Page 1

foreknowledge Essential Resources for Intelligence Analysts

Issue Four August 2012 ISSN 2225-5613

Horizon scanning…not just for futurists Futures analysis cooperation tool in the German Armed Forces Role of analysis in criminal investigations Analysis software: Beam us up Scotty!

IALEIA awards Reader survey results

News from around the world


Editor: Dalene Duvenage

From the editor



Horizon scanning…not just for futurists


4Knowledge Analysis Solutions

Futures analysis cooperation tool in the

PO Box 40467

German Armed Forces

Moreleta Park Pretoria

Analyst toolbox


With the cycle’s plug pulled - let’s plug into Counter intelligence


IALEIA Awards 2012


Analysis software: Beam us up, Scotty!


Contributions and advertising enquiries:

Meet Mario Eybers: financial sector intelligence analyst


Upcoming conferences



South Africa

The role of analysis in criminal investigations 16

Views expressed in articles are not necessarily those of

Intelligence analysis research


4Knowledge Analysis Solutions cc or of any executive member or director of the endorsing professional organizations unless expressly so stated.

In the news


Editorial submissions

Psychology of intelligence analysis # 4


AIPIO conference feedback


Authors contributing articles to Foreknowledge e-mag grant a licence to the publisher and its contractors from time to time to edit and publish the article electronically or by print or any other media.

Intelligence analytics


The role of analytics in professional development


Foreknowledge reader survey


Cover: Shutterstock

Endorsing organisations:

By contributing to the e-mag authors grant the publisher and its contractors from time to time an indemnity to the fullest extent permitted by law from all liability arising from their work. All authors are responsible for securing permission to use any copyrighted material, including graphics, quotations, and photographs, within their contributions. The publisher and its contractors from time to time disclaim any and all responsibility for copyright violations and any other form of liability arising from the content of the e-magazine or from any material linked to the e-magazine. Contributing authors will be notified immediately of any discovered copyright violations so that such issues may be dealt with promptly. No responsibility or liability will be accepted by the publisher and its contractors from time to time or any associated persons or entities to advertisers for the publication of advertisements that may be inaccurate or found to be contrary to law.

Association of Law Enforcement Intelligence Units

Association of Crime and Intelligence Ana-

4Knowledge Analysis Solutions CC (the “Publisher”) is the owner of all rights in terms of copyright related to any works embodied in this E-Magazine or its content, save for the works embodied in the advertisements and the literary works embodied in the contributions. No person may copy, reproduce, make an adaptation of, let, offer for sale or hire, import or export other than for private use, or distribute for purposes of trade the E-Magazine or any part thereof in any manner or form or cause or allow any person to commit any of the aforementioned acts in relation to the E-Magazine or any part thereof; without the express authorisation of the Publisher.

International Association of Law Enforcement Intelligence Analysts 2

Australian Institute for Professional Intelligence Officers

The Publisher, Authors and Advertisers reserve their respective rights in and to all works embodied in this E-Magazine. © 4Knowledge Analysis Solutions CC 2011 All rights reserved

August 2012 • Foreknowledge

from the editor Editor: Dalene Duvenage, Pretoria, South Africa I am writing and editing this 4th edition of Foreknowledge in the midst of the first snow in 50 years in Pretoria and flipping between channels to watch the London 2012 Olympics. Again, I’m reminded that perseverance and effort leads to success. I believe that Foreknowledge is on the same road of becoming the hub of all things related to intelligence analysis - our recent survey confirmed that thousands enjoy the content, and are willing to share their know-how with a wider audience. While involved in a recent Global Futures Forum event in Botswana, I was heartened by the willingness of experts from different disciplines across the globe to contribute to a better understanding of the future. Few analysts actually understand and apply basic foresight methodologies and I hope that the articles on Horizon scanning in this edition challenge you to change this. We start a new series on the role of analysis in criminal investigations, which has a lot of valuable lessons for intelligence analysts across all domains as well as a section highlighting current and recent research in intelligence analysis. We have feedback from the IALEIA and AIPIO conferences and highlight some upcoming events. There are also quite a number of interesting career tid-bits and our regular features on intelligence analytics and software. Enjoy!


Our contributors in this edition include intelligence professionals writing under pseudonyms as well these experts: Richards Heuer is a veteran intelligence scholar and analyst. He has written numerous books and resides in Monterey, California, USA. He gave us permission to summarise his book, Psychology of Intelligence Analysis.

Tony Nolan is a risk, intelligence and analysis officer in the Australian government.

August 2012 • Foreknowledge

Kathrin Brockmann is a futures analyst with the German Federal Armed Forces (Planungsamt der Bundeswehr) and an Associate with the "EU Security Foresight 2030" project at the Stiftung Neue Verantwortung in Berlin.

Mario Eybers is a mortgage fraud analyst at First National Bank, Johannesburg, South Africa

Brett Peppler is AIPIO President, Vice Chair of the International Association for Intelligence Education (IAFIE), and a member of the adjunct faculties of several universities.



Horizon scanning …not just for futurists Dalene Duvenage



ne of the absurdities of our profession is the forced distinction and separation between “tactical” and “strategic” analysts. Sometimes this separation is structural - separate divisions with different products and clients. The “strategic” analysts are viewed as the more important and “special” species, while the tactical analysts are left to churn out charts and memo’s that will keep the day-today investigations going. There is rarely any contact between the two, and usually the politics and competition in agencies make the relationship strenuous at best. Although we do not have control over structural and management issues, we do have a choice whether we want to become irrelevant or become a holistic analyst that is able to provide insight and foresight no matter what or who our target is. I believe that a strategic intelligence analyst cannot provide future-orientated analysis unless he/she also can understand and apply the nitty-gritty of operational/tactical intelligence tools and techniques. Surely, a strategic threat assessment would have much more impact on decision-making if it is 4

grounded in the realities experienced by our clients everyday. If it is based on the fantasy flights of a strategic analyst who is far removed from the harsh realities of the operational environment, it becomes totally irrelevant. Neither can a tactical analyst analyse the modus operandi of a terrorist group or organised crime syndicate unless he/she understands the political, social, economic, technological and legal context and future trajectories of the role players and the environment in which they operate. Very few of us can be good in both tactical and strategic analysis, but one should at least understand the nuances of both and aim to incorporate both into our daily task. Too many times intelligence analysts are criticised for shallow and narrow analyses that do not really reduce uncertainty for our clients. This happens when often only one variable - most of the times ignored by the analyst - changes the dynamics of the threat environment making your analysis either late or irrelevant to the decision-maker. The intelligence community is then caught unprepared for this eventuality, trying to play catch-up while

the targets are agile, taking the initiative and maintaining the momentum of surprise. But, there are analytical tools and techniques that you as an analyst can learn and apply to remain aware of what those variables are that might influence your analyses. One of these methods is Horizon Scanning, usually regarded as one of the tools used in Foresight or Strategic Warning. First, a little background: Foresight or Future Studies has become a discipline on its own. There are numerous futurists with thriving consultancies telling especially businesses and multinationals what might happen in the next 5, 10 or 50 years. Also, many governments have dedicated units providing foresight services, including the Netherlands, Finland, Singapore, Malaysia, Germany, Sweden, France, the EU’s iKNow project and the UK. They focus on science, technology, environmental, societal and economic issues and futures. Security and intelligence relevant foresight is conducted by various think tanks like the US’ National Intelligence Council (NIC) that is currently developing the Global August 2012 • Foreknowledge


Some say strategic foresight is only the task of a few brilliant visionaries in a separate institutional structure - far removed from the day-to-day stresses of the ordinary intelligence analyst. Nothing could be further removed from the truth… Trends 2030 document. The UK Ministry of Defence’s Development, Concepts and Doctrine Centre (DCDC) also conduct regular horizon scanning exercises. In a sense, these think tanks reinforce the notion that strategic foresight is only the task of a few brilliant visionaries in a separate institutional structure - far removed from the day-to-day stresses of the ordinary intelligence analyst.

