intelligence analysis

Intelligence analysis is the application of individual and collective cognitive methods to weigh data and test hypotheses within a secret socio-cultural context. The descriptions are drawn from what may only be available in the form of deliberately deceptive information; the analyst must correlate the similarities among deceptions and extract a common truth. Although its practice is found in its purest form inside national intelligence agencies, its methods are also applicable in fields such as business intelligence or competitive intelligence.

Overview

Intelligence analysis is a way of reducing the ambiguity of highly ambiguous situations. Many analysts prefer the middle-of-the-road explanation, rejecting high or low probability explanations. Analysts may use their own standard of proportionality as to the risk acceptance of the opponent, rejecting that the opponent may take an extreme risk to achieve what the analyst regards as a minor gain. The analyst must avoid the special cognitive traps for intelligence analysis projecting what she or he wants the opponent to think, and using available information to justify that conclusion. Being aware that one's enemies may try to confuse is a relevant factor, especially in the areas of intelligence cycle security and its subdiscipline counterintelligence. During World War II, the German word for counterintelligence art was ''Funkspiel'', or radio game—not a game in the sense of playing fields, but something that draws from game theory and seeks to confuse one's opponents.

A set of problem-solving talents are essential for analysts. Since the other side may be hiding their intention, the analyst must be tolerant of ambiguity, of false leads, and of partial information far more fragmentary than faces the experimental scientist. According to Dick Heuer, in an experiment in which analyst behavior was studied, the process is one of incremental refinement: "with test subjects in the experiment demonstrating that initial exposure to blurred stimuli interferes with accurate perception even after more and better information becomes available...the experiment suggests that an analyst who starts observing a potential problem situation at an early and unclear stage is at a disadvantage as compared with others, such as policymakers, whose first exposure may come at a later stage when more and better information is available."

The receipt of information in small increments over time also facilitates assimilation of this information into the analyst's existing views. One item of information may not be sufficient to prompt the analyst to change a previous view. The cumulative message inherent in many pieces of information may be significant but is attenuated when this information is not examined as a whole. The Intelligence Community's review of its performance before the 1973 Yom Kippur War noted n the only declassified paragraph

Writers on analysis have suggested reasons why analysts come to incorrect conclusions, by falling into cognitive traps for intelligence analysis. Without falling into the trap of avoiding decisions by wanting more information, analysts also need to recognize that they always can learn more about the opponent.

Analytic tradecraft

The body of specific methods for intelligence analysis is generally referred to as analytic tradecraft. The academic disciplines examining the art and science of intelligence analysis are most routinely referred to as "Intelligence Studies", and exemplified by institutions such as the Joint Military Intelligence College, University of Pittsburgh Graduate School of Public and International Affairs (Security and Intelligence Studies major), and Mercyhurst College Institute for Intelligence Studies. The goal of the Analytic Tradecraft Notes of the Central Intelligence Agency's Directorate of Intelligence (DI) include the

On January 2, 2015, the Office of the Director of National Intelligence (ODNI) issued Intelligence Community Directive (ICD) 203, which "establishe Intelligence Community (IC) Analytic Standards that govern the production and evaluation of analytic products; articulates the responsibility of intelligence analysts to strive for excellence, integrity, and rigor in their analytic thinking and work practices..."

Setting goals for an intelligence analysis

Stating the objective from the consumer's standpoint is an excellent starting point for goal-setting:

More charitably, he now characterizes his early periods of service at the NSC Staff and in State Department bureaus as ones of "mutual ignorance"

Be bold and honest

Weasel-wording is problematic in intelligence analysis; still, some things truly are uncertain. Arguably, when uncertainties are given with probabilities or at least some quantification of likelihood, they become less a case of weasel wording and more a case of reflecting reality as it is best understood.

While a good analyst must be able to consider, thoughtfully, alternative viewpoints, an analyst must be willing to stand by his or her position. This is especially important in specialized areas, when the analyst may be the only one that reads every field report, every technical observation on a subject.

"Believe in your own professional judgments. Always be willing to listen to alternative conclusions or other points of view, but stand your ground if you really believe the intelligence supports a certain conclusion. Just because someone is your boss, is a higher grade, or has been around longer than you does not mean he or she knows more about your account than you do. You are the one who reads the traffic every day and who studies the issue". At the same time, Watanabe observes, "It is better to be mistaken than wrong". Not willing to be wrong is also a disease of the highest policymaker levels, and why there needs to be a delicately balanced relationship, built of trust, between a policymaker and his closest intelligence advisors.

"Being an intelligence analyst is not a popularity contest...But your job is to pursue the truth. I recall a colleague who forwarded an analysis that called into question the wisdom behind several new US weapon systems. This analysis caused criticism of the CIA, of his office, and of himself. He stood his ground, however; the Agency supported him, and eventually he was proven right. He did not make a lot of friends, but he did his job.

Intelligence analysts are expected to give policymakers' opinions both support and reality checks. The most effective products have several common features:
*Opportunities and dangers for interests of the analyst's country, especially unexpected developments that may require a reaction.
* Motives, objectives, strengths, and vulnerabilities of adversaries, allies, and other actors.
* Direct and indirect sources of friendly parties' leverage on foreign players and issues.
* Tactical alternatives for advancing stated national policy goals.

Reality checking is not to be underestimated. In World War II, the Allies launched an air offensive against a target system that they really did not understand: the V-1 cruise missile. Their rationale to attack ("if the enemy apparently valued it, then it must be worth attacking") may have been rational when there were large numbers of aircraft and pilots, but it might not be applicable to current situations, at least not until analysts rule out the possibility of the target system being a decoy. If the threat is real, then it might be warranted to defer attack until a massive one can be delivered.

