Intelligence Analysis Management is the process of managing and organizing the analytical processing of raw intelligence information. The terms "analysis", "production", and "processing" denote the organization and evaluation of raw information used in a phase informally called "connecting the dots", thus creating an "intelligence mosaic". The information may result in multiple analytic products, each with different security classifications, time scales, and levels of detail. Intelligence analysis goes back to the beginning of history. Sherman Kent is often considered the father of modern intelligence analysis. His writings include a 1947 book, Strategic Intelligence for American World Policy. [1]
During his career in the Office of Strategic Services and the Central Intelligence Agency (CIA), Kent defined many of the parameters of modern analysis and its use. Kent disagreed with the philosophy that analysts never recommend policy, but only advise policymakers. [2] He considered it a partnership in which the analyst did not push a personal point of view.[2]
Recent[when?] scholarship drawing upon theories of the sociology of knowledge has criticized Kent's work for being over-positivist and for failing to recognize the role the identity and culture of the analytic unit play in formulating, accepting, and rejecting the hypotheses used to collect and analyze intelligence.[3]
Preprocessing
The intelligence process or cycle. Analysis is one of the processes in the cycle.
Some intelligence disciplines, especially technical ones, will analyze the same raw data in different ways for complementary purposes. For example, a signals intelligence collection platform will record all the electromagnetic signals it received from an antenna pointed to a particular target at a particular time. Assuming the target was radar, the ELINT analysts would be focused on the purpose and coverage of the radar. The MASINT analysts, however, would be looking for patterns not in the intentional signals of the radar or side frequencies that were inadvertently generated. In the same manner, if the target was a voice communication, the COMINT specialists would concentrate on the content of the message, but acoustic MASINT technicians might "voice print" the spoken words to validate that it was really from the supposed source. While Morse code telegraphy is largely obsolete, each operator has a distinct rhythm known as a "fist". Experienced telegraph intercept operators can recognize radio deception when the fist failed to match the purported operator identity.
A very basic preprocessing step is translating the collected material into the native language of the analysts unless, as is desirable, the analysts are fluent in the language of the information.
Basic intelligence and reference library services
Librarians at the CIA receive large numbers of documents, not counting special source materials, cables, newspapers, press summaries, periodicals, books, and maps. Since these reports come from scores of different major sources, the daily volume fluctuates and shows a lack of uniformity in format, in reproduction media, in length and quality of presentation, and in security classification. As they come in they must be read with an eye to identifying material of interest to some 150 different customer offices or individuals.
The reference office manages several registers (in effect special libraries) for special source materials, biographic data on scientists and technicians, films and ground photographs, and data on industrial installations. Demands made on the document collection stem from three types of requests:
Requests for a specific document to which the analyst has a reference or citation;
Requests for a specific bit of information in answer to a specific question;
Requests for all information relevant to a subject which may or may not be well defined.
The last, which requires literature search, is the most difficult. Where central reference services have been organized independent of research offices, it soon becomes evident that the functional line of demarcation between them and the research units is not clear. This becomes important when it results in duplication of effort or, in non-use of reference materials by the researcher laboring under the misimpression that they have all relevant documents in their possession. Increasing use of collaborative technologies can help this misimpression.
Then there is the question of whether a reference service should be active or passive, dynamic or static? A passive approach to reference service would mean that reference personnel would merely keep the stacks of the library in order, leaving it to research analysts to exploit the collection. Under the active approach, on the other hand, reference analysts would discuss the researcher's problem with them and then proceed, as appropriate, to prepare a bibliography, gather apparently pertinent documents, screen them, check with colleagues in other departments for supplementary materials, make abstracts, have retention copies made of popular items in short supply, initiate a requirement for supplementary field service, or prepare reference aids.
Once a separate facility has been set up to provide reference services it is not long before it publishes. This comes about for several reasons, the least controversial of which is that a customer has made a specific request. This type of publication is called a research or reference aid. Some are quite specific; others are more general, being prepared in response to a need generally expressed. A number of different customers may, for example, make known that it would be very helpful to have a periodic compilation of all finished intelligence reports and estimates for ready reference.
