Table of Contents
Introduction
The Intelligence Cycle is a process to help you visualize the steps involved in the production of intelligence. Intelligence should be thought of as the output, while information or raw data is the input. The data goes into a system, is processed (by human beings) and emerges intelligence.
Intelligence is commonly thought of as being only for military or police agencies but Competitive Intelligence is an area that has been expanding and has the potential to assist corporations (including non-profits) in the best performance of their mission.
There are a variety of conceptualizations of the Intelligence Cycle which may be between four and seven steps or even more depending on the specific organization. For instance, in the US Army FM 34-3 Intelligence Analysis, it consists of four steps:
- Directing
- Collecting
- Processing
- Disseminating and Using
This whole process involves planning (how each step will be performed) and supervising for quality.
A different example of the Intelligence Cycle is present in Criminal Intelligence in the 21st Century:
From this model, I’ll add one additional step from the Army Intelligence Cycle: Direction. I’ll explain below why this is important.
We see the following 7-step process (with my addition bolded) for intelligence:
- Direction
- Collection
- Collation
- Evaluation
- Analysis
- Dissemination
- Re-Evaluation
The difference between these two examples of the Intelligence Cycle is not the tasks that are performed, but merely the way they are visualized. The second model, with its additional entries makes for a good review.
Working Through the Intelligence Cycle
Direction
Direction is the first step in the intelligence cycle. In this step, it’s identified that there is actually an intelligence need. This step is the one that actually gets the intelligence cycle started. In the military, this often begins with a PIR, a Priority Intelligence Requirement. This is used in both the military and national security arenas but may be used in law enforcement as well.
Especially in the law enforcement or national security arenas, requests for intelligence can be more informal. You may get an email, a colleague may drop by your desk or you may get a phone call from your supervisor asking you for information.
At this stage the Analyst will have an idea of the problem they need to solve, and will begin the data collection part of the process.
Collection
The data collection part of the Intelligence Cycle involves finding the information needed to begin answering the analytical question. Collections should be guided by a collection plan, which sets out the specific types of information that are required to answer the question. This is similar to planning an essay; if you don’t know what you want to write about, you won’t know what sources to consult.
This may involve consulting a wide variety of sources. In law enforcement, these sources from the IACA (2003) may include:
- Police (crime) reports, submitted by the public
- Arrest reports, when individuals are brought in to the station
- Call for Service records, for non-emergency calls received
- Accident reports
- Regional Crime Analysis Network
- Police Magazines, Newsletters and Journals
- Deeds and Tax Assessment Information, which may reveal the source of financial transactions
- Field Interviews, conducted in neighbourhoods where criminals are operating
- Intelligence Reports produced by other analysts
- Parole Release Notices, indicating when criminals in jail are being released
- Criminal Histories
- Known Offender Files
- Motor Vehicle Registration and Licensing Data
- Pawn Data, where collected can help you trace the source of stolen goods
- Sex Offender Registries
Some more general sources of information may include:
- Websites – A wide variety of information is available on the internet. This can include social networks like Facebook, government sources of public records, and websites produced by individuals in your community of interest
- Demographic Data – For strategic intelligence (which will be explained later), demographic information in an area can be useful to understand the difference between a particular region and the population
- Bulletins and reports – This can be police bulletins, national security warnings, or other bulletins and reports by others
- Regional newspapers – This can give you the “pulse” of a community, especially if you’re providing analysis on an area that you’re not extremely familiar with
- Meetings of intelligence analysts – Joining a community of analysts can help
- Online Bulletin Boards and Discussion Groups
- E-Mail Discussion Lists (listserv) – These are lists on a variety of topics that you can subscribe to for regular updates from professionals. You may wish to subscribe to the LEAnalyst listserv for crime analysts
This information is separated into two categories, open source intelligence and covert intelligence. Up to 90% of the intelligence collected and acted on in today’s CIA is open source (Moshirnia, 2013), which means that it’s freely available to the public. Examples of this include media reports in Russian, a Chicagoland web forum where a mobster posts, or a Deed indicating who owns a house where drug dealing is known to occur.
Over time, you may develop additional sources of information. For instance, intelligence analysts who work in law enforcement may develop informants as they work the streets while national security analysts may have connections with journalists or politicians around the world who funnel them information.
It’s important, especially when working as a freelancer that you obey all laws and regulations in your area for the collection of information. If you fail to collect information in a legal manner, it may be difficult or impossible to take action on it. This is more common in investigations, but has occurred with national security intelligence as well. For instance, confessions that were the result of waterboarding during the George W. Bush administration were used to invalidate convictions of terrorists.
Collation
You may be most familiar with collation in the context of getting items copied. If you want a binder to be photocopied but you have it stored as individual files, you need to pay an extra collating fee in order for those files put together in the right order.
In intelligence analysis, collating refers to the steps taken to put raw information that you will subject to analysis. Audio tapes may need to be digitized and transcripts written, images will need to be converted to text (or into a format consistent with importing into an analysis program), or translating documents obtained from a source into English.
