In the previous article, you were introduced to the core concepts of Rules of Engagement (ROE), like self-defense, hostile intent, proportionality, etc... and how they can shape operations like OEF. Within NATO, these principles are described through a strategic document, called MC 362/1. It's the alliance’s official ROE policy.
This system assigns numbered rules gathered within what's called "Séries" dealing with specific actions, like target identification or the use of force. Each rule can be activated, retained, or withheld, allowing commanders to tailor ROE profiles to mission needs and to national caveats.
In this post, I'll try to explain how NATO’s numbered ROE work in practice, and which ROE were the most relevant in Afghanistan.
I. Description of NATO Numbered ROE
The NATO ROE system, as defined in MC 362/1, organizes permissions into Séries, each identified by a three-digit number and tied to a specific operational function. They are used as a standardized policy tools that allow commanders to build a coherent ROE profile, scalable from peacekeeping to high-intensity combat.
Each rule within a Série can be activated, retained (requiring higher-level approval), or withheld entirely. This modularity gives NATO commanders flexibility while respecting the political and legal constraints of each member nation.
Full list of NATO ROE Séries described inMC 362/1, as of 2003.
We can make a simplified breakdown of the core NATO ROE Séries, categorized by operational functions.
I.1 - ROE Without Use of Force
These rules govern movement and presence, including how forces posture or simulated activities near potential adversaries.
10X - Geographic positioning of own forces
11X - Relative positioning of own forces
15X - Warnings
24X - Exercising in the presence of a potential enemy
25X - Conduct of simulated attacks
I.2 - Weapon Systems Employment and Control
These rules authorize or restrict the use of specific systems or effects, including sensors, illuminators, non-lethal agents, and electromagnetic tools.
22X - Infrared and visual illumination
23X - Identification of potential targets prior to engagement
28X - Designation of targets
29X - Harassment and counter-harassment
32X - Use of riot control agents
35X - Prohibiting or Restricting use of specific weapons in designated circumstances
37X - Use of electronic countermeasures (ECM)
38X - Use of mines
I.3 - Reactive Use of Force
These rules permit the use of force in response to threats or to secure control of persons and property — often during maritime or tactical interdiction.
13X - Prevention of boarding, detention, or seizure of civilian property
16X - Diversions
17X - Boarding
18X - Detention or seizure
33X - Use of force in designated operations
I.4 - Offensive Use of Force
This Série contains the most politically sensitive permissions, involving deliberate attack on designated targets.
42X - Attack
Use of (lethal) force can be granted either in reaction to enemy behavior (self defense, reactive ROE, response to hostile intent or hostile act), or from our own initiative under the 42X Série of ROE.
I.5 - Other Operational ROE
This group includes specialized domains — from psychological and information operations to cyber activities — which may be activated depending on the strategic environment.
14X - Intervention in non-military activities
31X - Psychological operations
34X - Computer network attacks
36X - Information operations
39X - Action against suspected submarine contacts
99X - Confirmatory ROE (used to clarify or confirm previous ROE status)
II. A deeper look at offensive ROE, HI and HA, and ROE for Air Operations
As gamers and virtual pilots, the most important ROE we obviously need to understand are the offensive ROE, notably Série 42, defined simply as “Attack.” These ROE explicitly authorize deliberate and proactive engagement of designated enemy targets. Unlike reactive or defensive ROE, which rely on responding to hostile actions or threats, Série 42 rules permit commanders to initiate planned military action to achieve operational objectives.
In operations like OEF and ISAF mission in Afghanistan, Série 42 was a cornerstone for strategic missions targeting insurgent leadership, infrastructure, weapon caches, or enemy combatants in open battle. Yet, despite (or because of) its inherent permissiveness, Série 42 was also one of the most politically sensitive ROE, typically subject to strict national oversight, restrictive caveats, and higher-level approval requirements. In fact, after the fall of the Taliban, these ROE were generally activated only very punctually, most of the time in order to support very defined large ground operations.
During the initial phase of OEF, such as the airstrike against Kandahar airfield, offensive Rules of Engagement from Série 42X were activated to authorize deliberate offensive military actions against designated targets.
II.1 - Detailed Analysis of Série 42: “Attack”
According to NATO’s MC 362/1, Série 42 explicitly authorizes deliberate offensive attacks against clearly identified military objectives. Activation of this rule is generally tied to high-level mission approvals and detailed target vetting processes, as it has been discussed in the Electronic Target Folder intorudction.
Full list of offensive ROE.
While ROE 420 to 426 are still reactive in essence (since they depend on a hostile act (HA) or hostile intent (HI)), Série 42X also authorizes planned offensive operations without requiring such a triggering event. You will note that there are only three distinct rules remaining: 427, 428, and 429. Each represents an increasing degree of permissiveness regarding offensive engagements:
ROE 427 typically authorizes attacks against clearly defined military objectives directly supporting enemy combat operations. This rule still maintains some linkage to identifiable military threats and may require proof that the target is actively contributing to enemy capability or actions.