Insight includes continuously scanning the present environment - literally actively looking for things, people, issues, trends etc that helps you to understand your threat and the factors that impacts on it. You might be aware of a similar term, “situational awareness”.

Nothing could be further removed from the truth…

Foresight deals with anticipatory intelligence - what we think might happen in the future. We could never know the future, but foresight tools improve our contextual understanding of the future space.

Whether your desk deals with financial crime, political risk of foreign governments, human smuggling or cyber crime, your main purpose as an intelligence analyst is to provide insight and foresight.

Horizon scanning is only one tool in the futures toolbox and is used in the beginning of the strategic foresight process. Its main aim is to research and collect information that will be used in further steps of the process.

August 2012 • Foreknowledge

It takes environmental scanning or situational awareness into the future: literally looking beyond the visible here-and-now to the unknown-unknowns. Horizon scanning aims to answer the following questions: What are the emerging trends and developments in the environment and the underlying dynamics? What are the signals/drivers that will change the future? The concept of horizon scanning is ill-defined and used in different formats by different scholars and foresight units. Our aim in the following few pages is not to critique these, but to offer you a simplified and practical guide on how to conduct horizon scanning on your desk. •



Futures Analysis Cooperation Tool in the German Armed Forces

Kathrin Brockmann is a futures analyst with the German Federal Armed Forces (Planungsamt der Bundeswehr) and an Associate with the "EU Security Foresight 2030" project at the Stiftung Neue Verantwortung in Berlin.



he need for decision makers to discern possible future developments in advance is not new, yet central in today's globalized world. The long-term oriented strategy development and planning processes in various organisations today reflect the aspiration of taking future developments into consideration. Hence, foresight or futures analysis represents an important part in the planning and development of the German Federal Armed Forces. The aim of futures analysis is not to predict, but instead, to systematically reflect on a range of possible futures and to derive implications and stimuli for strategic planning and further development. To achieve this goal, the German Federal Armed Forces have institutionalized foresight activities with an innovative supporting element, the Futures Analysis Branch in the Planungsamt der Bundeswehr. In order to fulfil its tasks, the Branch relies on four basic principles: (1) scientific interdisciplinarity, (2) creativity and freedom, (3) target-oriented products as well as (4) openness and cooperation. 6

To enhance internal and external cooperation and to strengthen the methodological fundament of its work, the Futures Analysis Branch currently develops a prototype of a web‑based foresight platform with‑ in the so-called Risk Assessment and Horizon Scanning Project (working title). The project intends to explore the development of a web-based cooperation tool to facilitate systematic horizon scanning and long-term analysis of the strategic environment. It specifically aims at strengthening the interdisciplinary and inter-institutional collaboration on foresight activities within Germany but also with partners worldwide. Expert knowledge and working results shall be shared. While the prototype is still under development, a testing phase with various project partners has started. The underlying research for RAHS comprised a comprehensive scanning of internationally applied foresight methods, inter alia based on the Z punkt Foresight Toolbox, the JRC Online Foresight Guide, the HSC Foresight Toolkit, the EU

research project webpage iKnow, the compilation on future research methodologies by Jerome Glenn (Millennium Project) or compendiums of Ulf Pillkahn. The final platform will be designed to: ●

Provide a toolbox of methods for security-related futures analysis that are (partly) supported by software,

Integrate decision-makers and experts in common projects, both, temporarily and continuously,

Offer the systematic filing of relevant sources,

Allow the presentation, common use and discussion of working results,

Serve as technical support for early-warning activities.

The prototype contains 9 functional units: 1) present projects, 2) trend database, 3) trend radar, 4) Source collection, 5) Scenario world 6) key factor data base 7) Yellow pages, 8) project archive and 9) hexagon of methods.

August 2012 • Foreknowledge

need2share The results of the platform-prototype will constitute the basis for the procurement of the final web-based tool, which will become a key vehicle for facilitating collaboration on horizon scanning and foresight activities within the German Armed Forces and likely well beyond. Yet, a lot of work has still to be invested implementing this ambitious project.

Fig. 1: Functional Units of the Platform As the variety of these functionalities illustrate, the integrated RAHS platform enters a new stage of foresight tools: Instead of only providing a single software solution, it allows accomplishing whole foresight projects with a variety of methods within a web 2.0 environment. The Hexagon of Methods (see Fig. 1 in the middle) is the main toolbox and thus the central element of the RAHS platform and shall be elaborated a little further. The hexagon contains all methods offered on the platform. Not all of them will be software-supported; however, all methods (about 40) will be explained and supplemented by an instruction or template. Software-supported methods include or will include for example: Brainstorming (Mind‑Map), Cross‑Impact‑Analysis,  Delphi (Online‑Delphi),  Environmental Scanning by STEEP/V, Explorative Scenario Construction, Impact-Uncertainty-Analysis, Plausibility Matrix, Strategic Options Evaluation, Trend Monitoring (Trend-Radar) and others. Methods not supported by software, but with guidance and templates for their use include for example Backcasting, Brainwriting, Fifth Scenario, Five Future Glasses, Future Conference, Future News, Future Wheel, Open Space, Seven August 2012 • Foreknowledge

Questions, SWOT Analysis, Scenario Writing and many more. Within the hexagon, all methods provided on the platform are categorized by their application in a foresight-process, from the research to the monitoring phase (see Fig. 2 below). Consequently, each method is allocated to at least one process step. As some methods can apply to several stages of a foresight process, they are allocated to more than one process step. So far, most of the scenario-related and software-supported elements in the hexagon have been implemented.

Instruments such as this platform are only a vehicle. Much will depend on organizations’ attitude and willingness to collaborate on foresight and horizon scanning activities and to engage in an in-depth exchange of information, expertise and best practices. Contact: Useful resources: Z_punkt (2010): Foresight Toolbox link JRC / ITPS - European Commission (2010): Online Foresight Guide. link Horizon Scanning Centre (HSC), Government Office for Science (2008): Foresight, Horizon Scanning Centre (HSC). link iKnow (2009): iKnow WiWe Bank. link Glenn, Jerome C.; Gordon, Theodore J (2009): Future Research Methodology, Version 3.0. The Millenium Project. Pillkahn, Ulf (2007): Trends und Szenarien als Werkzeuge zur Strategieentwicklung – Wie Sie die unternehmerische und gesellschaftliche Zukunft planen und gestalten.

Fig. 2: Hexagon of Methods



Analyst toolbox Horizon scanning Shutterstock

It would be presumptuous of me to offer a ”new” theory or model on horizon scanning. This is a practical method I designed to explain to analysts and their managers the concepts of mindfulness and awareness in my intelligence training. It works well for environmental and horizon scanning, OSINT collection and as a opener in debating the “tyranny of current intelligence”. I hope you find it useful! Dalene Duvenage

As previously stated, horizon scanning is used in either the first or second step of the foresight process, depending on whose theory you espouse. If you want to know more about those theories, have a look at the listed resources at the end of the article. First, a few ground rules might be in order: ● Set some time aside to introduce and practise this tool. As analysts become au fait with it, they will subconsciously practise it everyday as they collect and analyse intelligence every day. It might be an ideal team scanning exercise once a month and in the annual strategic planning and priority setting process. ● Foresight is by definition imprecise and relative - we can never know the future. The purpose here is to open your mind to things that you might not pick up otherwise. Horizon scanning is the ideal platform to apply “what-if analysis”, devil’s advocacy and challenge analysis. Do not be afraid to think outside the box and question your own and other’s assumptions. ● This method combines environmental scanning/situational awareness with horizon scan8

ning. The reason is that very few analysts can start thinking about the far future without first having a good look at the current situation. In training sessions, I found that at first, analysts feel insecure when dealing with the future, but they are more willing to engage the unknown when they feel emboldened by their expertise of the present. The dangers of expert opinion1 should be communicated and challenged continuously to ensure rigor in the exercise. ● The scanning is merely the means to have sufficient information to progress further in the foresight process. The identification of signals and trends should be followed up by proper analysis and interpretation. Step 1: Conceptualise a radar screen Conceptualise the environment in which your threat exists or your target operates as a radar screen. This is an easy metaphor as we are all familiar with how it works and how frantic the people in the movies get when something moves at a high speed towards the middle… not so dissimilar with us realising that an action or event in the distance has disastrous consequences on our immediate area of interest