Although collation can be thought of an automated process, it is generally an intensive procedure because it requires human input in order to make decisions about what the most effective conversion for a particular piece of data is.
Collation can also involve categorizing and indexing information, including storing it in a database. A database in a law enforcement intelligence operation may allow you to search by type of crime (such as sexual assault), a piece of evidence (such as the full text of a note left at a burglary) or by location of crime or victim.
In the US Army Intelligence Analysis manual, collation is combined with Evaluation and Analysis (the next two sessions), in a step called “Processing.”
Evaluation
Evaluation is similar to collating, in that you comb through the information that you’ve collected. The difference is, now that it’s in the same format, the audio has been cleaned up and transcripts generated, and all files are ready.
For each piece of information, evaluation focuses on its credibility or validity (the likelihood that the information is accurate) and it’s reliability (which is the likelihood an individual is telling the truth. You can have high reliability and low validity, when someone who has previously told you correct information tells you something that conflicts with all other sources. You can also have high validity and low reliability when someone tells you something that matches other sources but comes from a source you can’t trust (such as a hostile enemy.)
Additionally, in some analysis techniques like Analysis of Competing Hypothesis (ACH), relevance. Relevance is the likelihood that the evidence impacts the chosen hypothesis.
Four Category Reliability and Validity System (UNODC, 2011)
The following categorization has been suggested for rating information’s reliability, from the Association of Law Enforcement Intelligence Units (ALIU).
| Reliability | Rating | Validity | Rating |
| Reliable – Source’s reliability is unquestioned or has been well-tested in the past | A
|
Facual | 1 |
| Usually reliable – Source’s reliability can usually be relied upon as factual. The majority of past information has proven to be reliable | B | Probably true | 2 |
| Unreliable – Source’s reliability has been sporadic | C | Possibly true | 3 |
| Unknown – Source’s reliability cannot be judged. Authenticity or trustworthiness has not been determined by either experience or investigation. | D | Factually unknown | 4 |
From this, pieces of information can be assigned reliability and validity ratings. A piece of information from a generally reliable source that appears to match with most of the existing information may be coded A2, while a piece of information from a sporadically reliable source that cannot be validated at all would be coded C4.
This information can be added to an intelligence database and integrated into analyses.
Classification
Classification, in this sense, refers to the grading of a piece of information for its level of sensitivity. Those working for organizations in law enforcement and national security will have their own sensitivity levels, such as those listed below.
| Classification | Rating (Quist, 1993) |
| Unclassified | No classification. Information publically available but distribution may be limited (e.g. by Freedom of Information Act requests) |
| Confidential | “Confidential” shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause damage to the national security. |
| Secret | “Secret” shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security. |
| Top Secret | “Top Secret” shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security |
Freelance intelligence analysts will have to develop their own classification scheme. A simple two-pronged approach is suggested, where information is classified either Open Source (OS) or Closed Source (CS).
Open source can be any information that has not undergone analysis or synthesis, essentially raw data or very simply conclusions. Closed sources include both covert sources (such as human intelligence) but also open source information that has been processed into intelligence in a novel way.
Analysis
In the Intelligence Cycle, Analysis occurs after information has been collected, processed and evaluated. Analysis has been described in a variety of sources (Pythian, 2009) as the heart of the intelligence process. Analysis, which is the core of this training program, is the process by which information is converted into actionable information.
Analysis is generally divided into two categories, tactical and strategic intelligence. Tactical intelligence is the output of analysis that produces actionable information for immediate operations. In law enforcement, this could include targeting specific gang members, while in national security this could be an operation to stop a terrorist attack.
Strategic intelligence is broader and focuses on strategic priorities. For instance, reducing the number of gang shootings by 20% in the next 3 years, or understanding the broad threat of terrorism rather than specific activities.
Dissemination
The purpose of dissemination is to ensure that the intelligence product you produce actually reaches its destination. Intelligence products can involve a variety of material: short bulletins, longer written reports, oral briefings, formal presentations and other methods of communication what you know.
Dissemination involves both the choice of who to distribute to, and what to distribute to them. Time is also an important element in the dissemination part of the cycle; intelligence is generally time-sensitive, and so a failure to distribute information on time can make it worthless.
It is usually easy to know who to distribute a completed intelligence product to. Law enforcement and military analysts will have a Chain of Command to fall back on, and may distribute bulletins or other targeted products (in law enforcement intelligence especially) in order to disseminate information.
In the national security arena it is trickier, but often a system exists where completed intelligence products are archived, and distributed to relevant members of the government. As a freelancer, you will likely distribute your products to subscribers to your service, and potentially to journalists or government agencies with whom you would like to establish relationships.
Re-Evaluation
The final stage of the Intelligence Cycle, re-evaluation involves looking back at your products after they’ve been produced and consumed, or used, by the individuals who needed them. Did they meet their needs? Were your predictions right? Can you change the process in any way? This is the opportunity for reflection.
Some intelligence products can be regularly updated, these are mostly strategic analyses where new information can be factored in that was not known before. Other products of a tactical nature are quickly out of date – while the information shouldn’t be discarded it loses its immediate relevancy.