Traditional and non-traditional security: why the armed forces alone are not enough
Borders may be protected while a vital laboratory fails, a communications network stops or a hospital cannot maintain its services. Military capability does not become worthless in these circumstances. Rather, they show that protecting a state requires functions the armed forces cannot perform entirely, however effective they are. The practical question is how instruments of protection can complement one another without institutional responsibility becoming blurred.
On 23 March 2026, the World Health Organization published a framework for national public-health agencies' emergency preparedness and response capabilities, covering legal authority, financing, surveillance, laboratories and coordination. It is a general framework, not an assessment of Iraq. Its relevance to Iraq is that health preparedness is a distinct institutional capacity, not a function that can be created in full after a crisis begins. Source.
What does the distinction mean?
Traditional security here means protecting territory and sovereignty against armed coercion and threats associated with military force. Non-traditional security covers risks crossing sectors or borders, including health emergencies, critical-infrastructure failures and environmental or digital disruption. This is a working classification for assigning instruments and responsibilities. Some risks are longstanding or deliberate, and the label “non-traditional” does not make their effects less serious.
Problems arise when classification becomes complete institutional separation. An armed attack may interrupt electricity, which may halt water pumping, communications and healthcare; a health crisis may affect staffing across all these sectors. The issue is therefore functional interdependence, not an inventory of neighbouring risks. A solution confined to one sector may leave the cause of its failure beyond its reach.
This does not eliminate the military's distinct role. Border protection, deterrence and armed operations require dedicated institutions, training, equipment and command arrangements. Competence in those tasks does not automatically produce competence in running laboratories, regulating water or maintaining civilian networks. Each field has knowledge, authority and accountability systems that discipline alone cannot replace.
Why increasing armed strength is insufficient
The armed forces can support civilian responses through transport, engineering, protection and assistance where necessary and lawful. They cannot permanently compensate for weak service-producing institutions. If every routine interruption needs exceptional intervention, that intervention may relieve immediate harm without proving that the system reproducing the failure has been repaired.
Diverting military resources to a civilian task also has opportunity costs: personnel time, equipment maintenance and training for the original mission. These costs should be weighed against the need for support, not used to reject support categorically. Assistance may be essential in a major crisis; strengthening civilian prevention and routine operation reduces pressure on both sides.
Iraq's constitutional framework remains important: the armed forces operate under civilian leadership with an assigned defensive function. Emergency coordination should respect legal mandates, identifying who requests support, who leads the civilian function and when the exceptional mission ends. Clear boundaries speed cooperation by reducing disputes over authority at the point of need. Source.
Service interdependence changes priorities
Imagine a hospital with backup electricity but uncertain fuel deliveries, one communications link without an alternative and a limited supplier of an essential diagnostic input. Owning a generator does not prove preparedness. An enforceable supply agreement or a tested communications alternative might be more urgent than another device. This is a hypothetical illustration of an assessment method, not a report on a particular hospital.
The system can be examined in two directions. Start with a function that must continue and identify its dependencies; then start with an exposed resource and identify the functions its loss would affect. The first reveals a facility's needs; the second reveals shared vulnerabilities capable of affecting many facilities simultaneously. Assets spread across locations may all depend on the same provider, contract or connection.
This introduces a trade-off between efficiency and redundancy. Lower inventories and a single supplier may reduce normal costs while increasing disruption costs. More alternatives can support continuity but raise operating and coordination expenses. No reserve ratio suits every sector. The choice depends on likely disruption duration, severity of harm, restoration time and available funding.
What can be learned from Finland?
In January 2025, Finland adopted an updated Security Strategy for Society centred on protecting vital functions through cooperation among authorities, businesses, organisations and citizens, combining preparedness and response. The useful lesson is to organise complementary roles around defined functions. Copying the entire model into Iraq would ignore differences in administration, resources, trust and the ability to enforce commitments. Source.
A more practical approach begins with one function and a limited set of interdependent actors, then tests their cooperation arrangements. A memorandum or committee is insufficient. Each participant must know what it will provide under a defined condition, how it receives information and who may decide when the usual official is absent. This requires training and financing, not merely agreement that coordination matters.
Private firms have a role when they operate vital resources or services, but participation does not release public authorities from oversight. Contracts should specify minimum service, reporting obligations, continuity commitments and data-sharing limits. Community participation likewise needs understandable information and dependable reporting channels. People cannot prepare for a concealed risk or contradictory official messages.
A realistic route to testing preparedness in Iraq
Work could begin with a bounded compound scenario: electricity and communications disruption in an area containing a health facility and a water station. Essential functions would be identified, followed by a review of alternatives actually available, rather than merely listed on paper. An appropriate tabletop or operational exercise would then document delays and distinguish missing authority, resources, information and training. Each cause calls for a different response.
Exercises require limits preventing damage to services or unnecessary disclosure of sensitive information. The purpose is not to disable real infrastructure to demonstrate fragility, but to test decisions, communications and reserves proportionately. General findings and improvement plans can be published while protecting details that could facilitate attacks on facilities.
Measurement should focus on detection time, continuity of minimum functions, recovery time and access to services during the crisis. These are proposed indicators, not measured findings about Iraqi institutions. An exercise may show that a simple administrative change works faster than expensive equipment, or that additional meetings cannot resolve a genuine material shortage.
Who holds final responsibility?
Non-traditional security does not require one agency managing everything. It requires arrangements that make responsibility traceable. The competent institution continues to lead its function; coordination addresses intersecting mandates, and conditions for escalation are set in advance. If every actor waits for another, participation becomes a cause of delay rather than a source of capacity.
The conclusion does not diminish the armed forces. It locates them within a broader national capacity. Military defence remains essential against certain forms of coercion, while specialised civilian institutions prevent other shocks from collapsing public life. Integration is judged by lawful continuity, recovery and institutional learning, rather than the number of agencies attending a meeting.