminate (targeted against combatants) to indiscriminate (more likely to affect non-combatants). Our expectation, drawing upon the terrorism and insurgency literature discussed earlier, is that less discriminating tactics are more likely to provoke a backlash in the form of active or passive support for the insurgency (see, cf. Rosendorff and Sandler, 2004; Kydd and Walter, 2006; Bueno de Mesquita, 2007). Second, operations can be identified by whether or not they directly or indirectly reduce the capacity of the insurgent forces to conduct additional attacks. More specifically, some COIN activities directly remove resources in the form of weapons and IED components from the stockpiles of insurgent groups, functionally reducing the force that they can bring to bear against the Coalition forces. Third, COIN operations can be compared in terms of whether or not they require the deployment of additional troops at a particular location for any extended period. This third aspect matters, we claim, because additional troops on the ground means additional Coalition assets that can be targeted by subsequent violence. Given that each of these three characteristics of COIN activities can vary, we anticipate that certain configurations of these characteristics should correlate with higher or lower subsequent levels of insurgency in the vicinity of COIN operations as follows:

H3: COIN operations have the effect of reducing levels of IEDs at proximate locations and times when those operations have the effect of directly reducing insurgent capacity and when those operations are more discriminatory.

H4: COIN operations have the effect of provoking increased levels of IEDs at proximate locations and times when those operations involve the placement of observable troops on the ground and when those operations are less discriminatory.

12.3 Counterinsurgency Data

Herein, our priority is to build upon extant research by more directly testing the empirical relationship between insurgency and COIN operations. To do so, we utilize five data series, each of which is drawn from Significant Activity (SIGACTS) reports covering the period January 1–June 30, 2005. Johnson and Braithwaite (2009) offer a detailed discussion of the SIGACTS reports and their level of classification. All of the data that we draw upon herein are taken from this same data source, although with one exception all of the analyses presented here are novel. It is worth noting at this time that each entry in this database is the product of on-the-ground reporting by members of the Coalition forces. Accordingly, one could be concerned that any observed patterns of clustering reflect the distribution of locations at which Coalition forces happen to be deployed and from which they are able to observe and report events, rather than from some systematic and purposive distribution of capabilities by insurgents. We think that this concern is unfounded, however, given that members of the armed forces engaged in reporting through SIGACTS reports are not limited in the scope of the insurgent events that they are permitted to report. Given the significant emphasis placed upon countering the threat of IEDs, in particular, there remains a high likelihood that individuals will report even those events to which they are not local.

In previous work (Townsley et al., 2008; Johnson and Braithwaite, 2009), space–time patterns in both the use of IEDs and non-IED insurgent attacks across Iraq have been explored. Herein, we examine the coincidence of IED attacks and COIN operations across Iraq. In particular, as noted in Table 12.1, we examine four COIN operation data series alongside the data on IED attacks. All data were recorded accurate to a spatial resolution of 100 m.

There are a total of 3,775 observations of ‘IED Explosion’. IEDs take a variety of forms, including being Vehicle Borne (VBIED), Remote Controlled (RCIED), Personnel Borne (PBIED) and taking the more familiar form of a roadside bomb, triggered by moving vehicles. Their common characteristic is that they are ‘booby traps’. Contrary, in many aspects, to popular portrayals over recent years, such tactics have been employed in conflict zones ever since the first explosives were invented. At this time, the use of IEDs is second-to-none, the most common tactic of choice among insurgents in Iraq (as well as Afghanistan and elsewhere). As has been previously shown (Johnson and Braithwaite, 2009), these events cluster in space and time more than would be anticipated if their timing and location were independent.

In addition to the IED data, Table 12.1 indicates that we are employing four additional series that represent the most common forms of COIN operation employed by the US/Coalition forces in Iraq in 2005. We also analyze these data in the aggregate to reflect overall trends in COIN activity. The four disaggregated series can be differentiated in terms of whether they (i) discriminate between combatants and non-combatants, (ii) directly reduce the capacity of insurgents to conduct additional attacks and (iii) require observable troops on the ground. Given their general strategic deployment – in response to and in preemption of IED attacks – we anticipate that these events will also cluster in space and time more than would be expected according to chance.