Horizon Scanning is a structured and continuous activity aimed to “monitor, analyse and position” (MAP) “frontier issues” that are relevant for policy, research and strategic agendas. The types of issues mapped by Horizon Scanning include new and emerging: trends, policies, practices, stakeholders, services, products, technologies, behaviours, attitudes, “surprises” (Wild Cards) and “seeds of change” (Weak Signals). Rafael Popper

that we haven’t foreseen. Draw the radar screen so that you can visualise the different facets. Step 2: Frame the time and issue Both for time and sanity sake, it is better to limit the scope of your enquiry. Narrow down the issue so that it is manageable, but do not make it restrictive, otherwise you might lose out on valuable insights and opinions. It might be necessary that you pose various questions about your threat/target before you decide which one will suit your purpose best. During the exercise, people realise the interconnectivity of drivers and the exercise then again broadens - which is fine at later stages, but a nightmare at the start of the process. Decide beforehand what your timeframe for the enquiry is. Futurists August 2012 • Foreknowledge

toolbox have the luxury of looking at anything between 10 or 50 year time spans. Your timeframe might be 5 years at the most, depending on your purpose and your clients’ needs. Then, use the concentric circles of the radar screen as time frames: the one nearest to the centre is immediate/short term, the middle circle medium term and the outer circle will be the long term time frame. Depending on your need, you can define the time frames to whichever unit you want to: immediate/2 months/6 months or 1 year/3 years/10 years. Step 3: Gather information Gather information from a wide range of sources about current and future trends which might impact on your threat or target environment or subject of interest. To structure this foraging for information, it is useful to use the 5W’s and the H (who, what, where, when, why and how) in combination with (would, could, might), what-if and PESTELO as a guidelines: ● Politics: political and power

developments at international, intergovernmental, national and local levels ● Economic: economic activities

and developments at the global level, the macro level (economy) and the micro-level (business). ● Society: all socio-economic and

socio-cultural issues and trends, values, norms etc ● Technology: technological de-

velopments, research and innovation ● Environment: natural site fac-

tors: physical-geographic conditions, ecosystems and resources. ● Legal: regulatory and legal developments When doing OSINT research, combine words like innovation, emergAugust 2012 • Foreknowledge


ing, issues, impact, change, future, emerging, promising, threatening, solutions, discoveries, problems, crisis, tensions, growth, breakthroughs, breakdowns, or new insights in combination with the issue/threat/target keywords. Link up with experts and follow them on blogs and Twitter. Step 4: Spot signals and map it By this time it easy to cluster discovered things together that suggests patters or signals of developing trends that might impact directly or indirectly at different time frames - the so-called wild cards. Map them on the radar screen, in the appropriate time frame using colours to depict either its nature or its threat level. Step 5: Review and monitor This is a continuous and evolutionary process in which key assumptions and biases are critiqued. The value of such an reflective process needs to be exploited to enhance shared sensemaking. This is where the scanning process stops and where analysis starts to determine trends, conduct driver analysis and scenarios are build and policy options determined. But let’s rather

leave that for future editions of Foreknowledge… • See Philip E. Tetlock, Expert Political Judgment: How Good Is It? How Can We Know? (2005) and Dan Gardner, Future Babble: Why Expert Predictions Are Next to Worthless, and You Can Do Better (2011) 1

Resources: Kuosa,Tuomo (2012) The Evolution of Strategic Foresight: Navigating Public Policy Making, Book OECD International Futures Programme link Giannoulis, Alexios (2011) Intelligence Failure and the Importance of Strategic Foresight to the Preservation of National Security , Rieas Habegger, Beat (2009) Horizon Scanning in Government: Concept, Country Experiences and Models for Switzerland‘, (Zurich: Centre for Security Studies), link Strategic Trends Programme: Global Strategic Trends - Out to 2040 link Amanatidou et al (2012) On concepts and methods in horizon scanning: Lessons from initiating policy dialogues on emerging issues, link RAHS (2004). Risk Assessment and Horizon Scanning programme of Singapore Foresight's Horizon Scanning Centre Toolkit Jackson, Michael, Shaping Tomorrow, Practical Foresight Guide Lavoix, Helene (2010) Enabling Security for the 21st Century: Intelligence & Strategic Foresight and Warning link ERA Toolkit - iKnow Community FOR-LEARN Online Foresight Guide European Foresight Platform (EFP)



With the cycle’s plug pulled let’s plug into Counter intelligence Author: B (practitioner & scholar)


In the previous issue of Fore-

vulnerabilities and against

The counterintelligence process

knowledge, a plea was made to

external threats. The

Even from the preceding brief

pull the plug on the intelligence

compromising of information

description, it is clear that

cycle. This was based on the

through human negligence or

counterintelligence comprises of

central contention that the intelli-

insecure systems is an example of

several sub-processes executed

gence cycle does not represent

an internal risk. External threats

concurrently. For purposes of the

the way counterintelligence

are posed by a wide-array of

construction of a process model,


actors such as hostile intelligence

however, we need to reduce these

This contribution sets out to

structures of nation states and

to a concise, idealised

‘plug into’ counterintelligence.

various other entities.


This is done with a twofold,

It must be emphasised that

The ‘rudimentary’ outline of a

dovetailed aim. Firstly, to sub-

counterintelligence is so much

process model has actually been

stantiate the contention that the

more passive protection.

around for several decades – we

intelligence cycle does not reflect

Counterintelligence actively, and

just did not recognise it as such.

the way counterintelligence

preferably proactively, engages

Within state intelligence services,

works. Secondly, to move be-

intelligence opponents with the

this model is commonly referred

yond mere criticism and, by de-

aim of exploitation, disruption

to as Operational Security

fining and providing an outline

and neutralisation.

(OPSEC). In its conventional

of the counterintelligence proc-

To this ends counterintelligence

form, the OPSEC process explains

ess, advance a building block for

utilises a wide-range of methods

defensive counterintelligence but

a proposition on the all-disci-

and measures. These measures

lacks in conveying

pline intelligence process (in the

and methods can be deployed

counterintelligence’s offensive

next Foreknowledge edition).

defensively, offensively and the

mission. With the offensive

What is counterintelligence?

combination of these two. Hence

mission included and with the

Counterintelligence, in a nutshell,

the sword and shield analogy is

qualification that

protects valuable informational

frequently used to explain

counterintelligence comprises of

assets from internal


several concurrent sub-processes,


August 2012 • Foreknowledge

insight the counterintelligence process has

counterintelligence subdiscipline,

Within the context of the above,

the following essential elements:

counterespionage will essentially

you the reader will agree that the

1) Demarcate those critical

follow all of the above phases –

intelligence cycle is hopelessly

informational interests that

albeit with a distinctive pattern.

inadequate in conveying the

warrant counterintelligence

This distinctive pattern will be

essence of counterintelligence.

actions ;

especially apparent at Phase Five

Accepting that intelligence cycle

during which counterespionage

(in its myriads of mutations) is an

danger’) posed by adversaries

will have the following ‘sub-

attempt to explain positive

and changes in the


intelligence and not

2) Appraise the threats (‘external

counterintelligence, is an excellent

environment; 3) Identify and assess own

Identify espionage adversaries

vulnerabilities: 4) Appraise existing

start for constructing a process model that explains both. This is explored in the next edition of

Prioritise espionage adversaries

Foreknowledge. •

counterintelligence measures; 5) Develop, adjust and implement defensive and

Investigate espionage adversaries

and Mike Hough, 2011, The concep-

offensive countermeasures; and

tual structuring of the intelligence and

Engage CE targets

6) Continually assess and adapt

– quo vadis?

