Decisive Action Training Environment and the Hybrid Threat of the Trans-national criminal syndicate

By Barry Laming July 14, 2020

Case study: The Vory v zokone (Russian Mafia)

 ‘Your code has outlived its time. All the “Code men” have cracked….’ ‘I come from a long line of Russian thieves. I have stolen and will again.’ Conversation between a prison guard and a blatnoi, in Sergei Dovlatov’s novel The Zone.

The Australian Defence Forces (ADF’s) newly adopted Decisive Action Training Environment (DATE) has significantly broadened the complexity of the threat picture away from the more conventional Musorian Armed Forces and brought with it a slew of new actors and issues. Adapted to real world threats, the new stakeholders in this updated training environment include near peer conventional threats as well as insurgents, guerrillas, terrorists and trans-national criminals ‘who may operate in ungoverned areas or failed states’. On its home page the DATE is described as “a comprehensive array of conventional, hybrid and irregular threat groups”. Arguably the most formidable element of the DATE is the evidently real phenomenon of the ‘hybrid threat’ that vastly surpasses its conventional predecessor in complexity. In one of DATE’s featured videos, ‘A complex world’, a description is given of the manner in which “enemies will combine complex fires and manoeuvre with irregular forces, criminals and terrorists operating among civilians. They will exploit their environments to close with friendly forces where combat mobility is constrained”. In other words, a most dangerous course of action scenario could well be a combination of belligerent actors working in sync to inflict anything from serious constraints on ADF operations, to direct action leading to severe mass casualties. A significant stakeholder in the new hybrid threat picture is that of the transnational criminal organisation. The DATE has identified this sub-sector of threat actor due to the ability that some of these groups have to act as para-military, but also the ability to act as facilitators of arms, traffickers of sensitive information and their influence on local populations. It is important to identify these groups and understand what affect they can have in the various theatres of operation and one of the most strikingly versatile, developed, and highly sophisticated operators in the trans-national criminal world is that of the Russian Mafia or Vory v zokone.

While the Vory v zokone are often referred to as the Russian Mafia, the Russian speaking Mafia may be a more fitting title as many of the key players over the years have been of Chechen, Georgian and Armenian descent along with some less significant players from Moldova and Ukraine.

In a book entitled The Vory: Russia’s super Mafia, author Mark Galeotti, a senior researcher at the Institute of International Relations - Prague and writer on transnational crime and Russian security affairs, spent three decades accumulating the information to form this comprehensive account though the first draft was not published until 2013. Drawing on detailed accounts from Russian Police, various intelligence agencies, the business communities in Europe and Russia, along with members of Eastern European and Russian underworld, The Vory details the development and augmentation of the Vorovskoi Mir or ‘Thieves world’ through four distinct phases: Foundations, Emergence, Varieties and the Future. The following is key information from Galeotti’s book with some real world application as it pertains to the DATE.


During the time of the various Czars, Russia was an extremely difficult land to govern and enforce the rule of law, much like the USA’s western frontier following the civil war, commonly known as the Wild West era. With little to enforce penalties against horse thief rings many of the locals in the rural areas had to form vigilante groups to ensure that thieves did not steal from their prime means of production and transportation. Conversely, the thieves needed to organise their own networks and safe havens through which they could smuggle their goods to the urban areas or other towns. Towns controlled by thieves also gave rise to a code of conduct which was very anti-authority in nature as vigilante groups would, wherever possible, side with whatever law enforcement was available to them. This code of conduct gave rise to the vory v zokone or ‘thief in law’, a parallel society with its own distinct laws, code of ethics and governance. The Vory has been immortalised throughout Russian folklore over the years, at times resembling the Robin Hood of western, namely British legend. Though there was much to be despised and distrusted from the Vory, a romanticised image of an anti-hero emerged who was courageous enough to stand up against the tyrannical rule of the Czar and his corrupt cronies, while remaining a humble ally of the common folk. The first significant schism within the vorovskoi mir came at the end of World War 2 when many former prisoners who served in Stalin’s Red Army were returned to the prisons they had been previously serving in, after having been promised freedom for their wartime service. Those who opposed serving in the Red Army did so out of loyalty to the thieves’ code and viewed those that served as traitors to the cause and referred to them as voyenschina meaning the ‘soldierly’, though the more common term given to them was suki or ‘bitch’. The traditional thieves that did not serve in the Red Army referred to themselves as blatnye or as chestnyagy - the unconverted, with a higher status than that of the suki. Inevitably the animosity between the two groups sparked what came to be known as the ‘bitch wars’ which spread fiercely throughout the Soviet gulag archipelago. It was during this period of prison war that the suki found common ground with many of the prison guards who viewed them as war heroes that had been wronged by the Communist leadership and thus favoured them in a manner which was highly detrimental to the operations of the blatnye, particularly with regards to the smuggling of goods into the prisons contributing greatly to the internal black markets of the Soviet prison system. Over time this would give rise to the amalgamation and crossover of the vorovskoi mir into the mainstream, semi-legitimate business world and beyond.