The ‘IED found/cleared’ series acknowledges a successful outcome from COIN operations, with an IED successfully identified and cleared before it explodes. There are a total of 3,333 such events in our data series. IEDs may be discovered in a variety of ways. However, perhaps the most frequent scenario is that they will be discovered near to and shortly after other devices explode due to the military searching such localities for further IEDs (see, e.g. Dept. of the Army, 2007). Consequently, we anticipate these events in particular to closely follow the distribution of IED attacks.

The ‘cordon/search’ data series summarizes US/Coalition directed operations designed to search for insurgents and their weapons caches. These 1,637 coded observations represent a relatively discriminatory tactic that, nonetheless, involves the location of troops on the ground in potentially vulnerable positions, as most cordon/search operations are designed to directly access suspected insurgent strongholds and bases of operation, as well as to enable the defence against and defeat of additional IED attacks against previously targeted areas (Dept. of the Army, 2007). Accordingly, we anticipate that these events will be shown to follow IED attacks closely as they are designed to respond to them but will also be associated with either (i) fewer subsequent IED attacks in the vicinity shortly afterwards insofar as they reduce insurgent capacity or (ii) more attacks because they place more troops on the ground for an extended period, providing the potential targets for subsequent attacks.

The ‘Cache found/cleared’ data captures those occasions on which US/Coalition forces have successfully identified, located, secured and disposed of an insurgent weapons cache. Given that such caches are often considered bases from which the deployment of new attacks – including IED attacks – are launched, it is reasonable to suggest that each weapons cache found and cleared represents a dent in the capacity of the insurgents to carry out additional subsequent attacks. There are a total of 1,614 such events in this data series. Given the unique capacity-reducing qualities of these particular operations, we expect these to show the greatest dampening effect upon the subsequent observation of IED attacks.

The ‘raid’ data series also captures US/Coalition directed operations designed to search for insurgents and weapons caches. In this instance, however, the 1,416 coded observations capture events that are likely more discriminatory than those carried out as cordon/search operations. In this instance, the operation is targeted, for instance, against a specific building rather than – as may be the case in cordon/search – a city block or equivalent. For the same reason as was listed for cordon/search operations, we anticipate an increase in these operations following IED attacks in a particular locale. We also suggest that raids will reduce subsequent levels of IED attacks. Given that raids are targeted more discriminately, we also expect that they would provoke fewer attacks in the vicinity relative to the patterns observed for the slightly less geographically focused cordon/search operations.

12.4 Diagnoses of Space, Time and Space–Time Distributions

12.4.2 Spatial Distribution

Figure 12.1 shows thematic maps for each of the five event types and for the aggregation of all COIN operations, with the exception of IEDs that are found. The reason for excluding the latter in the aggregated counts is because, as previously discussed, this activity most likely reflects the most reactive form of COIN activity. Each map was generated using a grid of regular sized cells (5 km × 5 km) and simply counting the number of events within each cell. These counts were then logged and, to generate a standardized index, divided by the (logged) maximum count across all cells. The greyscale used to shade each cell was calibrated using this index. Thus, as there were more COIN events overall (N = 4,665) than anything else, the cells for that map are generally darker than those for the other event types. Due to the sensitivity of the data, we exclude any reference to the precise locations of events and do not display any landmarks (e.g. roads) on the maps. Such detail is also excluded because it is not necessary for the approach to hypothesis testing adopted here.