Exploit CE targets

clarification. As an offensive

August 2012 • Foreknowledge

Strategic Review for

Southern Africa, vol. 33, no. 1, pp.29-77. Download here. (10MB

processes cannot be discussed here, one example is necessary for

the counterintelligence processes: enduring holy grails or crumbling axioms

counterintelligence measures. While all the different sub-

Article based on Petrus Duvenage


Neutralise & terminate



International Association for Law Enforcement Intelligence Analysts Awards for 2012 Organization making the most significant progress utilizing intelligence analytical techniques to support law enforcement objectives on national & international level

Individuals for outstanding contributions as intelligence analysts to the achievement of law enforcement objectives

New Zealand Police

Julia Burger and Annemarie Morrison

National Intelligence Centre

New Zealand Police Pike River Coal Mine explosion Annemarie Morrison

“Sequence of Events” document

Sue Budworth and Gary Willliamson Northfolk Constabulary (UK)

Executive or supervisor for outstanding support and recognition of the intelligence analysis function Mark Evans

Analytical functions in burglary Sue Budworth

series involving 11 police forces across UK

Director, National Intelligence Centre

Alicia Reitter MAGLOCLEN

New Zealand Police

Strategic Threat Assessment on the Mara Salvatrucha (MS-13) Street Gang Alicia Reitter

Organization making the most significant progress utilizing intelligence analytical techniques to support law enforcement objectives on regional/state/province level Pittsburgh Bureau of Police Criminal Intelligence Unit & Bureau of Alcohol, Tobacco, Firearms and Explosives, Philadelphia Field Division Group V Intelligence, US

Keith Jackson, Jon Jeffrey & George Adamson

Keith Jackson

Gloustershire Constabulary Headquarters (UK) Strategic Threat Assessment on the Mara Salvatrucha (MS-13) Street Gang

Jarek Jacubcek & Garda Síochána Northern Ireland Software that enhanced the identiJohn Smith (LEIU) - Kelly Heim (ATF) - Ashley Thompson (Pittsburgh) - Jenny Johnstone (IALEIA)

Jarek Jacubcek

fication of stolen items sold on the Internet

Read more here 12

August 2012 • Foreknowledge

IT tools

Beam us up, Scotty! A budget version of DCGS-A for those outside the US Army by RJG

RJG The Distributed Common Ground System – Army (DCGS-A) for those of you who do not know - is the US Army’s primary battlefield intelligence system supporting ISR requirements. According to the DCGS-A project website, the system has access to 53 million intelligence documents from more than 300 sources dating back to 2004. DCGS performs multi-INT processing of data and information received from a multitude of different sensor types. Let me compare it with existing intelligence management and analysis tools: remember those Star Trek episodes from back in the 70’s with the retro uniforms and props?...... Now compare this with Star Wars Attack of the Clones and you get a pretty good picture relating to the differences in resource accessibility between analysts using DCGS-A and us mortals who do not have access to it. The ability to process, exploit and disseminate (PED) intelligence, surveillance and reconnaissance (ISR) data efficiently is an important aspect of running successful operational intelligence capability, especially if this is coupled with targeting processes such as F3EA (find, fix, finish, exploit, analyse). In scenarios where analysts support operations countering a low contrast enemy or operating in an asymmetrical threat environment, questions arise as to how one supports PED under budgetary constraints making do with

August 2012 • Foreknowledge

COTS (Commercial of the shelf) analytical software suites. In addition, the adoption of mobile phone technology worldwide and the popularity of social media networks have created an easy communications channel for both licit and illicit economic activity. Mobile phone networks are pervasive across the globe. With the right tools and techniques, it also provides a good source of information for nodal analysis and deriving patterns of life and monitoring activities of groups and persons of interest. Various systems are available for “crowd sourcing” or tapping into valuable information residing in communities. Combining or fusing this with other SIGINT, HUMINT and OSINT provides for a rich Multi-INT capability. I can think of a couple of commercially available analytical tools, which would be capable of supporting Patterns of Life and nodal analysis. Granted, an analyst building patterns of life would need to have a good understanding of data structures to make them suitable for analysis in these analytical tools. As an example, you are tasked with analysing the activities of a group of individuals in a given geographical area. Pattern of Life analysis is possible by preparing the following data and information from sources such as: ● Community based information derived from crowd sourcing

systems (there are some good open source systems available) ● GRPS signature information from mobile phone data of your subjects of interest (Geocoding base station locations as subjects move around – assuming you have access) ● HUMINT available about your subjects ● Open source information relating to the schedules and routes of the general community in the area of interest ● Video data of the area sourced from CCTV or UAV’s ● In some instances Ground Surveillance Radar data can also be included. It is important to make sure that you have adequate metadata, especially relating to your video material. By layering your data from your various sources, you will be able to subject it to timeline analysis and build a usable pattern of life. With the right tools and training analysts can be placed as far forward as possible to provide a PED capability for operational units and do not necessarily have to be placed centrally. A small budget is not always a showstopper. For those of you who use DCGS – may the force be with you! Can Scotty please beam the rest of us up! •



Meet Mario Eybers: financial sector intelligence analyst Mortgage fraud analyst, First National Bank, Johannesburg, South Africa

What is the role and function of Intelligence Analysts in your agency? Although it does not differ much from that of an analyst working within the Law Enforcement Environment, the bank is a private entity. From an analytical perspective, we need to make sure that we provide an efficient and cost saving fraud risk management solution to the organization and achieve our client service objectives. Who are your clients and what type of products do you provide to them? Our clients are primarily the investigating officers and management. We undertake analysis of evidence/data, conduct in-depth case analysis, prepare evidence for prosecution, analyse trends for Home Loan / asset based fraud and revenue recovery and are in-

volved with implementing and managing anti-fraud programs. Our business unit is still new, but I am sure that as we mature, our analysts will provide analytical products and services that really improve the clients’ decisions. At my previous employer I introduced seasonal indexes as a tool to measure and forecast crime, this was very successful and now a number of organizations within the industry are utilizing these. What is your specialist area and what do you do to stay informed and abreast of new developments? Currently I am more focused on mortgage fraud simply because this is the area that I find myself in. However, this is just a topic of interest; what remains more important is that from an analytical perspective I continue to research and acquire as many analytical techniques as possible and actively search for opportunities to implement and practice these techniques. I also participate in webinars and am currently enrolled in online courses with the International Association of Crime Analysts.



Last year I utilised Bayesian Analysis in one of my products to a client. This technique is advocated more in the intelligence environment than in the crime analysis environment, yet if you are to become a well rounded analyst you cannot argue that some analytical techniques are for the exclusive utilization of specific professions.