Reference officers have the responsibility to make known the availability of services and information the existence of which may be unknown to the analyst; and, given a task, to make the preliminary selection of materials to meet the particular need of a particular user. To the analyst must be left the determination of its significance for the present; to the consumer its significance for the future; and to the policy-maker the indicated course of action.
Intelligence personnel, as well as end consumers, need their equivalent of reference books and encyclopedias. The US term for this is "basic intelligence", while the WEU calls it "documentary intelligence". Much of this information may itself be unclassified, but their indexing and cross-referencing, especially if that cross-referencing includes classified sources, the index itself, and bibliographies drawn from it, may be properly classified.
One means of organizing basic intelligence is with the acronym BEST MAPS
T--transportation and telecommunications intelligence
M--military geographical intelligence
A--armed forces intelligence
P--political intelligence
S--scientific and technical intelligence
This is not a complete list, as the basic intelligence library also includes:
Maps, including "base maps" over which overlays can be placed
Biographical data, extensively cross-referenced; the UK term is "registry"
Graphics data
Targeting data, which may be considered basic data only by military units
As a practical matter, these may be collected into:
Country handbooks, at various levels of classification (e.g., the unclassified World Factbook)
Topical handbooks (e.g., international terrorist groups), again at varying level of classifications.
With modern technology, these collections may be web documents rather than hard copies.
Country handbooks
Unclassified examples of a country reference, in much shorter form than the internal handbooks, is the CIA World Factbook, the "Countries and Regions" data sheets from the UK Foreign and Commonwealth Office ,[5] and the US Department of State Background Notes.[6]
Closer to the internal reference books of the intelligence communities are the Foreign Area Handbooks,[7] originally prepared under contract to the US Army by American University, and later by the Federal Research Division of the Library of Congress. The Country Studies-Area Handbook Program was "sponsored by the U.S. Department of the Army. Because the original intent of the series' sponsor was to focus primarily on lesser-known areas of the world or regions in which US forces might be deployed, the series is not all-inclusive." At the time of original publication, there was a main unclassified handbook and a secret supplement, the latter dealing principally with biographical information. Area Handbooks had less restrictive distribution than the CIA National Intelligence Summaries.
Biographical references
Comprehensive indexing is the real value of a biographical registry. The names themselves are a challenge, with phonetic variations and aliases. Soundex is one technique for indexing names such that phonetic equivalents, with variations in transliterations into the local language, can be retrieved.
While there is no truly general solution, there has been considerable work in both in transliteration nonroman character sets. Soundex and related systems help search biographical databases by phonetics, but transliterated character sets allow people not fully fluent in the written language to search for names.
Relationships among the people in the biographical index are essential and constantly updated. One term of art used for relationships indices are "wiring diagrams".[8]
[9] The cycle of organizational activity for intelligence purposes extends from the collection of selected information to its direct use in reports prepared for policy makers. Between these beginning and end activities there lie a number of functions which can be grouped under the term information processing. These functions include the identification, recording, organization, retrieval, conversion into more useful forms, synthesis and dissemination of the intellectual content of the information collected. The ever-mounting volume of information produced and promptly wanted and the high cost of performing these manifold operations are forcing a critical review of current practices in the processing field.
Geophysical basic intelligence
Maps are obvious products, but in infinite variety, including simple outlines onto which specific information can be overlaid, and divisions by political jurisdiction, ethnicities and languages, terrain, etc. The line between maps and actual imagery grows increasingly blurry.
Online resources such as Google Earth are increasingly useful for other than the most detailed technical analysis. One challenge remains the indexing of maps in geographical information systems, since multiple projections and coordinate systems are used both in maps and in imagery.