Figure 12.1 demonstrates that each series of events appears to cluster in space, and the different series of events follow quite similar patterns. Some of this patterning likely reflects the demographic, communications and infrastructure skeleton of the state of Iraq, with heavy intensity of events in Baghdad and, for instance, along the Tigris river to the North of Baghdad through Tikrit and Mosul. Informally, these patterns fit with what we would anticipate from similar studies elsewhere (including, Braithwaite and Li, 2007; Townsley et al., 2008; Johnson and Braithwaite, 2009), which highlight the non-random distribution of terrorist and insurgent violence across space.

12.4.3 Temporal Distribution

In characterising the temporal distribution of each series, our approach is to simply graph them along time axes. Figure 12.2 does just this. Each of the series displays some variation but, for example, the series for IEDs exhibits first-order serial correlation (auto-correlation function (ACF) at lag 1, ACF(1) = 0.43, p < 0.05), indicating that the pattern is not random. For the COIN events, none of the ACF values are statistically significant, although a trend is apparent for cordon searches.

12.4.4 Space–Time Distribution

In the remainder of this study, we employ an approach developed in previous studies to examine patterns of space–time clustering for the different event types (Johnson et al., 2007; Townsley et al., 2008; Johnson and Braithwaite, 2009) and a novel extension to this. In the case of the latter, we simultaneously examine the relationship between the space–time distributions of insurgency attacks and COIN operations. This novel technique is especially valuable, because it enables us to directly analyse the space–time dynamics of the two event types at the micro-level, and uncover any patterns that would be lost using data aggregated to the national level.

To examine whether events do cluster in space and time, we use the approach originally developed by Knox (1964) to detect disease contagion, which has been subsequently developed for the study of crime patterns (e.g. Johnson et al., 2007; Johnson et al., 2009). The null hypothesis is that the timing and location of events are independent. In the case of space–time clustering, more events will be observed to occur close to each other in both time and space than would be expected if their timing and location were independent. To examine this, the first step is to generate the distribution of interest for the observed events. In the univariate case, each event is compared to every other and the distance and time between them recorded. A contingency (or Knox) table is then populated to summarize the n*(n − 1)/2 comparisons (where n is the number of events). The dimensions of the table, and the bandwidths used, are at the discretion of the researcher but should be selected so as to allow a sensitive test of the hypothesis under investigation. For comparison with prior work on IEDs (e.g. Johnson and Braithwaite, 2009), in the current study we use spatial intervals of 500 m and temporal intervals of 1 week. However, sensitivity analyses suggest that – within reason – alternative bandwidths generate qualitatively identical results.

To compute the expected distribution and the probability of obtaining the observed results if the null hypothesis were correct, we use a permutation test. In this case, the dates on which events occur are ‘shuffled’ across incidents using a uniform random number generator. Thus, for each permutation of the data, the same locations occur with the same frequency as they do for the observed data, which takes account of the fact that such events cannot happen anywhere and in fact occur at some places more than others. Likewise, the same dates occur with the same frequency as they do in the observed data, reflecting, for example, any general seasonal variation and general temporal trends associated with IED attacks. What does, however, vary (randomly) across the permutations is the association between when and where events occur (recall that the null hypothesis is that the timing and location of events are independent). For each permutation, a new contingency table is populated and the results are compared with those for the observed distribution. A full permutation will be almost impossible and so a simple Monte Carlo (MC) simulation is used to (re)sample (in this case 99 samples) from all possible permutations.

Where the frequencies of the cells which enumerate the number of event pairs that occur close to each other in space and time are higher for the observed than permuted data, space–time clustering is said to exist. To estimate the size of this effect, the observed frequency for each cell may be divided by the mean derived across all permutations (see Johnson et al., 2007). Values above 1 indicate that there were more observed pairs of events within a particular time interval of each other than would be expected if the timing and location of events were independent (the null hypothesis). The statistical significance of any observed effect can also be derived using the formula specified by North et al. (2002):

12.1

In Equation (12.1), n is the number of realizations of the MC simulation (in this case 99) and r is the number of permutations for which the value of the test statistic is at least as large as the observed value. In the case where none of the values generated by the MC simulation exceed the observed count for the test statistic, the pseudo-probability of observing that value is estimated as (1/100=) 0.01 or less.