Offensive targeting of military means, like aircraft here, is typically permitted under ROE 427.
ROE 428 broadens authorization, allowing deliberate targeting of military objectives not directly linked to ongoing hostilities but nonetheless deemed necessary to weaken enemy capabilities or achieve operational goals. This rule grants greater latitude to commanders, enabling strategic targeting beyond immediate tactical threats.
The raid against Bin Laden in Pakistan might have been authorized under a ROE similar to ROE 428, which grants authorization to pursue people contributing to hostile operations against the allied force.
ROE 429 is the most expansive and politically sensitive offensive ROE within NATO’s doctrine. It authorizes offensive action against virtually any designated entity, without the requirement for the target to be a traditional military objective or directly contributing to military operations. It can encompass political, economic, or infrastructure targets if approved by political authorities.
For instance, the April 2018 strikes against Syria, conducted by the US, UK and France, were likely authorized under ROE similar to ROE 429. These strikes specifically targeted facilities associated with chemical weapons production, despite these facilities having no direct link to immediate military operations and notwithstanding the Syrian regime's concurrent engagement against a common enemy (ISIS).
Given its broad scope, we can easily understand that ROE 429 engagements require explicit national approval and are generally reserved for strategic-level decisions rather than routine tactical targeting. Activation of ROE 429 is typically a clear signal of political resolve and strategic intent, sending messages well beyond the immediate tactical or operational context.
In Afghanistan, these purely offensive ROE were most probably selectively authorized to target enemy strongholds, insurgent infrastructure, or leadership figures. ROE 429, however, was certainly never activated due to its potential political and strategic implications far beyond the Afghan theater.
II.2 - The importance of "Hostile Intent" and "Hostile Act"
As you have seen above, ROE 421 to 426 requires a clear understanding of two critical concepts defined by NATO’s MC 362/1: Hostile Act and Hostile Intent.
Contrary to common misunderstanding, a Hostile Act does not necessarily involve firing a weapon. According to NATO’s MC 362/1, hostile acts encompass a wide range of behaviors, going from an immediate threat to less significant "disruption" to NATO forces.
For example, in the air domain, we can imagine:
Correlated and unambiguous Radar Warning Receiver (RWR) indication of enemy air interceptor radar actively locking onto friendly aircraft within weapons employment range (WEZ).
Enemy aircraft clearly and persistently maneuvering into an attack position inside WEZ, demonstrating imminent firing capability.
Aircraft significantly exceeding tactical speeds (greater than Mach 1.0 or 600 knots ground speed at high altitude), clearly indicating an aggressive intent or imminent threat.
Use of electronic warfare (EW), such as radar jamming or chaff deployment, actively denying situational awareness or disrupting friendly communications.
Conducting unauthorized mine-laying operations directly imposing restrictions upon the movements of friendly forces.
Hostile Intent, by comparison, involves behaviors indicating preparations or positioning for imminent hostile acts but not yet directly threatening immediate force employment. Typical examples of hostile intent in air scenarios could include:
Correlated and unambiguous RWR indication that enemy interceptor radar is tracking friendly aircraft, but still outside weapon employment range.
Enemy aircraft penetrating friendly-controlled airspace and ignoring interception instructions or directives, suggesting non-cooperation and potential hostility.
Groups of aircraft marshalling or forming combat formations in a manner consistent with imminent offensive action.
The NATO brevity code "Gorilla" indicates a large, coordinated enemy air formation (COMAO), clearly signaling preparation for an imminent attack and likely triggering Hostile Intent ROE. Similarly, assembling your own COMAO may be interpreted by the enemy as Hostile Intent. To minimize the enemy's reaction time and avoid early detection, friendly COMAOs should form either beyond enemy sensor range or as late as operationally feasible.
Enemy aircraft maneuvering at high speeds (Mach 0.7 or greater) with hot aspect, closing within weapon range of friendly assets, or deploying countermeasures (e.g., chaff) indicating preparation for combat.
You'll note that the precise definitions of HI/HA for any given operation are necessarily classified. Publicly disclosing them could give adversaries a critical advantage, enabling them to anticipate our responses and exploit this predictability to delay or disrupt our defensive actions...
Conclusion
I hope that you now have a better understanding of NATO’s structured numbered ROE system, with special emphasis on offensive ROE (Série 42X) and the critical concepts of Hostile Act and Hostile Intent.
In a next article, we’ll narrow our focus specifically to Afghanistan. We’ll try to determine which ROE from the NATO system were most relevant for coalition aircrews, particularly in conducting Close Air Support (CAS) missions, and we'll try to come up with a tentative SPINS section describing useful ROE for this conflict.