What are the greatest challenges you face as an analyst and how do you overcome them? Generally there are a number of challenges faced by all crime and intelligence analysts. The main one may be that we become complacent and have become accustomed to products that are not necessarily on par with the best. When we think of analysis we tend to think of things such as link analysis, detailed billing analysis or profiling, whereas these are all just forms of analysis and provide no indication of the relevant analytical technique that was applied to produce the analytical product. It is my opinion that we as analysts still have a long way to go and should concern ourselves with the challenges faced by our clients rather than the challenges we are faced with on a daily basis. We need to understand the requirements of our clients and become relevant to them. What can intelligence analysts do to promote our profession? Become the best at what he or she does because that is what the client demands. You can do this by becoming familiar with the various analytical techniques available and understand the needs of our clients. The analyst must also ensure that he assist the client to articulate those needs into world class products and provide guidance in the application and implementation of any recommendations stemming from those analytical products. •

August 2012 • Foreknowledge





August 2012 Innovation in border control workshop

21 - 22 August 2012 Odense, Denmark

curity OSINT & se informatics symposium

OSINT & web min ing symposiu m

2012 27 & 28 August Istanbul, Turkey

21 - 22 Au gust 2012 Odense, De nmark Informatio

Information here

re Information he

n here

September 2012

IALEIA regional intelligence training conference

ACFEA Global intelligence forum

Geospatial Defence & intelligence Asia

21 - 22 September 2012

Intelligence Analyst in the Digital Society

Brussels, Belgium

17-20 September 2012

Information here

Legionowo, Poland

11-14 September 2012 Thailand Information here

Information here and here

Novem be

012 2 r e b o

Oc t

ow Need to kn c n confere e

2012 16-17 October ark Odense, Denm re Information he

December 2012 Australian Security and Intelligence Conference

International Crime and Intelligence Analysis Conference

3-5 December 2012

13-14 December 2012

Perth, Australia

Manchester, UK

Information here

Information here

August 2012 • Foreknowledge

Intelligence in the Knowledge Society

19 October 2012 Bucharest, Romania Information here

r 2012

3rd International Congress of Intelligence

14 November 2012 Barcelona, Spain Information here

2013 ● International Studies Association Annual Convention: 3-6 April 2012, San Francisco, US: info ● IALEIA/LEIU Annual Training Conference, Chicago, US, 8-12 April 2013, info ● International intelligence, forensic sciences and surveillance conference, Istanbul, Turkey, 25-27 April 2012: info ● AIPIO annual conference, Canberra, Australia, 24 - 26 July 2013 info 15


The Role of Analysis in Criminal Investigations Mario Eybers


ost intelligence analysts and investigating officers will be able to point out that when dealing with information during an investigation, it is important to consider the collection, collation, analysis and dissemination of information. However, this does not mean that when the investigation team and particularly the analyst follow this basic approach, the investigation is intelligence-driven. Ensuring that there is a significant contribution by the analytical service towards making the investigation truly analytical or intelligence driven requires a much more focused as well as active participation from the investigative team. Investigation teams and for that matter, investigating officers, can no longer forward information to the analyst and expect quality analyses without themselves getting involved in the analytical process. Let us look at some characteristics of criminal investigations and projects that are not truly intelligence driven: ● Investigations and projects where the role of the analyst remains ring fenced to the analysis of information only. ● The analyst does not act as manager of information and there is no consultation and planning 16


Mario, who is also our “Meet the Analyst” in this edition, will share with us in the next few issues of Foreknowledge how intelligence analysts can be more effective in investigation and other teams. In this first instalment, he looks at what factors contribute to a successful analytical driven investigation.

for analysis between the analysts and investigating officer. ● Verbatim assessments of available information with very little focus on an approach to deal with the collection and analysis of information. ● The analyst takes sole responsibility for the analysis of information and consultation is not encouraged. ● No indication from the analyst what intelligence approach was followed or analytical techniques applied during the analysis of information. ● There is very little opportunity for the investigating officer to review analytical working papers. ● Analytical products mostly consist of link charts covering areas such as travel, communication and relationships with reports mostly covering the status quo. ● The investigation team is not debriefed. ● Analytical support and services are not evaluated. ● No assessment of analytical successes and failures.

August 2012 • Foreknowledge


It does not mean that an investigation is analytical or intelligence driven simply because an intelligence report is produced to achieve a particular objective. What are those factors that contribute to a successful intelligence or analytical driven investigation? 1. The intelligence or analytical approach chosen by the investigating officer and analyst. This is one of the very first decisions that must be made by the analyst in consultation with the investigating officer. There can be no review of the analytical service if a particular approach has not be chosen and documented. 2. The quality and frequency of interaction between participants in the investigation and the ease with which role players can scrutinize and access the analytical process, work tools and products. 3. The willingness of the investigation team to participate in certain aspects of the analysis process. Even the analysis of something as simple as travel records or telephone records require careful planning from the side of the analyst and investigative team. The analyst cannot decide on his own what as aspects of a particular set of in-

My name is Bess Puvathingal, and I am a doctoral candidate in the psychology program at Temple University, working under Dr. Richard Immerman (former ADDNI/AIS at ODNI). I have a MA in behavior analysis from University of Nevada, Reno and am a fellow with the Truman National Security Project. I am writing to request your participation in my online experiment -- an analytic exercise that should take approximately 1 hour to complete -- if you are: a professional with experience working as an intelligence analyst (current or former) in the USA OR a student (undergraduate or graduate) in the USA with no professional experience working as an intelligence analyst My dissertation explores how individuals make assessments and solve complex problems in the realm of intelligence analysis. Your participation will allow us to better understand the analytic process and contribute to our research goal of improving analytic products. The study does not ask for your name or contact information - so your participation will reAugust 2012 • Foreknowledge

formation will be analyzed, input from the investigating officer or team is crucial. This in turn is dependent on the analytical knowledge of both the analyst and investigation team as well as the suitability of analytical techniques to a particular set of data. 4. The analytical role is extended to include manager of information and the analyst actively participates to promote and deliver this service to the investigation team. 5. There is some form of review to determine the quality of the entire intelligence and information management process. In the upcoming articles I will discuss the evaluation the analysis function in an investigation, the role of the analyst during an investigation, how to plan for analysis during investigation and project initiation, analytical approaches, normal event reconstruction with the criminal value chain superimposed on events and analytical plans and scenario planning for investigations. •

main completely anonymous. If you would like to participate in this research, please access the experiment by clicking on the link and using the login/password below. The experiment will run until 30 September 2012. **Please note: The experiment should be completed in 1 sitting. When you are ready, this web exercise works best in Mozilla Firefox. Please maximize your browser window to full screen before accessing the study below. Access Information for INTELLIGENCE ANALYSTS: web address: login: foreknowledgeanalyst password: iowa Access Information for STUDENTS: web address: login: foreknowledgestudent password: iowa I would be grateful if you have time in the next couple of weeks to participate in my experiment. Thank you in advance for your consideration, and please do not hesitate to follow up with me at if you have any questions! 17


Share with us your research on issues, tools, processes etc to build the interdisciplinary body of knowledge in our field.

Intelligence analysis


Illuminating dark networks: a social network analysis of an Australian drug trafficking syndicate: David A. Bright, Caitlin E. Hughes and Jenny Chalmers. Crime, Law and Social Change, Volume 57, Number 2 (2012), 151-176 Paid subcription A small but growing number of analysts of criminal activity have used social network analysis (SNA) to characterise criminal organisations and produce valuable insights into the operation of illicit markets. The successful conduct of SNA requires data that informs about links or relationships between pairs of individuals within the group. To date analyses have been undertaken with data extracted from offender databases, transcripts of physical or electronic surveillance, written summaries of police interrogations, and transcripts of court proceedings. These data can be expensive, time-consuming and complicated to access and analyse. This paper presents findings from a study which aimed to determine the feasibility and utility of conducting SNA using a novel source of data: judges’ sentencing comments. Free of charge, publically accessible without the need for ethics clearance, available at the completion of sentencing and summary in nature, this data offers a more accessible and less expensive alternative to the usual forms of data used. The judges’ sentencing comments were drawn from a series of Australian court cases involving members of a criminal group involved in the manufacture and distribution of methamphetamine during the 1990s. Feasibility is evaluated in terms of the ability to produce a network map and generate the types of quantitative measures produced in studies using alternate data sources. The utility of the findings is judged in relation to the insights they provide into the structure and operation of criminal groups in Australia’s methamphetamine market.