While useful, this does not allow us to determine if events of one type are more likely to occur near to, and follow those of another, or vice versa. To do this, we develop an approach articulated in Johnson et al. (2009) and generate two Knox contingency tables. In the first, we enumerate the number of event pairs for which an IED attack follows a COIN operation. In the other, we do the reverse. The distributions expected on a chance basis (assuming the timing and location of events are independent) are generated and the results are interpreted, in exactly the same way as for the univariate case. However, in the bivariate case, for each permutation, there will be N × M comparisons – where N and M are the counts for the two data sets. Such analysis allows us to determine if events of one type are more likely to occur within particular space–time intervals of another than would be expected if the two types of event were independent. For example, we can estimate whether it is the case that more IED attacks and raids occur within (say) 500 m and 7 days of each other than would be expected if the two types of event were independent.

12.4.5 Univariate Knox Analysis

Figure 12.3 shows the univariate Knox analyses for each of our six data series – IED explosions, an aggregate of the COIN events, and each of the four individual COIN operations of interest. Each plot is essentially a contingency table, with the columns representing different temporal intervals and the rows identifying different spatial ones. Rather than listing the Knox ratios, to facilitate the easy identification of patterns in the data, each cell is proportionately shaded to indicate the size of the Knox ratios. As the scale bar to the right-hand side shows, both those Knox ratios that indicate higher than expected cell frequencies (those that are above 1) and those that indicate lower than expected frequencies (those in the range between 0 and 0.999) are represented in the table. In each case, cells that are shaded darkest are those for which the Knox ratio departs the most from 1 (recall that a Knox ratio of 1 indicates that the observed and expected values are equal). Knox ratios that are above 1 are distinguished from those that are below 1 using different symbols; a square indicates that a Knox ratio was greater than 1; a diamond indicates that it was less than 1. Furthermore, cells are only shaded where the observed Knox ratio is statistically significant (i.e. where p ≤ 0.01).

As discussed in the introduction and elsewhere (Johnson and Braithwaite, 2009), we find that following an IED explosion, subsequent IED explosions are more likely to occur within a short period of time and distance of the original explosion than would be expected if the timing and location of events were independent. We can see, for instance, that the Knox ratios for pairs of explosions occur within 1.5 km and 2 weeks of each other are positive and relatively large. The plot also suggests that the effect decays in space and time. For example, the Knox ratios decrease along the bottom row as one looks from left to right. Furthermore, we find that fewer pairs of IED explosions occur near to each other in space but far apart in time (11 weeks or more) than we would expect, assuming that events were independent.

In the case of COIN operations, while there was no obvious pattern in the simple time series analyses discussed earlier, for the analyses presented here – which consider clustering in both space and time – the general trend is similar to that for IED explosions. In particular, the highest Knox ratios tend to be found in the bottom left corner of each plot. However, there are variations across the different types of activity. In the case of raids, we find that the clustering observed for events that occur near to each other in time appears to extend over a larger spatial range. And, when pairs of raids occur 2–3 weeks apart, it appears that they are more likely to occur slightly further away than if they occurred within 1 week of each other. Again, relative to chance expectation, fewer pairs of events occur near to each other in space but far apart in time.

For caches found, the pattern observed is really quite stark. We can clearly see that relative to what would be expected if events were independent, substantially more caches are found within 5.5 km and 1 week of each other. This elevation is most pronounced at proximate locations but is still high for those up to 5.5 km away. This effect also appears to be sustained for a period of up to 3–5 weeks, particularly within a radius of about 3.5 km of discovery locations. After 5 weeks has passed, however, the likelihood of a cache being discovered near to a previous find appears to be substantially lower than would be expected, assuming the timing and location of events were unrelated. This may suggest that the ‘Clear and Hold’ strategy outlined by Condoleezza Rice has some significant effect, as those areas in which caches have been removed appear to experience lower than chance levels of further finds in subsequent periods, likely because of a consequent dearth of available IED components. The alternative is that the military do not return to locations where caches have previously been discovered for sometime.