With the approach of, and the actual collapse of the Soviet Union new opportunities for rapid expansion emerged for the vory v zokone and the landscape had changed dramatically with an array of new actors to add the increasingly complicated milieu that was Russia’s ever changing underworld. Among these new players were former athletes, boxers, wrestlers and a small but impactful number of afghantsy, the soldiers who had served in Afghanistan during the Soviet occupation of the 1970s and 80s. The bulk of these new players would take up positions as muscle or enforcers and some would rise in the ranks from there often by utilising legitimate (or seemingly legitimate) businesses. While the collapse of the Soviet Union saw social and economic upheaval in Russia and Eastern Europe, the underworld was engulfed in a brutal war which would further alter the landscape and continue the trend of amalgamation of worlds that had been put into motion from the outset of  the ‘bitch wars’. Among the turbulence of this period a new actor emerged in the Russian underworld, the avtoritet, who further blurred the lines between legitimate business and organised crime. The enduring factor of this period in the development of Russian organised crime that persists and shapes the contemporary battlefield is the crossover between the underworld, the business world and the state and its institutions namely the military and intelligence services. The United Kingdom has witnessed a number of high-profile examples of this nexus with regard to assassinations and attempts on former members of the Russian intelligence community who became defectors and whistle-blowers. Among these defectors was Alexander Litvinenko, a former officer of the Russian FSB secret intelligence service who specialised in tackling organised crime; Badri Patarkatsishvili a Georgian businessman who claims he was targeted by two Georgian hitmen; and former double agent Sergei Skripal who was - along with his daughter - targeted by a chemical attack. Incidentally, one week after Skipral’s assassination attempt Aerofloat boss Nikolay Gluskov, who had received political asylum in the UK and had extradition attempts resisted by the UK government, was apparently strangled to death in his London apartment. Russian organised crime networks are believed to have had significant roles in these deaths and attempts on life. These kind of targeted operations epitomise the DATE’s hybrid threat where in which the Kremlin’s political objectives are carried out by means of a co-operation between state intelligence services and underworld enforcers and can easily be re-adapted to inflict harm on friendly forces deployed in operational theatres.


Another more significant potential flashpoint with this phenomenon of the hybrid threat is in Russian Private Military Contractors, the Wagner Group being the most notable. Known for its involvement in some of the heaviest fighting in Eastern Ukraine and Syria, the Wagner Group is believed to have had significant initial funding and a high level of ongoing involvement from one Yvgeny Prigozhin, a well-connected and highly influential and successful businessman, owning St. Petersburg’s first Casinos along with restaurants, grocery chains and catering businesses. His success in these ventures earned him high profile contacts, which eventually earned him the title of ‘Putin’s chef’. Prigozhin’s early life however saw him landing in trouble with the law. From the Russian publication Meduza:

“In 1979, when Prigozhin was only 18, a court in the Kuibyshev district of Leningrad sentenced him to a suspended sentence for theft. And two years later, in 1981, the Zhdanovsky District Court of Leningrad sentenced him under more serious articles of the Criminal Code: robbery in an organized group, fraud, involving minors in prostitution. He received 12 years and spent nine in the colony”.

Yvgeny Prigozhin epitomises the avtoritet breed of trans-national criminal and his history and dealings – particularly the founding of the Wagner group - exemplify the manner in which DATE’s notion of the hybrid threat can develop from humble criminal roots into the expansion of a full-fledged threat in an operational setting. As the criminal world become increasingly intertwined with commercial enterprise and become ever more reliant on, and enhanced by the recruitment of military and intelligence services personnel, the more urgent the need for a comprehensive strategy that takes into account the fact that contemporary transnational criminal groups are no longer simply bandits that operate across borders. The contemporary trans-national criminal enterprise that emanates from Russia, Eastern Europe and the Caucuses is now a highly sophisticated series of networks that have the ability to hide in plain sight while also operating in cyber space and execute their objectives by means of covert and direct action. They are manned at times by skilled experienced operators with military and intelligence service backgrounds and can be called upon by the state in many instances to carry out tasks on behalf of Kremlin interests with a dangerously effective amount of plausible deniability by Russian government officials.