If you’re an American intelligence analyst, please complete Bess Puvathingal’s survey for her research on how individuals make assessments and solve complex problems in the realm of intelligence analysis here

Identifying new forms of money laundering: Brigitte Unger & Johan den Hertog, Springerlink Criminals seem to switch from the more controlled banking sector into still less controlled parts of financial markets, and from financial markets to other sectors. These new sectors include electronic payments, trade and real estate. The paper shows how one can empirically approach the latter two by using economic information of unusual prices and other characteristics in order to identify the amount of laundering in these sectors. Combining economic information with criminological data facilitates the development of a new tool for identifying money laundering in some important sectors.



August 2012 • Foreknowledge


Rethinking threat: intelligence analysis, intentions, capabilities, and the challenge of non-state actors: Charles Vandepeer, University of Adelaide, Australia. 2011 PhD thesis The core argument of this thesis is that the conventional model used by intelligence agencies is too simplistic to capture the nature and complexity of non-state threats. By articulating an ontology, epistemology and methodology of threat and threat assessment, this thesis moves beyond an uncritical acceptance of the conventional model of threat. The study demonstrates how the model of threat, used and reinforced by intelligence agencies within a Cold War context to assess threats from clearly defined states, has become the primary approach to assessing threats from often ill-defined and amorphous non-state actors. The study specifically focuses on intelligence analysis within the United States, the United Kingdom and Australia which have all demonstrated an acceptance and use of the conventional model of threat against both state-based, and most recently, non-state threats.

Improving Intelligence in a Counterinsurgency or Counterterrorism Environment Through the Application of a Critical Thinking-Based Framework: James Henry Hess, Louisiana State University, US. 2011 PhD thesis The intelligence community is responsible for providing competent analysis and assessments pertaining to the many significant geo-political situations that may potentially or do effect the nation’s interests. The intelligence community has always experienced challenges living up to that charge, and while it may merely be a case of the nature of the profession, there are always lessons that can be learned and processes that may improve the analytical processes. Critical thinking is a cognitive process that may be able to provide that improvement to the analytical processes, and when an analytical framework is built by applying these cognitive skills, the analytical effort may become more focused and meaningful. This study examined an intelligence analysis framework that was built using specific cognitive critical thinking skills. It was demonstrated that intelligence analysis did improve, specifically with the novice analysts that participated, and there was demonstrated specificity in the respondents’ analyses. A panel of experts provided insight and content assurance that demonstrated the intelligence analysis and products produced were valuable for operational usage. Finally, successful historical counterinsurgencies were examined in relationship to the analytical framework that was utilized in order to understand how this analysis can lead to operational success.

Whither Iraqi Democracy: an Analysis of Competing Hypotheses (ACH) study on the nature and direction of Iraqi politics, Joshua Sholander, American Public University System, Charlestown, West Virginia. US. 2012 Masters thesis The future of democracy efforts in Iraq is uncertain. An accurate hypothesis regarding the future direction of Iraqi democracy will better equip policy makers as they evaluate the true efficacy of foreign aid, military involvement, and humanitarian assistance. This study will apply an Analysis of Competing Hypotheses framework to three basic hypotheses: 1) In the coming decade, Iraq will resolve its current differences and participate in a liberal, Western style democracy. 2) In the coming decade, Iraq will be unable to resolve the current conflict and a strong, central party or leader will emerge as the ruler of a nominally democratic Iraq. 3) In the coming decade, Iraq will descend into civil war which will result in its partitioning into three independent states (Kurdish, Sunni, and Shia). The evidence analyzed in this study will express which hypotheses are more and less plausible and aid in forecasting future directions in Iraqi politics.

August 2012 • Foreknowledge


Hackers, help us! In July 2012, the head of the American government's National Security Agency, General Keith Alexander, took the unprecedented step of asking a convention of computer hackers to join him in an effort to make the internet more secure and help developing new tools. "You're going to have to come in and help us," Alexander told thousands of attendees of Defcon.

EU workshop On 10 and 11 May 2012, CEIS, Hawk and the EUROSINT FORUM organised a workshop in Brussels. The objective of this first meeting was to share experiences and best practices with intelligence analysts regarding the management of cognitive biases impacting intelligence analysis. 17 analysts coming from intelligence agencies and administrations in Member States and in European institutions attended the workshop.

Economic espionage In a July 2012 statement to the US Senate Subcommittee on Counterterrorism and Intelligence, Assistant FBI Director Frank Figiluzzi said that "economic espionage losses to the American economy total more than $13 billion."

US Army analysts’ IT heaven! An intelligence effort being advanced by each of the US military services is promoting more complete intelligence analysis, better collaboration across the services and faster delivery of actionable intelligence to support combat operations. Each military service is developing its own version of the Distributed Common Ground System (DCGS), a U.S. Defense Departmentdirected initiative to create a common framework for analyzing and sharing intelligence. This state-of-the-art battlefield intelligence, reconnaissance and surveillance architecture will enable analysts from every service to take data from multiple military and government sensors and databases and compile them into a single, easy-to-access format. This allows Army analysts to see connections that they could never see before. They


can do a very powerful analysis, because they see the entire picture. Fuelling that powerful analysis is cloud technology. DCGS-Army represents the military’s first tactical deployment of a cloud node, which brings enormous storage and computing power to analysts’ fingertips, with some 60 million text reports in less than a second. The result is improved situational awareness for commanders in the theater, who can task battle-space sensors and receive intelligence from multiple sources, and for troops on the ground whose lives depend on complete, accurate data. The real power of DCGS is very powerful analysis and very powerful collaboration, It’s a big step toward incorporating analytic products through a common framework.” Read more here. Also read our IT Tools article here

August 2012 • Foreknowledge

Turkey conference In June 2012, the Turkish National Intelligence Organization (MİT) held a conference titled “ICINTA-12 International Conference on Intelligence Analysis 2012: From Intelligence to Policymaking, Intelligence Analysis for Policy Executives,” attended by Turkish and foreign academics, experts, think tanks, civil and military bureaucrats. Read more here

In the news 35% of Indian companies involved in espionage Corporate espionage is a booming industry in India, according to a June 2012 report by Associated Chambers of Commerce and Industry of India. And it’s being fuelled by executives spying on their rivals as well as their own employees. “Over 35 percent of companies operating in various sectors across India are engaged in corporate espionage to gain advantage over their competitors and are even spying on their employees via social networking Web sites.

Indian economic intelligence school planned

1st African Fusion Centre Uganda and other countries in the Great Lakes region have opened up an intelligence fusion centre in the Democratic Republic of Congo (DRC) to coordinate their efforts against negative forces. The centre was opened by eleven countries under the auspices of the International Conference on Great Lakes Region (ICGLR) in Goma in June 2012. The member countries of the regional block will utilize the centre to share intelligence information on the armed rebel groups in the region and take collective action to eliminate the negative forces.

August 2012 • Foreknowledge

In a move to strengthen the Indian Central Economic Intelligence Bureau (CEIB), the financial intelligence gathering department under the Ministry of Finance, the government is working on setting up a school of economic intelligence to impart skills to its officials in the area of economic intelligence. The school is envisaged as a multidisciplinary institution to be used for imparting skills in collation, analysis and dissemination of intelligence.