Finally, compared to chance expectation, we also find that significantly more pairs of ‘cordon/search’ operations occur near to each other in time and space. As with raids, at locations closest (up to 500 m) to previous troop deployments the elevation is short-lived, but at locations a little farther away (1–3.5 km) it endures for 2–3 weeks.

In combination, these findings suggest that there is significant space–time clustering for each event type. It is perhaps noteworthy that this appears to extend (but decay) over relatively large spatial ranges, but generally only in the short term. This would appear to support the conjecture that COIN operations result in local areas being successfully cleared and held, with an observable reduction in the perceived need for follow-up events of the same type at close proximity for much more than a week or two. However, this hypothesis can be more directly evaluated by assessing space–time correlations between IED attacks and COIN operations.

12.4.6 Bivariate Knox Analysis

This modified Knox procedure is used to generate 10 contingency tables, each of which is plotted in Figure 12.4. Once again, we provide a scale bar on the right-hand side that details the greyscale used to illustrate statistically significant Knox ratios (at the p ≤ 0.01 level). As earlier, darker squares are used to highlight higher than expected ratios and darker diamonds are used to highlight lower than expected ratios. In this instance, the plots indicate whether, for example, IED explosions appear to occur close to and shortly after COIN operations (the left-hand column) or (say) the reverse is true (the right-hand column). In other words, these plots enable us to examine the space–time distribution of IED attacks in relation to COIN operations, and vice versa.

Recall that the logic underlying the Coalition strategy of ‘Clear and Hold’ leads us to anticipate (i) that COIN operations will typically be shown to follow IED explosions at targeted locations and nearby more consistently than is shown to be true of the reverse; (ii) that more discriminatory and capacity reducing COIN operations (including raids, cache found and IED found) are expected to have the effect of reducing subsequent levels of IED explosions at proximate locations (at least temporarily) and (iii) that less discriminate and troop-intensive operations (cordon/searches) are likely to be followed by increasing levels of IED explosions nearby in the short-to-medium term.

In the first instance, there is immediately less systematic evidence across the 10 plots of the typical space–time decay than was shown to be the case with the univariate analyses. We do feel comfortable suggesting, however, that some patterns exist. This is most notable for the comparison between IED explosions and IEDs found where we see greater evidence of COIN operations clustering in space and time following IED explosions. In addition to being in line with expectation, this result is useful insofar as it illustrates the utility of the test in detecting patterns and what these might look like.

It would appear that there is some evidence that cordon/search operations also follow IEDs more consistently than vice versa (see the Knox ratios in the bottom left of the plots), but that the timing and location of these COIN operations are influenced by factors other than that of IED explosions. In the case of cordon/searches, which reflect a more strategic action carried out on the basis of hard intelligence, this is perhaps hardly surprising.

In terms of the second general expectation, we find only marginal support for the claim that discriminatory and capacity-reducing operations swiftly reduce subsequent levels of IED explosions in the vicinity of those operations. Indeed, for IEDs found and cordon/search operations, we find that a reduction (relative to chance expectation) in IEDs at locations proximate to these operations is observed only after 11 weeks has elapsed – suggesting that in the longer term, Clear and Hold strategies may have the intended impact. Conversely, we can see that relative to what would be expected if events were independent, there is an increase in subsequent levels of IED explosions around identified cache locations after 11 weeks of their discovery. This is particularly the case at locations that are nearest to those locations where caches were previously discovered. Notably, prior to the 11th week, any increases appear only to be observed outside of a 1.5–2 km radius of the discovery locations.

With respect to the third general expectation, relative to chance, we find an increase in IED attacks within 1.5–2 km of raids, but the general pattern is hardly unequivocal. In fact, contrary to our hypotheses, we interpret the results as suggesting that at least in the short-to-medium term, raids have little effect on the space–time distribution of IED attacks (either positive or negative). The timing and location of raids also appear to be imperfectly related to that of IED explosions.