Much could be said about just how dangerous the transnational criminal group could be to ADF personnel and operations and the plethora of potential threat activity is quite expansive. The most likely course of action for organised crime groups that has been seen in many conflicts is that of funding or facilitating of arms sales to certain belligerent groups that may be opposed to ADF and allied operations, and carrying out information operations or even committing outright violence against a civilian population to erode trust in the ADF or partnered forces including local government. During the Russian-Georgian conflict of 2008, many criminal elements operating in South Ossetia were employed to carry out ethnic cleansing operations to clear out any ethnic Georgians from the region. Perhaps one of the most dangerous courses of action from trans-national crime groups is the deliberate targeting of individuals like those of the Russian defectors who had attempts on their lives in the UK. Soldiers in transit to and from operational areas are particularly vulnerable and ROCL movements present a most opportune time for criminal groups to take action. Such action need not necessarily be violent in nature and could be as simple as drugging a soldier on leave or the use of honey traps to gain information or smear the reputation of soldiers, particularly those in command positions. The public smearing of key personnel can have the effect of undermining an entire mission and in the digital age, such information can easily be broadcasted through global mass media rapidly. Russian intelligence services have long been renowned for use of information (and disinformation) warfare in the form of character assassination and more recently using cyber warfare and social media platforms to discredit and delegitimise the Kremlin’s adversaries.  While much of the targeted violence is aimed at Kremlin dissidents and whistle-blowers, there is nothing stopping a hybrid criminal threat from directly targeting ADF personnel during opportune times of vulnerability.

Threat Mitigation

Of all the hybrid threats presented by the DATE, the threat emanating from the trans-national criminal group is arguably the most hybrid of these threats in its ability to work in sync with all other belligerents and stakeholders in the Operational Environment (OE). With an almost endless budget, the trans-national criminal organisation has far less constraints than any other group in the OE. While interfering with or clashing with ADF missions and personnel is extremely low on their list of priorities, the force that can be brought to bear on ADF missions is potentially catastrophic. As an increasing number of potential operations are likely to be in coastal urban areas – where many trans-national criminal enterprises operate - proximity to these criminal groups in theatre is going to be an important factor in operational planning and there is great need to be forewarned about their objectives, capabilities and networks prior to deploying any ground troops. The key in operating in such environments may be a precarious struggle to ensure that ADF operations do not interdict or intersect with the goals of criminal enterprises. This may need to be done by the highly irregular method of utilising direct channels of communication with these groups, perhaps drawing on assets from the Australian Federal Police (AFP) or Intelligence services to conduct a type of go between channel. While not being the most desirable course of action for anyone trained in the more conventional methods of warfare, the DATE has presented a complex array of stakeholders in the OE for the very reason of adjusting to present day threats and utilising a broader array of assets to achieve mission success.

Ultimately, the key to successful operations in such complex environments is to maintain a safe level of distance between criminal organisations and ADF personnel and missions. These two streams must be kept as far away from one another as possible and this will likely require a high level of diligence, a constant flow of information and possibly a level of limited interaction aimed at avoiding incident, for as the Old Russian proverb goes: Two bears cannot live in the same den.


Note from the Cove Team: This article first appeared on Grounded Curiosity in a different format.



Barry Laming

Corporal Laming served as a rifleman and French linguist in the 2nd Battalion Royal Australian Regiment. After discharging from full time service in 2013 he commenced study at Deakin University completing a Graduate Diploma in International Relations. He has also worked in the Defence Private sector and is presently an Infantry Section Commander in 5/6 RVR.


The views expressed in this article are those of the author and do not necessarily reflect the position of the Australian Army, the Department of Defence or the Australian Government.


Good article. Relevant and timely. Suggest that in Threat Mitigation the risk of criminal elements interfering with ADF missions is Low rather than Extremely Low with High Impact. The corruption and blackmail threat on operations and at home increases the risk exposure to insiders making security vetting and management problematic. Whilst maintaining a safe level of distance between criminal organisations and ADF personnel is a must, the threat actors will strive to minimise the distance, hence the importance of 'compromise training' for all.

Add new comment

Cove App


Fast access to The Cove anywhere, anytime. Additional feature of receiving notifications for new content.

Reflective Journal


Record your reflections in a structured way to improve your performance.