Psychology of intelligence analysis Richards Heuer There are still thousands of intelligence analysts and their managers who have not yet read the seminal Psychology of Intelligence Analysis by Richards Heuer. We will carry excerpts from the book’s chapters in each edition of Foreknowledge. This is an excerpt of chapter 4 on Strategies for Analytical Judgment - situational logic. You can also download the entire book here. When intelligence analysts make thoughtful analytical judgments, how do they do it? In seeking answers to this question, this chapter discusses the strengths and limitations of situational logic, theory, comparison, and simple immersion in the data as strategies for the generation and evaluation of hypotheses. Intelligence analysts should be self-conscious about their reasoning process. They should think about how they make judgments and reach conclusions, not just about the judgments and conclusions themselves. Webster's dictionary defines judgment as arriving at a "decision or conclusion on the basis of indications and probabilities when the facts are not clearly ascertained." Judgment is what analysts use to fill gaps in their knowledge. It entails going beyond the available information and is the principal means of coping with uncertainty. 22

It always involves an analytical leap, from the known into the uncertain. Judgment is an integral part of all intelligence analysis. While the optimal goal of intelligence collection is complete knowledge, this goal is seldom reached in practice. Almost by definition of the intelligence mission, intelligence issues involve considerable uncertainty. Thus, the analyst is commonly working with incomplete, ambiguous, and often contradictory data. The intelligence analyst's function might be described as transcending the limits of incomplete information through the exercise of analytical judgment. The ultimate nature of judgment remains a mystery. It is possible, however, to identify diverse strategies that analysts employ to process information as they prepare to pass judgment. Analytical strategies are important because

they influence the data one attends to. They determine where the analyst shines his or her searchlight, and this inevitably affects the outcome of the analytical process. Strategies for Generating and Evaluating Hypotheses This book uses the term hypothesis in its broadest sense as a potential explanation or conclusion that is to be tested by collecting and presenting evidence. Examination of how analysts generate and evaluate hypotheses identifies three principal strategies 1) the application of theory, 2) situational logic, and 3) comparison each of which is discussed at some length below. A "non-strategy," immersion in the data and letting the data speak for themselves, is also discussed. This list of analytical strategies is not exhaustive. Other strategies might include, for example, proAugust 2012 • Foreknowledge


jecting one's own psychological needs onto the data at hand, but this discussion is not concerned with the pathology of erroneous judgment. Rather, the goal is to understand the several kinds of careful, conscientious analysis one would hope and expect to find among a cadre of intelligence analysts dealing with highly complex issues. Situational Logic This is the most common operating mode for intelligence analysts. Generation and analysis of hypotheses start with consideration of concrete elements of the current situation, rather than with broad generalizations that encompass many similar cases. The situation is regarded as one-ofa-kind, so that it must be understood in terms of its own unique logic, rather than as one example of a broad class of comparable events. Starting with the known facts of the current situation and an understanding of the unique forces at work at that particular time and place, the analyst seeks to identify the logical antecedents or consequences of this situation. A scenario is developed that hangs together as a plausible narrative. The analyst may work backwards to explain the origins or causes of the current situation or forward to estimate the future outcome. Situational logic commonly focuses on tracing cause-effect relationships or, when dealing with purposive behavior, means-ends relationships. The analyst identifies the goals being pursued and explains why the foreign actor(s) believe certain means will achieve those goals. Particular strengths of situational logic are its wide applicability and ability to integrate a large volume of relevant detail. Any situation, August 2012 • Foreknowledge

however unique, may be analyzed in this manner. Situational logic as an analytical strategy also has two principal weaknesses. One is that it is so difficult to understand the mental and bureaucratic processes of foreign leaders and governments. To see the options faced by foreign leaders as these leaders see them, one must understand their values and assumptions and even their misperceptions and misunderstandings. Without such insight, interpreting foreign leaders' decisions or forecasting future decisions is often little more than partially informed speculation. Too frequently, foreign behavior appears "irrational" or "not in their own best interest." Such conclusions often indicate analysts have projected American values and conceptual frameworks onto the foreign leaders and societies, rather than understanding the logic of the situation as it appears to them.

The intelligence analyst's function might be described as transcending the limits of incomplete information through the exercise of analytical judgment.

It is quite possible to ignore the fact that ethnic conflict as a generic phenomenon has been the subject of considerable theoretical study. By studying similar phenomena in many countries, one can generate and evaluate hypotheses concerning root causes that may not even be considered by an analyst who is dealing only with the logic of a single situation.

The second weakness is that situational logic fails to exploit the theoretical knowledge derived from study of similar phenomena in other countries and other time periods.

Analyzing many examples of a similar phenomenon, as discussed below, enables one to probe more fundamental causes than those normally considered in logic-ofthe-situation analysis.

The subject of national separatist movements illustrates the point. Nationalism is a centuries-old problem, but most Western industrial democracies have been considered well-integrated national communities.

The proximate causes identified by situational logic appear, from the broader perspective of theoretical analysis, to be but symptoms indicating the presence of more fundamental causal factors. A better understanding of these fundamental causes is critical to effective forecasting, especially over the longer range. While situational logic may be the best approach to estimating shortterm developments, a more theoretical approach is required as the analytical perspective moves further into the future. (We will proceed with Chapter 4 in the next issue) •



Australian Institute for Professional Intelligence Officers Feedback on Annual Conference held 24-26 July 2012 in Sydney Brett Peppler - President traditional intelligence cycle as a new model built more as a system with four types of activity – collection, transmission, anticipation as well as denial and deception – with analysis occurring within all four types of activity.

Distinguished Panel (L-R): Tim Riley (IBM), David George (Booz, Facilitator), Dr Jennifer Sims (Georgetown University), Assistant Commissioner Tim Morris (AFP), and Dr Warren Tucker (NZSIS). Our conference theme this year was ‘Anticipating Risks and Influencing Action’, intended to highlight the challenges arising from the growing partnership between intelligence practitioners and their customers. This year’s conference featured 23 speakers – including five international speakers – three training masterclasses, and an exhibition comprising 12 sponsors and exhibitors. We attracted 170 delegates. Six themes threaded the conference: transformation, alignment and agility (dealing with challenges internal to intelligence organisations) while client relationships and public-private partnerships dealt with external challenges; and one theme (the changing nature of success) that seemed to link the preceding five themes. Transformation Most speakers highlighted growing complexity in our respective operating environments, and the need for more sophisticated approaches. Kevin Sheedy alluded to the need for transformative change when he 24

said ‘if your organisation is failing it’s probably because you are failing to embrace new conceptual ideas’. Jennifer Sims strengthened the imperative for transformation by overturning much of the conventional wisdom about intelligence practice. Warren Tucker rammed home the point by suggested if we didn’t embrace transformative change we faced two unpalatable options; either we will be heroic and dead, or we will have ill-informed change imposed upon us by unsympathetic masters. Tim Morris suggested we should have the plan for transformative change already prepared and available in our back pockets to respond quickly to client interest. Alignment Speakers addressed alignment in two dimensions; vertically by aligning strategic and tactical intelligence activity within organisations, as well as horizontally across business functions and between organisations. Jennifer Sims proposed gaining better alignment by reinventing the

Kirsten Williams and Roger Beer spoke about developing more sophisticated approaches to tasking and coordination as one way of dealing with the multidimensionality of the alignment problem. Kirsten succinctly captured the challenge when she posed the question ‘how do we prioritise priorities’? Agility Speakers noted the importance of being more anticipatory in our approach as an enabler of agility – at both the organisational and individual levels. Tim Mashford’s predictive crime mapping tool showed how we can hardwire these features into customised tools. Tim’s case study also showed how even small intelligence teams – four people – can successfully undertake research and development. This demonstrated capacity to innovate was the key reason we awarded the Organisational Award to the Victoria Police (VICPOL) crime mapping unit. Eugene Dubossarsky’s masterclass on collective forecasting showed how to read the future with precision and realism by combining ‘wisdom of crowds’ techniques to fuse the insight of many individuals, while using scientific rigour and measurement to find which of them is more accurate. August 2012 • Foreknowledge


