Figure 1
The Battlefield Forensics Framework (overall research project).
Note. Own work. This article focuses on the NATO/military dimension of the framework (Rietveld, 2025).
Figure 2
NATO’s technical exploitation process, showing the different levels of exploitation, supporting activities, technical/forensic disciplines and supported outcomes (AIntP-10 Technical Exploitation Standard).
Figure 3
Mixed methodologies: Action Research and Grounded Theory.
Note. Own work. Data from exercises, stakeholder engagements, and field observations are analysed to generate recommendations, implemented, and re-assessed in iterative cycles (action research). In parallel, outputs are coded through constant comparison (open, axial, and selective coding) across datasets until thematic saturation, yielding concepts that inform theory building (grounded theory). The two cycles run concurrently so that practice improvement and theory development reinforce each other (Lingard et al., 2008).
Table 1
Summary of Exercises and Events from Which Empirical Data Were Drawn (Empirical Input 2).
| YEAR | EXERCISE/EVENT | HOST/LOCATION | FOCUS AREA | NOTES/DATA COLLECTED |
|---|---|---|---|---|
| 2022 | MV TE Experiment (MV22) | San Marcial Division HQ Spain | Tested TEF-2 (later TECC) concept | 11 Vignettes incl. UAS, IEDs, maritime, CBRN, 50 Participants, 12 nations |
| 2023 | Ardent Defender 23 (AD23) | Canada | Counter Explosive Threat FTX | Evaluated TECC/TEG, reporting standards, 9 nations |
| 2023 | Bison Counter (BC23) | Germany | NATO C-IED LIVEX | Observed TE without TECC, 1000 participants, 12 nations |
| 2023 | Northern Challenge 23 (NC23) | Iceland | EOD/IEDD Multinational FTX | TECC Role in scenarios, 430 participants, 16 nations |
| 2023 | CBRN MERT Experiment – Toxic Valley 23 (TC23) | Slovakia | CBRN Exploitation | Level 1 CEM collection in CBRN-contaminated scenarios, 5 nations |
| 2024 | Trojan Footprint 24 (TF24) | NATO SOF Europe | SOF exploitation, CEM HOTO | Scripted SOF drills, tested CEM transfer to CIV authorities, identified cross-JOA sharing gaps |
| 2024–2025 | HQ Observations – Command Post Exercises (CPX) | MNCNE (Poland), MNDN (Latvia) | Operational Integration of TE on DIV and CORPS level | Observations, field notes, NATO reports, doctrinal review |
Table 2
Example of Coding Process Across Empirical Inputs.
| DATA SOURCE | EXAMPLE EVIDENCE | OPEN CODES | CATEGORIES | THEMES |
|---|---|---|---|---|
| Scoping Mission (Iraq 2023) | NATO/host-nation confusion over BE vs TE definitions | Terminology confusion | Doctrine & Standards | Conceptual clarity |
| NATO Exercises and Experimentation (2022–2025) | TECC improved outcomes but lacked SOPs and supporting doctrine | Undefined SOPs and outdated doctrines | Coordination and Command | Interagency cooperation |
| Surveys and Interviews | Most nations only at level 1 TE; civilian labs provide Level 2/3 | Capability shortfall | Capability Gaps | Capability Development |
| Conferences and Working Groups | Legal advisor stressed need for biometric compliance | Legal risk | Legal Frameworks | Legal harmonisation |
Figure 4
Military forensics intelligence cycle with TECC coordination.
Note. Own work. Collected exploitable material (CEM) may be recovered deliberately or incidentally by specialists or non-specialists. When routed via the technical exploitation coordination capability (TECC), technical outputs are validated, standardised, and translated into actionable intelligence, fused with other sources through the all-source analysis cell (ASAC), and disseminated to the wider community. The TECC also coordinates lateral exchange with other joint areas of operations and host-nation points of contact to optimise exploitation and the re-use of results (Rietveld, 2025).