Order of battle intelligence
Principally a military term, order of battle refers to the composition of an adversary's organization, including units, key personnel, equipment, and strength. In general, this is a form of basic intelligence, but is so important, and often so rapidly changing, that it may be assigned to a specific branch of an intelligence unit.
The term is also used for the organizational details of other aspects of opposition. For example, electronic order of battle is an inventory of the equipment, location, and operating signal characteristics of enemy transmitters, antennas, and other electronic equipment.
Current intelligence
A spectrum of activities falls under the term "current intelligence". At a minimum, a current intelligence facility receives raw or minimally processed reports, integrates them with information it has, and, depending on its mission, may support:
Tactical warning (especially military facilities that combine operations and intelligence), such as the North American Air Defense Command (NORAD) command post
Strategic warning and coordination (e.g., US Department of State Operations Center)
Situational awareness of continuing items of interest, for operational use (e.g., World War II UK Submarine Tracking Room)
Situational awareness of continuing items of interest, for policymaker information and more systematic presentations (e.g., US White House Situation Room).
One function of watch centers, at least those in agencies and commands with collection and surveillance capabilities, is to monitor the availability of sensors, scheduled patrols, etc. Part of the tactical surprise at the Battle of Pearl Harbor was that patrol aircraft were supposed to be aloft and the early radar station operating, but no watch center verified this—senior officers assumed it was being done.[10]
Intermediate in timeliness between tactical warning and situation awareness are 24/7/365 facilities that stay active on current matters. Perhaps the first modern watch center was the British submarine tracking center under Rodger Winn. This was the predecessor of the modern "all-source" center, where tactical reports, cryptanalysis, direction finding, and other functions came together to locate German submarines threatening Allied convoys.
Modern current intelligence facilities often use teleconferencing or videoconferencing to share information, such as the NOIWON (National Operational Intelligence Watch Officer's Network) that links the (US) National Military Command Center, National Military Joint Intelligence Center, State Department Operations Center, CIA Operations Center, State Department Bureau of Intelligence and Research, NSA Operations Center and White House Situation Room. Other units may join conferences when appropriate, such as the Federal Bureau of Investigation (FBI) Strategic Information and Operations Center (SIOC).
Other countries have similar networks, or sometimes a physical installation to which all affected agencies send representatives, such as the UK Cabinet Office Briefing Rooms "COBRA".
When a crisis is not necessarily of international significance, a subset may be all that is needed, such as the SIOC for multiple simultaneous prison riots. In the case of an aircraft hijacking without terrorist implications, the Federal Aviation Administration operations center may work with the SIOC, or with specific service components such as Coast Guard headquarters. The Coast Guard, other Department of Homeland Security offices such as Federal Emergency Management Agency, and technical specialists such as the United States Environmental Protection Agency or National Weather Service may join ad hoc operations.
While some of these contingencies may not immediately seem related to national security, the reality is different, in that a major natural disaster, such as Hurricane Katrina, will need significant military support. In North America, the Incident Command System, with variants all the way from local to the National Incident Management System, are common to emergency service organizations.
Major military commands often have operations centers, into which subordinate headquarters feed information, and higher commands are kept aware of the situation but not its details. They, in turn, feed information to their national levels. The US and Russia have exchanged liaison teams in their aerospace warning centers, and there are "hotline" communications between countries that may need to resolve crises, such the HAMMER RICK system between the US and Israel.
Indications and warning checklists
Indications and warnings are collated into "indications check lists" specific to particular countries and systems. For example, it might be routine for one country flying a given aircraft to launch formations on short notice, as part of its regular training. A different country might, due to shortages of fuel or maintenance personnel, rarely do formation takeoffs, and that would be indicative of an intended action. Some actions in one's own country or by one's own forces may trigger national-level alerts, such as an accident involving nuclear weapons, a major national disaster, etc.
Situation intelligence
Situation intelligence lies between the immediate and the moderate term. It draws on reference material, current intelligence, and raw information that is not directly relevant to a tactical goal. It gives policymakers an overview and context.