Intelligence research and analysis services on Africa’s political, economic and criminal threats Prof Jennifer Sims talks to ABC about intelligence gathering in the internet age. Click here to access the interview. Tony Nolan’s masterclass on open source intelligence highlighted the many sources of ‘weak signals’ in our business environment, which may provide early warning by hinting at major change ahead. Client relationships The presentation by Tim Morris centered on client relationships as a key enabler of intelligence success, providing a rationale for his choice of clients. David George’s panel discussion agreed that intelligence best shapes its value proposition around how it can help clients achieve their business objectives NOT in terms of process metrics within the intelligence agency. The panel also stressed that we need to get closer to clients by placing analysts with decision makers to build better value and build trust. Also, we need to be more responsive to frequently changing clients’ needs and priorities. Tim Riley cautioned that, where possible, we need to pick and choose our interactions with clients. Public-private partnerships Many speakers – Jennifer Sims, Warren Tucker, Tim Morris and Caroline Ziemke-Dickens – saw public-private partnerships as a way to build ‘reserve intelligence

capacity’ and leverage off new technologies. This is the main reason AIPIO includes an industry exhibition in conjunction with our annual conference. Also, we shouldn’t forget about opportunities to partner within our organisations. This strategy was highlighted in Fiona Walton’s case study about the Madeleine Pulver investigation where the capabilities of specialist squads were seamlessly woven together at short notice but only by leveraging a high level of existing trust. Nature of success Jennifer Sims crystallised this final theme when she said ‘if we don’t know how intelligence works anymore, then how can we be successful?’ She provided some persuasive examples from popular culture to illustrate how the way we can best confer an advantage to our clients is changing.

*** Publishers of Foreknowledge e-magazine *** Assistance with establishing intelligence units *** Intelligence information management and systems *** Intelligence training & curriculum development to more than 60 military, intelligence, security, law enforcement, compliance and risk clients in Africa

Tim Morris also reflected on changing rules of the game, posing the question ‘what now constitutes success?’ His presentation provided an excellent forensic tool for comprehensively examining intelligence business models as a basis for reinventing the basis for success. •

Intelligence 2013 Canberra 24-26 July 2013 Theme: “Future proofing intelligence’ August 2012 • Foreknowledge



Tony Nolan

Risk, Intelligence and Analytics Officer, Australian Government

e c n e g i l l analytic Inte s


elcome to another edition of column Intelligence Analytics. A few days ago I presented a Master Class about open source at the Intelligence 2012 conference in Sydney Australia. Open source is both data and software which is provided for free. To set the story straight right form the beginning, datasets can be used in both commercial and open source software. Of course there are advantages and disadvantages in both, and I believe that a good intelligence analyst needs to be aware and capable in both. Both of course work of the same dataset specifications, so you can move data from one to the other. Of course just like the software, both open source and commercial data can be used in either as well. Every thing is designed to some type of industry standards, and software is designed to work with the various sources of data. So, in the majority of cases, no mater whether it is commercial or open source software or data, they can be integrated to in various combinations. An interesting aspect to open source, is the number of governments that provide data about them selves and their populations. The governments of Australia, Brazil, Canada, Chile, France, Italy, Kenya, Netherlands, New Zealand, Portu-

gal, Spain, UK, United Nations, USA, etc are a few of the countries that provide open source data about themselves. The follow set of links, show where the media and other groups have taken open source data and turned it into some interesting features. This interactive story, Arab spring: an interactive timeline of Middle East protests lets you run across either dates or countries to get a full picture what happened in which country when. Click here to access the interactive graph.

This one shows you the world population by latitude and longitude.

What is interesting in both examples is where open source has been massaged, and then turned into another open source product. In my next column, I will provide some comments about open source software, and then we can start to get down into how to put it all together, using mathematics to produce intelligence products. • 26

August 2012 • Foreknowledge


The Role of Analytics in Professional Development Anne Walton, Founder, Analysts Compass

Proficiency in analytical techniques is an incredible skill to possess, particularly in a time when globalization and technological innovation threatens workers with information overload. Intelligence analysts, who are readily equipped to meet the demands of the modern workplace, should consider application of their skill set to their development of their own career. Professional development, in the form of education and training, is both a necessity and an opportunity; Not only does it offer a chance to refresh, awaken, or update skills that have become outdated or lay dormant it also provides a space for growth outside and beyond the parameters of the current mindset.


There is no shortage of courses, webinars, and trainings to choose from. In order to navigate the slew of offerings effectively and make an informed decision, simply activate the tools and techniques used to analyze intelligence over the course of day and apply it to the problem at hand.

In 2009, CNNMoney ranked “Intelligence Analyst” as the 9th best job in the US with the following Quality of Life ratings: Personal satisfaction: A Job security: B Future growth: A Benefit to society A Low stress: C August 2012 • Foreknowledge

A sample framework for approaching the professional development problem of selecting the right education or training event is as follows: 1. Conduct a self-assessment and determine your core competencies, areas of expertise, and role within your organization. Understand how each area contributes to your performance at the tactical, operational, and strategic levels of your organization. The Competency Model created by the American Society for Training and Development is an excellent guide to employ during this process. 2.

Have a plan. Clearly state the problem. For example: You want to attend a training to acquire a new skill or learn about a new issue but it is costly and time consuming. Isolate key points that both supporting and refuting attendance at the training. Try viewing the scenario from the viewpoint of the manager or decision maker. Prepare a written summary of the analysis and consider using it as a cost justification tool.


Gather data and information from at least nine different kinds of sources; three online sources, three human sources and three source-based information products.


As you conduct online and offline research to gather data, track your progress and record findings using a collection management tool. Templates are available online or can easily be made using Microsoft Word or Excel. Be sure to continually evaluate sources and material using a credibility and reliability matrix.

The above framework can be applied to selection of a multitude of professional development events, materials and associations. Not only does it provide an efficient way of navigating the way through large amounts of data, it also encourages expansion into new learning areas and opportunities for growth. •

Sample resume of an intelligence analyst here IACA online courses here IALEIA certification here



Foreknowledge reader survey We ran an internet survey in June and July 2012 to get to know

What is your highest qualification?

our readers better. A total of 125 people from 24 countries completed the survey. Due to the sensitive nature of our pro-

Grade 12

fession, it will always be difficult to get an exact picture of our readers. However, the survey gives us an indication of who

0.8% 7.2%

Only short courses

you are and what you want.

1 or 2 year certificate/diploma/associate

Our website has been visited by 9,694 people from 101 countries since 1 February 2012. We had 16,931 readers of the Flash version of the e-magazine while the PDF format is emailed to


3 or 4 year bachelors degree


1 or 2 years Honours/post graduate certificate /diploma

about 1,500 intelligence professionals, many of whom forward it to their intranets and distribution lists. In a nutshell - Fore-


Masters degree


Doctorate degree

knowledge is read by thousands the world over!


10.4% 2.4%

We hope to increase the traffic even more as we launch our resources pages in the coming months. We aim to be the “hub” of all things related to the Intelligence analysis profession.


In which sector are you employed? 28.8%

Law enforcement Military intelligence




State security/intel






Risk & security


Government compliance


Commercial crime


Private intelligence


Training provider


Competitive intelligence




Full-time student

“Thanks for posting this. I have seldom found a publication so interesting as Foreknowledge.” “You have done an excellent job and fill an important niche in educating intelligence professionals.” “Excellent work. The IPad edition performed flawlessly and the content was both informative and entertaining.”

Nearly 48% is an “Intelligence Analyst” 15% said they are intelligence managers

“I just read through much of your first issue and it is really excellent! I am passing it on to my students and followers. Good job! And thanks!”

8% said they are intelligence lecturers or trainers 9% are operational or intelligence collectors

“This is a fantastic resource! Thank you for bringing this to the analytic community.”


Contact us if you want to

What do you want in the e-magazine & website?

market your products &


services in Foreknowledge 66.7% 61.8% 52.8%



See our own Amazon bookstore on the web!

Intelligence University programmes


Software tools & gadgets

Training courses

Books & journals

Career & certification

Professional organizations

August 2012 • Foreknowledge

Foreknowledge #4  

E-magazine for intelligence analysts

Read more
Read more
Similar to
Popular now
Just for you