| TERM/ABBREVIATION | DEFINITION |
|---|---|
| AEODP-6 | Allied Explosive Ordnance Disposal Publication 6: A NATO reporting standard designed for EOD that is also applied to TE reporting. |
| Battlefield evidence (BE) | Material collected during military operations that is intended for use in judicial proceedings. |
| Battlefield forensics (BF) | Battlefield forensics is the application of scientific methods to collect, analyse, and disseminate information, intelligence, and evidence within crisis or conflict zones. It encompasses both military forensics (e.g., technical exploitation) and civilian forensics (e.g., contributions from government, academia, industry, and NGOs/IOs). This multidisciplinary approach integrates forensic science principles to reconstruct events, identify combatants, and provide critical insights for military and civilian operations. By examining physical, digital, and biological materials, battlefield forensics supports tactical, operational and strategic decision-making, enhances operational security, and ensures accountability in conflict environments. |
| Civilian forensics | Forensic activities conducted by non-military actors, such as government medico-legal systems and law-enforcement, national laboratories, academia, industry, and NGOs/IOs, that support identification of the deceased, war-crimes investigations, disaster victim identification (DVI), digital/media analysis etc. Civilian forensics provides surge capacity and legal admissibility pathways, and interfaces with military collection through agreed procedures and standards. |
| Collected exploitable material (CEM) | Items recovered from the battlefield (e.g., weapons, electronics, documents, biometrics) that can be exploited for intelligence or evidentiary purposes. |
| Exercise blindness | A tendency during exercises to validate scripted intelligence products without rehearsing and implementing the full end-to-end exploitations (collection, analysis, legal permissions, dissemination coordination). Authors definition. |
| Five Eyes | The Five Eyes is an intelligence alliance composed of Australia, Canada, New Zealand, the United Kingdom and the United States |
| Forensic science | Forensic science is defined as the application of scientific principles and techniques to matters of criminal justice especially relating to the collection, examination, and analysis of physical evidence (Merriam-Webster). |
| Joint intelligence, surveillance, and reconnaissance (JISR) | JISR is an integrated intelligence and operations set of capabilities, which synchronises and integrates the planning and operations of all collection capabilities with processing, exploitation, and dissemination of the resulting information in direct support of the planning, preparation, and execution of operations. TE is a component to the JISR process of the intelligence cycle. |
| Legacy bias | The cultural perception that TE is primarily an expeditionary counter-IED function (rooted in Afghanistan/Iraq experience), which limits its wider adoption as a routine intelligence and forensic capability. Authors definition. |
| Level 1/2/3 Exploitation | NATO’s tiered exploitation structure: Level 1 – Tactical collection and initial screening at the point of capture. Level 2 – Advanced analysis (DNA, biometrics, electronics) in deployable or national laboratories. Level 3 – Specialist national or strategic laboratories with full forensic capabilities. |
| Military forensics | An umbrella term for technical exploitation (TE), battlefield evidence (BE), and biometrics focusing on the collection and exploitation of material in conflict environments to support intelligence, operations, and judicial processes. |
| MoA (Memoranda of Agreement) | Bilateral or multilateral agreements that establish operational and legal arrangements for cooperation in evidence collection and sharing. |
| SOFA (Status of Forces Agreement) | A legal framework between NATO/nations and Host-nations defining rights and responsibilities of deployed forces. |
| Martial Vision Subgroup | Martial Vision Subgroup (MVSG) is a Flagship Activity of the NATO Technical Exploitation Group (NTEG). MVSG aims to identify and pursue opportunities for testing and/or validating concepts, doctrine, and operational standards in NATO and/or national exercises and experimentation. |
| TE process | The TE process parallels the JISR process with a focus on the processing and exploitation steps. TE results fused with JISR results contribute to the development of intelligence products that define the operating environment (OE) and support the commander’s decision-making process on all levels. |
| Technical exploitation (TE) | The process of using scientific methods and tools to derive data and information from potential intelligence or operational value from collected data, information, materiel, and materials. |
| Technical Exploitation Coordination Capability (TECC) | A scalable staff function, embedded in J2 (intelligence), responsible for coordinating TE contributions, fuse technical reporting, and disseminating exploitation outputs. |