The Canadian Security Intelligence Service (CSIS) is especially[citation needed] good on publishing materials. An example of a situation study would be Commentary No. 70, The Threat from Transnational Crime: An Intelligence Perspective.[11] The Currently Listed [Terrorist] entities data base is another publication.[12]
During 2001-2002, a Scholar-in-Residence at the Sherman Kent Center for Intelligence Analysis, the “think tank” attached to the CIA’s training center for analysts, [13] was tasked with something new: using an outside scholar to study the process of analysis itself, especially how Information Technology (IT) was, and could be, used.
His "approach was to watch as many DI analysts as practical and ask them how they performed their work. We discussed what kinds of tasks were hard to do and what technologies or procedures seemed to work smoothly. We also talked about their own ideas about how they might use IT more effectively. For the sake of comparison, I also met with researchers at organizations that perform functions similar to those of the DI (e.g., other intelligence organizations; the Congressional Research Service; The Washington Post; and business risk assessment services). Finally, I drew on my own experience in business and non-government research institutions. I was able to watch the DI respond to the terrorist attacks of 11 September 2001 and ramp-up for the war on terrorism.
"I came away from this experience impressed by the quality of DI analysts, but also concerned about their lack of awareness of and access to new information technology and services that could be of critical value to their work. The DI has used automated databases since the 1970s and has gradually improved its capabilities. With the existing system, analysts can perform most searches for source documents from CIA archives at their desks and retrieve the documents electronically."
It is sadly worth noting, however, that CIA analysts still do much better than their FBI counterparts, who have difficulty accessing any external secure networks, or sharing the most sensitive data within their agency.[14] NSA, however, seems to be much more comfortable with using IT as a daily tool.
Agency internal databases continue to improve over earlier generations, but, in many respects, are inferior to commercial search engines. It should be remembered, however, that ease of use is not an absolute requirement. Some search engine human interfaces are "expert friendly" rather than "user friendly", allowing analysts with solid backgrounds in complex search strategies to be at their most efficient. One indicator of some system shortcomings is simply the fact that an important part of a DI analyst’s tradecraft is building an informal source network. A good analyst either knows someone, or “knows someone who knows someone,” at another office or organization who can get the information they need. A good analyst will use these contacts to develop more leads in the process. In the commercial world, these contacts are managed with CRM, ERM, or social networking software.
Agency policies and practices create five kinds of constraints that prevent the DI from acquiring new IT and using it effectively. In 2008, the US intelligence community A-Space may have broken through some of these constraints, or will break through in time.
Security and IT
Security is probably the single most important factor that prevents the DI from applying information technology more effectively. Security is essential for intelligence, of course. The problem is that, when it comes to IT, approach is not “risk management,” but “risk exclusion.”
Until recently, personal digital assistants were forbidden in high-security facilities.[13] There are some very specialized electronic security threats that could apply, so it may be that a secure PDA needs to be developed and provided. Even in government agencies with sensitive but unclassified information (e.g., personal health information covered by HIPAA), there has been a serious concern over information bypassing safeguards on tiny solid state disk equivalents, which can fit into pens. Other agencies, however, are addressing this problem by requiring the devices to store information in encrypted form, and using biometric identification. [15]
Such exclusionary rules also send an implicit message to DI analysts that information technology is dangerous and not essential for analysis. Analysts are, by the nature of their work, especially aware of security threats. So when they are told that a technology is potentially dangerous, their instinct is to avoid it unless absolutely necessary.
A laptop can be secured, but the security both has to be built-in, and maintained. Files need strong encryption. Multiple layers of security risk detection tools are needed. Biometric authentication will identify only legitimate users.
Security staffs must develop a better understanding of how analysts work. Rather than simply excluding technologies, their goal should be to develop methods of applying IT that are so user-friendly that DI analysts can operate securely with as few hindrances as possible.
The Defense Intelligence Agency (DIA) is an intelligence agency and combat support agency of the United States federal government, specializing in defense and military intelligence.
