loader image

Disruptive Insurgencies

Recent events in the United States have underlined a significant public knowledge gap as regards the form and function of disruptive insurgencies and the assessment of risk.

Our operations manual on this topic will be available later in 2021, but we felt two paragraphs (1.2 and 1.3) from that publication may be immediately helpful at this time.


Disruptive Insurgency has less in common with politics and bears more similarity to what the US Military refer to as “Irregular Warfare” – defined as “a violent struggle among state and non-state actors for legitimacy and influence over the relevant population.”

By its nature, disruptive insurgency is not best responded to with a full frontal assault using traditional methods (PR campaigns, media advertising, SPOX pieces, parliamentary questions) though these can be used to chip away at credibility, shift public opinion, and demoralise the actors involved. Rather, hybrid resistance requires a full-spectrum approach, blending traditional political and media tactics with grassroots activism, social media, alternative information ecosystems, and trust network communications. This hybrid or blended response is essential in not only defeating disruptive insurgents head-to-head but in exposing, targeting, and repairing the underlying cracks in the societal structure which they exploit.

The operational environment of disruptive insurgents tends to be off the beaten track, in unregulated spaces where governance is weak or non-existent and as such a crucial objective of hybrid resistance is to highlight these gaps, engage legislators, and implement effective interim measures to police these areas while driving policy decisions which close them down. In any case, with hybrid resistance demanding direct engagement with the general public and the legislature, it is important to recognise at the outset that full control will never be achieved and obstacles to success may include insurmountable ignorance, apathy, self-interest, complicity, and other counterproductive or self-harming behaviours.


The starting position of disruptive insurgency should be one of weakness – outside of accepted societal norms, expected behaviours, and general compliance with rules and regulations. However, this is a strength. They are not bound to behave in the ways opposing forces or authorities would expect and benefit from decreased visibility and increased agility, being able to readily identify places where oversight is weak but societal access is maximised.

Origins are varied, with some disruptive insurgencies existing on the fringes of society or in the periphery of mainstream politics for many years, and they may begin with public disgruntlement over a single issue. Some may be non-domestic in origin, seeded, encouraged, funded, or even resourced by hostile states or foreign agents. Critical mass is achieved when a sufficient portion of the domestic population is mobilised to action, using peaceful or violent means to achieve their objective and change either the direction of authority or replace authority itself.

In some cases this can be organic or opportunistic, catalysed by societal events in which disruptive insurgents can insert themselves and obtain control. In other cases, causation is synthetic, designed end-to-end by the disruptive insurgents themselves in order to achieve personal or state objectives. In all cases, disruptive insurgency can be defined as: “the calculated attainment of or disruption to control of a political assembly, state, or region through subversive or violent activity, or both.”

Success in a disruptive insurgency is not necessarily measured by a point-score or visible battlefield victory. Rather, it centres on the quality of impact: the lifespan of political consequence and the volume of support given by the population affected. In turn, this data is used to inform future actions and create targetable audience segments which can be activated to drive further wedges into society or create (or attempt to create) more ideological change.


Timelines (1)

Timely action is essential in countering a disruptive insurgency.

There are several key points at which certain types of action cease to be viable. In the above diagram 2017 is highlighted as a point of no return. In context, this refers to the point at which an online only response could be used to successfully counter majority online tactics.

Up until this point, regulating content, enforcing standards, and removing harmful online actors from circulation would have been a successful approach. Beyond this point such tactics cease to be effective in addressing the counter-insurgency due to its transition to majority offline activity.

By the point of activation, the meaning of majority offline is simply that communications, tasking, briefing, and data-gathering are no longer reliant upon online platforms. There is no need for open recruitment and the insurgent activities are carried out through a distributed network most similar to multi-layer marketing. Subsequently it no longer matters which online services are disrupted or removed and, in fact, disruption to such services will reinforce narratives of the insurgency and its supporters being under attack.

The result is a flashpoint arriving alongside a reduction in the visibility of the insurgency, allowing it to operate and endure clandestinely. At the same time, the insurgency retains a full view of what those opposed to it are doing. The result is a high-risk situation likely exacerbated by a false sense of security.

As a final note on base unification, during the consolidation stage final open recruitment is active. Using a range of narratives and delivery mechanisms, fringe groups most likely to align with the insurgency and become taskable assets are brought on board. Fringe groups are important as they are susceptible to believing outlandish conspiracy and already hold bias against trust in authority and are seeking signs of a "climax to society." Unifying them in order to bring them into the wider base may require action which would look outwardly absurd and this would also draw public attention, leaving other aspects of activation largely unnoticed and allowing the nature of the broader threat to be minimised or dismissed.

Disruptive insurgencies and efforts to counter them are entirely reliant on legitimacy and achieving this requires knowledge of the operating environment or terrain. We hope these final two paragraphs from our operations manual (1.45 and 1.46) provide some further clarity.


Disruptive insurgencies seek to persuade populations to reject authority in order to destabilise the assembly, state, or region targeted. This is complex because it can be for the purpose of establishing illegitimate authority, initially by obtaining the favour or consent of the public before installing new authority and using the excuse of that change – for example the collapse of a governmental system achieved through protest – to implement coercive control and secure or maintain the power obtained as a result of the insurgency.


The difference between success and failure, between establishing or destabilising legitimacy, is in understanding the operating environment and conditions in which the disruptive insurgency has arisen. This means knowing the society, culture, values, language and lexicon, interests and intrigues of the population where the insurgency is running and in which hybrid resistance operations will take place. This does not mean knowing a part of it, or understanding one component societal segment, or niche special interest group. This does not mean having general polling assumptions to hand, nor does it mean understanding basic social media metrics for key influencers, MRP models for elections, or being embedded in internet culture. Knowing the terrain means having firm data, intelligence, and knowledge of the affected population no matter what their view. It goes beyond forming opinions based on studies and media reporting and, instead, requires deep cultural understanding to capture not only the insurgency but the structural conditions and root causes of it.




Related Articles

Hostile Actors and Insider Threats

Hostile Actors and Insider Threats: As digital footprints have grown, the upcoming generation being the first with no real gaps in their cradle to grave online presence, our attack surface has expanded. As old border mechanisms have become less relevant in the connected world, it has never been easier to reach a target or disseminate information. Social norms have shifted to and continue to do so with acceptable and unacceptable behavior or activity perhaps harder to narrowly define than during previous decades. From the impact of the Cambridge Analytica scandal on the restriction of access to information by platforms to the increasing use of covert online identities in espionage, security risk is evolving at an unprecedented rate. PAEI is at the heart of it. Fingerprints can be retrieved from digital photographs. insurrection can be planned on message boards, populations can be subjected to influence operations through open social media, spies can be tracked through jogging apps… Hostile actors can deploy cyber attacks through social engineering on a scale never previously thought achievable. A central challenge for governments and corporations arises from the natural conflict between what someone acting within the confines of law and expected standards can do to protect their interests versus what can be done by an unconstrained adversary or an uncontrolled insider threat operating in the grey zone. Helping you understand threats and helping you mitigate risks is not just a cybersecurity issue and we are here to assist.

Losing Narratives

Narrative isn’t a toy, you see. Yet it’s played with all too often by people who don’t understand it. Narrative is a weapon in the hybrid warfare arsenal and has tendency of backfiring if not handled with care.

The Long Walk

Recent events in the United States have underlined a significant public knowledge gap as regards the form and function of disruptive insurgencies and the assessment…


This psychology not only continues to redefine our shared values, incorporating disinformation into our talking points and group behaviours, but profits the whole sector which both feeds upon and drives it. This is Disinfonomics.