12.5 Concluding Comments

The present study uncovers yet further evidence to demonstrate that insurgency events (specifically, attacks involving the deployment of IEDs), cluster in space, in time and in space–time. More uniquely, the present study has also shown that COIN operations have distinct space–time signatures, and that for some types of COIN event there is a relationship between when and where they take place and when and where IED explosions occur. Moreover, the results suggest that it does not appear to be the case that IED attacks are more likely to be observed in the vicinity of recent COIN activity. If anything, the reverse appears to be a little more likely. These findings are inconsistent with the idea that COIN activity provokes insurgent action, at least at those locations near to such operations. Importantly, these results also suggest that the finding that IED attacks cluster in space and time is unlikely to be explained in terms of insurgents reacting to COIN action. Instead, it more likely appears to reflect rational decision-making on the part of insurgent actors, perhaps along the lines outlined in the introduction to this chapter.

How might these findings inform military operations on the ground? They offer moderate support for the claim that the Coalition's ‘Clear and Hold’ strategy has borne fruit. In other words, in addition to the fact that IED explosions do not occur with an elevated frequency shortly after and around those locations that COIN operations take place, there is some evidence to suggest that there may be positive longer-term effects of COIN operations at and near to targeted locations. To elaborate, at the locations that these operations (with the exception of the discovery of caches) take place there appear to be fewer occurrences of IED explosions at proximate locations in the long term than would be expected if the timing and location of events were independent. The exception to this rule – caches found – warrants further investigation. It logically follows that the removal of caches would fundamentally alter the resources available to insurgents to engage in additional IED attacks in the local area. We find that locating and removing caches do not have a systematic impact (positive or negative) on IED deployment within the vicinity in the short term, suggesting that, perhaps, insurgents have alternative caches nearby from which to draw resources or that they are able to redeploy resources from more distant caches.

In the preceding discussion we have referenced the actors involved as if they were essentially two groups who coordinate their own actions. However, the insurgent groups involved are unlikely to represent a top-down organized group (Sageman, 2004). Thus, it is conceivable that the patterns observed here are also somewhat contingent upon the distribution and variety of groups carrying out IED attacks against the Coalition and the local communities (for a related discussion, see Bohorquez et al., 2009). Moreover, perhaps it is the case that the pockets of raised Knox ratios at more distant locations and times reflect the spatial and strategic positions taken by competing insurgent groups. On this particular dynamic, further research could usefully be employed to inform the ongoing debate within terrorism and insurgency literature regarding the strategy of ‘outbidding’. Outbidding occurs, some claim, where two or more groups are competing for a position of authority within a community and where the public remains uncertain as to which of the groups is most likely to be able to deliver the goods that the public demands (Kydd and Walter, 2006). The ongoing competition between Fatah and Hamas for the support of the Palestinian populations is perhaps the best exemplar of this strategy at play. Bloom (2004) notes that in this case, increased support among the Palestinian public for the use of suicide bombings has resulted in greater levels of competition between groups for militant recruits. Given the apparent competition both between and within Shia and Sunni communities in Iraq for a role in the governance of Iraq, it appears likely that future research might similarly identify evidence of active outbidding.

A number of other considerations perhaps warrant attention in future research in order to ensure that these speculative conclusions are thoroughly tested against alternative accounts (ideally using data for a different period of time or region) and are, accordingly, more valuable to those designing COIN policy and operations. It is important to note that COIN types are not mutually exclusive (as currently portrayed). Indeed, it is the case that a range of COIN operations are commonly employed in combination and/or in sequence, rather than as substitutes for one another. Similarly, it would perhaps be valuable to assess patterns of different kinds of IEDs. As discussed earlier, there are in excess of six or eight varieties of IEDs commonly deployed in Iraq. Differentiation between these types is not possible using the data from SIGACTS reports, but may be possible through the use of data drawn from the Global Terrorism Database (START, 2011).