Open-source intelligence (OSINT) is the collection and analysis of data gathered from open sources to produce actionable intelligence. OSINT is primarily used in national security, law enforcement, and business intelligence functions and is of value to analysts who use non-sensitive intelligence in answering classified, unclassified, or proprietary intelligence requirements across the previous intelligence disciplines.
Defence Intelligence (DI) is an organisation within the United Kingdom intelligence community which focuses on gathering and analysing military intelligence. It differs from the UK's intelligence agencies in that it is an integral part of a government department – the Ministry of Defence (MoD) – rather than a stand-alone organisation. The organisation employs a mixture of civilian and military staff and is funded within the UK's defence budget. The organisation was formerly known as the Defence Intelligence Staff (DIS), but changed its name in 2009.
Measurement and signature intelligence (MASINT) is a technical branch of intelligence gathering, which serves to detect, track, identify or describe the distinctive characteristics (signatures) of fixed or dynamic target sources. This often includes radar intelligence, acoustic intelligence, nuclear intelligence, and chemical and biological intelligence. MASINT is defined as scientific and technical intelligence derived from the analysis of data obtained from sensing instruments for the purpose of identifying any distinctive features associated with the source, emitter or sender, to facilitate the latter's measurement and identification.
Intelligence assessment, or simply intel, is the development of behavior forecasts or recommended courses of action to the leadership of an organisation, based on wide ranges of available overt and covert information (intelligence). Assessments develop in response to leadership declaration requirements to inform decision-making. Assessment may be executed on behalf of a state, military or commercial organisation with ranges of information sources available to each.
The Bureau of Intelligence and Research (INR) is an intelligence agency in the United States Department of State. Its central mission is to provide all-source intelligence and analysis in support of U.S. diplomacy and foreign policy. INR is the oldest civilian element of the U.S. Intelligence Community and among the smallest, with roughly 300 personnel. Though lacking the resources and technology of other U.S. intelligence agencies, it is "one of the most highly regarded" for the quality of its work.
The Directorate of Operations (DO), less formally called the Clandestine Service, is a component of the US Central Intelligence Agency. It was known as the Directorate of Plans from 1951 to 1973; as the Directorate of Operations from 1973 to 2005; and as the National Clandestine Service (NCS) from 2005 to 2015.
The United States government classification system is established under Executive Order 13526, the latest in a long series of executive orders on the topic. Issued by President Barack Obama in 2009, Executive Order 13526 replaced earlier executive orders on the topic and modified the regulations codified to 32 C.F.R. 2001. It lays out the system of classification, declassification, and handling of national security information generated by the U.S. government and its employees and contractors, as well as information received from other governments.
Intelligence analysis is the application of individual and collective cognitive methods to weigh data and test hypotheses within a secret socio-cultural context. The descriptions are drawn from what may only be available in the form of deliberately deceptive information; the analyst must correlate the similarities among deceptions and extract a common truth. Although its practice is found in its purest form inside national intelligence agencies, its methods are also applicable in fields such as business intelligence or competitive intelligence.
Intellipedia is an online system for collaborative data sharing used by the United States Intelligence Community (IC). It was established as a pilot project in late 2005 and formally announced in April 2006. Intellipedia consists of three wikis running on the separate JWICS (Intellipedia-TS), SIPRNet (Intellipedia-S), and DNI-U (Intellipedia-U) networks. The levels of classification allowed for information on the three wikis are Top Secret Sensitive Compartmented Information, Secret (S), and Sensitive But Unclassified information, respectively. Each of the wikis is used by individuals with appropriate clearances from the 18 agencies of the US intelligence community and other national-security related organizations, including Combatant Commands and other federal departments. The wikis are not open to the public.
Intelligence cycle management refers to the overall activity of guiding the intelligence cycle, which is a set of processes used to provide decision-useful information (intelligence) to leaders. The cycle consists of several processes, including planning and direction, collection, processing and exploitation, analysis and production, and dissemination and integration. The related field of counterintelligence is tasked with impeding the intelligence efforts of others. Intelligence organizations are not infallible but, when properly managed and tasked, can be among the most valuable tools of management and government.