A further issue regarding the types of patterns explored is that while it is possible that they are homogeneous across space, it is also possible that they are not. To elaborate, in the current study (and studies reported elsewhere, e.g. Johnson et al., 2007) we have analysed data for a large region and reported upon patterns observed across the entire space. In methodological terms, this is not problematic for the analysis of space–time patterns (it would be for the analysis of spatial patterns alone) as the Knox test was developed for analyses conducted at this kind of spatial scale (see Knox, 1964). The issue to consider is that while, for example, space–time clustering may be a feature of events in some of the region, it may not be (or be less so) in others. Examining variation in observed patterns across the region was beyond the scope of the current study, but doing so would be a useful next step.

The analyses employed above focus upon the dynamic distribution and co-evolution of events in space and time. An alternative strategy would focus, instead, upon a fixed grid-cell approach. This would involve the disaggregation of the region into (say) 5 km × 5 km grid cells and the specification of a series of event count models for each event type within these units of observation. This second approach would be designed to facilitate further testing of the sequencing of different types of events, thereby examining cause and effect relationships – so far as this is possible using methods of correlation. A similar approach is employed with increasing frequency in the study of civil violence (see, e.g. Buhaug and Rod, 2006). Advantages of this approach are that it would enable us to explore the relationship between the types of patterns observed and different populations-at-risk, to examine associations with targets of perceived utility to insurgents, such as iconic buildings or bases, and to examine the extent to which patterns vary across space.

The study of spatial and temporal patterns of insurgent activity is gaining increasing interest in the academic literature. In the current study, we examine both insurgent and counterinsurgent activity to explore the extent to which there are regularities in the coincidence of these two types of action and introduce new methods for studying these interactions. It is important to reiterate that the approach taken represents a departure from studying spatial patterns or temporal trends in isolation. What the approach taken uncovers are the space–time dynamics of events at the micro-level – patterns that cannot be identified using techniques such as spatial hotspot analysis or time series methods. In future work, we aim to continue this trend by exploring, for example, the association between the risk of IED attacks and the recent locations of such events and also the influence of more time-stable factors such as the accessibility or centrality of places, the presence of vulnerable targets and so on.