It is a maxim of intelligence that intelligence agencies do not make policy, but advise policymakers. Nevertheless, with an increasingly fast pace of operations, intelligence analysts may suggest choices of actions, with some projection of consequences from each. Intelligence consumers and providers still struggle with the balance of what drives information flow. Dissemination is the part of the intelligence cycle that delivers products to consumers, and Intelligence Dissemination Management refers to the process that encompasses organizing the dissemination of the finished intelligence.
National intelligence programs, and, by extension, the overall defenses of nations, are vulnerable to attack. It is the role of intelligence cycle security to protect the process embodied in the intelligence cycle, and that which it defends. A number of disciplines go into protecting the intelligence cycle. One of the challenges is there are a wide range of potential threats, so threat assessment, if complete, is a complex task. Governments try to protect three things:
The United States Intelligence Community A-Space, or Analytic Space, is a project started in 2007 from the Office of the Director of National Intelligence's (ODNI) Office of Analytic Transformation and Technology to develop a common collaborative workspace for all analysts from the USIC. It is accessible from common workstations and provides unprecedented access to interagency databases, a capability to search classified and unclassified sources simultaneously, web-based messaging, and collaboration tools. The Defense Intelligence Agency (DIA) is the executive agent for building the first phase of A-Space. Initial operational capability was scheduled for December 2007. A-Space went live on the government's classified Joint Worldwide Intelligence Communications System 22 September 2008. A-Space is built on Jive Software's Clearspace application.
This article deals with activities of the U.S. Central Intelligence Agency, specifically dealing with arms control, weapons of mass destruction (WMD) and weapons proliferation. It attempts to look at the process of tasking and analyzing, rather than the problem itself, other than whether the CIA's efforts match its legal mandate or assists in treaty compliance. In some cases, the details of a country's programs are introduced because they present a problem in analysis. For example, if Country X's policymakers truly believe in certain history that may not actually be factual, an analyst trying to understand Country X's policymakers needs to be able to understand their approach to an issue.
Words of estimative probability are terms used by intelligence analysts in the production of analytic reports to convey the likelihood of a future event occurring. A well-chosen WEP gives a decision maker a clear and unambiguous estimate upon which to base a decision. Ineffective WEPs are vague or misleading about the likelihood of an event. An ineffective WEP places the decision maker in the role of the analyst, increasing the likelihood of poor or snap decision making. Some intelligence and policy failures appear to be related to the imprecise use of estimative words.
The target-centric approach to intelligence is a method of intelligence analysis that Robert M. Clark introduced in his book "Intelligence Analysis: A Target-Centric Approach" in 2003 to offer an alternative methodology to the traditional intelligence cycle. Its goal is to redefine the intelligence process in such a way that all of the parts of the intelligence cycle come together as a network. It is a collaborative process where collectors, analysts and customers are integral, and information does not always flow linearly.
Richards "Dick" J. Heuer, Jr. was a CIA veteran of 45 years and most known for his work on analysis of competing hypotheses and his book, Psychology of Intelligence Analysis.The former provides a methodology for overcoming intelligence biases while the latter outlines how mental models and natural biases impede clear thinking and analysis. Throughout his career, he worked in collection operations, counterintelligence, intelligence analysis and personnel security. In 2010 he co-authored a book with Randolph (Randy) H. Pherson titled Structured Analytic Techniques for Intelligence Analysis.
The CIA publishes organizational charts of its agency. Here are a few examples.
An information security operations center is a facility where enterprise information systems are monitored, assessed, and defended.
↑ Pages 234-252 Jones, Milo L. and; Silberzahn, Philippe (2013). Constructing Cassandra, Reframing Intelligence Failure at the CIA, 1947-2001. Stanford University Press. ISBN978-0804793360.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