References

1. Arce, D. and Sandler, T. (2005) Counterterrorism: A game-theoretic analysis. Journal of Conflict Resolution, 49, 183–200.
2. Axelrod, R. (1984) The Evolution of Cooperation, Basic Books, New York.
3. Blank, L., Enomoto, C., Gegax, D. et al. (2008) A dynamic model of insurgency: The case of the war in Iraq. Peace Economics, Peace Science, and Public Policy, 14, 1–26.
4. Bloom, M. (2004) Palestinian suicide bombing: Public support, market share, and outbidding. Political Science Quarterly, 119, 61–88.
5. Bohorquez, J.C., Gourley, S., Dixon, A. et al. (2009) Common ecology quantifies human insurgency. Nature, 462, 911–914.
6. Braithwaite, A. (2010) Conflict Hotspots: Emergence, Causes, and Consequences, Ashgate Press, Aldershot.
7. Braithwaite, A. and Li, Q. (2007) Transnational terrorism hot spots: Identification and impact evaluation. Conflict Management and Peace Science, 24, 281–296.
8. Bueno de Mesquita, E. (2005a) Conciliation, counterterrorism, and patterns of terrorist violence. International Organization, 59, 145–176.
9. Bueno de Mesquita, E. (2005b) The quality of terror. American Journal of Political Science, 49, 515–530.
10. Bueno de Mesquita, E. (2007) Politics and the suboptimal provision of counterterror. International Organization, 61, 9–36.
11. Bueno de Mesquita, E. and Dickson, E. (2007) The propaganda of the deed: Terrorism, counterterrorism, and mobilization. American Journal of Political Science, 5 (2), 364–381.
12. Buhaug, H. and Rod, J.K. (2006) Local determinants of African civil wars, 1970–2001. Political Geography, 25, 315–335.
13. Department of the Army, Headquarters. (2007) Combined Arms Improvised Explosive Device Defeat Operations (FM 3-90.119/MCIP 3-17.01). Accessed online <www.us.army.mil> (accessed 07 January 2016).
14. Faria, J.R. and Arce, D. (2005) Terror support and recruitment. Defence and Peace Economics, 16, 263–273.
15. Hoffman, B. (2006) Inside Terrorism, Columbia university Press, New York.
16. Johnson, S. and Bowers, K. (2004) The burglary as a clue to the future: The beginnings of prospective hot-spotting. European Journal of Criminology, 1, 235–255.
17. Johnson, S., Berdasco, W., Bowers, K. et al. (2007) Space-time patterns of risk: A cross-national assessment of residential burglary victimization. Journal of Quantitative Criminology, 23, 201–219.
18. Johnson, S. and Braithwaite, A. (2009) Spatio-temporal distribution of insurgency in Iraq, in Countering Terrorism through SCP. Crime Prevention Studies, vol. 25 (eds J.D. Freilich and G.R. Newman), Criminal Justice Press, pp. 9–32.
19. Johnson, S., Summers, L. and Pease, K. (2009) Offender as forager? A direct test of the boost account of victimization. Journal of Quantitative Criminology, 25, 181–200.
20. Johnson, S. (2010) A brief history of the analysis of crime concentration. European Journal of Applied Mathematics, 21, 349–370.
21. Kalyvas, S. (2006) The Logic of Violence in Civil War, Cambridge University Press, New York.
22. Knox, G. (1964) Epidemiology of childhood leukaemia in Northumberland and Durham. British Journal of Preventive Social Medicine, 18, 17–24.
23. Kydd, A. and Walter, B. (2006) The strategies of terrorism. International Security, 31, 49–79.
24. LaFree, G., Dugan, L. and Korte, R. (2009a) The impact of British counter terrorist strategies on political violence in Northern Ireland: Comparing deterrence and backlash models. Criminology, 47, 17–46.
25. LaFree, G., Dugan, L., Xie, M. and Singh, P. (2009b) Spatial and Temporal Patterns of Terrorist Attacks by ETA, University of Maryland, Typescript.
26. Maoz, Z. (2007) Evaluating Israel's strategy of low-intensity warfare, 1949–2006. Security Studies, 16, 319–349.
27. North, B.V., Curtis, D. and Sham, P.C. (2002) A note on the calculation of empirical p values from Monte Carlo procedures. American Journal of Human Genetics, 71, 439–441.
28. Pape, R.A. (2003) The strategic logic of suicide terrorism. American Political Science Review, 97, 343–361.
29. Pape, R.A. (2005) Dying to Win, Random House, New York.
30. Rosendorff, B.P. and Sandler, T. (2004) Too much of good thing? The proactive response dilemma. Journal of Conflict Resolution, 48, 657–671.
31. Ryu, A. (2005) Roadside Bombs Cause Increasing Concern in Iraq. Voice of America. 28th September.
32. Sageman, M. (2004) Understanding Terror Networks, University of Pennsylvania Press, Philadelphia, PA.
33. Siquiera, K. and Sandler, T. (2007) Terrorist backlash, terrorism mitigation, and policy delegation. Journal of Public Economics, 91, 1800–1815.
34. National Consortium for the Study of Terrorism and Responses to Terrorism (START). (2011) Global Terrorism Database [Data file]. Can be retrieved from http://www.start.umd.edu/gtd (accessed 07 January 2016).
35. Townsley, M.T., Johnson, S.D. and Ratcliffe, J.R. (2008) Space-time dynamics of insurgent activity in Iraq. Security Journal, 21, 129–146.
36. Wilkinson, P. (2001) Terrorism versus Democracy: The Liberal State Response, Frank Cass, London.