Agreement on content

The analytic process must be interactive with the customer to succeed. For example, the first IMINT of Soviet missiles during the Cuban Missile Crisis was verified and quickly taken to the President and Secretary of Defense. The highest level of authority immediately requested more detail, but also wanted a perspective on the Soviet strategy, which was not available from photography.

As the White House requested more CIA and Navy support for photography, it simultaneously searched for HUMINT and SIGINT from Cuba, as well as diplomatic HUMINT. Until John F. Kennedy was briefed by excellent briefers, such as Dino Brugioni, he probably did not understand the capabilities of IMINT.

Frequently, the intelligence service will organize the production process and its output to mirror the customer organization. Government production by the single-source intelligence agencies is largely organized geographically or topically, to meet the needs of all-source country, region, or topic analysts in the finished-intelligence producing agencies.

In terms of intended use by the customer, both business and government producers may generate intelligence to be applied in the current, estimative, operational, research, science and technology, or warning context. Serendipity plays a role here, because the collected and analyzed information may meet any or all of these criteria.

A good example is warning intelligence. Military and political analysts are always watching for predefined indication that an emergency, such as outbreak of war, or a political coup, is imminent. When an indicator is approved, policymakers are alerted and a crisis team is often convened, with the mission of providing time-sensitive intelligence on the situation to all relevant customers.

Orienting oneself to the consumers

Experienced analysts recommend seeing oneself as a specialist on a team, with 5–10 key players. Learn something about each of them, both in terms of how they express themselves, and how you can reinforce their strengths and support their weaknesses. The analyst must constantly ask himself, "what do they want/need to know? How do they prefer to have it presented? Are they still trying to select the best course of action, or have they committed and now need to know the obstacles and vulnerabilities on their chosen path?"

Others on the team may know, how to handle the likely challenges. The analyst's contribution is in recognizing the unlikely, or providing connections that are not obvious. Consumers must get information in a timely manner, not after they commit to a decision they might not have made having rougher information available sooner.

Sometimes, when the producer is struggling with how to meet the needs of both internal and external customers, the solution is to create two different types of products, one for each type of customer. An internal product might contain detail of sources, collection methods, and analytic techniques, while an external product is more like journalism. Remember that journalists always address:
#Who
#What
#When
#Where
#Why

"How" is often relevant to journalists, but, in intelligence, may wander into that delicate area of sources and methods, appropriate only for internal audiences. The external consumer needs to know more of potential actions. Actions exist in three phases:
#The decision to act
#The action
#Disengagement from the action

Internal products contain details about the sources and methods used to generate the intelligence, while external products emphasize actionable target information. Similarly, the producer adjusts the product content and tone to the customer's level of expertise.

Orienting oneself to peers

Even in professional sports, where there are strict anti-fraternization rules on the playing field, players often have deep friendships with counterparts on opposing teams. They might have been on a college team together, or are simply aware that the team they oppose today might be the team to which they might be traded tomorrow. If a technique is personal, rather than a proprietary idea of a coach, one professional might be quite willing to show a nominal opponent how he does some maneuver. Watanabe observed

If you are examining a problem and there is no intelligence available, or the available intelligence is insufficient, be aggressive in pursuing collection and in energizing collectors. ... As an analyst, you have the advantage of knowing both what the consumer needs to know (sometimes better than the consumer knows himself) and which collectors can obtain the needed intelligence.

Aggressively pursue collection of information you need. In the Intelligence Community, we have the unique ability to bring substantial collection resources to bear in order to collect information on important issues. An analyst needs to understand the general capabilities and limitations of collection systems...If the analyst is in a technical discipline, the analyst might have an insight about a collection system that the operators have not considered ... If you are not frequently tasking collectors and giving them feedback on their reporting, you are failing to do an important part of your job.

Peers, both consumer and analyst, also have a psychological context. Johnston
suggests the three major components of that context are:
#socialization
#degree of risk taking or risk aversion
#organizational-historical context

Devlin observes that while traditional logical work does not consider socialization, work on extending logic into the real world of intelligence requires it. "The first thing to note, and this is crucial, is that the process by which an agent attaches meaning to a symbol always takes place in a context, indeed generally several contexts, and is always dependent on those contexts. An analytic study of the way that people interpret symbols comes down to an investigation of the mechanism captured by the diagram:

gent+ ymbol+ ontext+. . . + ontext→ nterpretation/code>

Things that are true about contexts include:
#Contexts are pervasive
#Contexts are primary
#Contexts perpetuate
#Contexts proliferate
#Contexts are potentially pernicious

The discipline of critical discourse analysis will help organize the context. Michael Crichton, in giving examples of physicians communicating with other physicians, points out that laymen have trouble following such discourses not only because there is specialized vocabulary in use, but the discourse takes place in an extremely high context. One physician may ask a question about some diagnostic test, and the other will respond with a result from an apparently unrelated test. The shared context was that the first test looked for evidence of a specific disease, while the answer cited a test result that ruled out the disease. The disease itself was never named, but, in the trained context, perfectly obvious to the participants in the discourse.

Intelligence analysis is also extremely high context. Whether the subject is political behavior or weapons capabilities, the analysts and consumers share a great deal of context. Intelligence consumers express great frustration with generic papers that waste their time by giving them context they already have internalized.


Organizing what you have

Collection processes provide analysts with assorted kinds of information, some important and some irrelevant, some true and some false (with many shades in between), and some requiring further preprocessing before they can be used in analysis. Raw information reports use a standard code for the presumed reliability of the source and of the information. The U.S. Intelligence Community uses some formal definition of the kinds of information.

Collation describes the process of organizing raw data, interpolating known data, evaluating the value of data, putting in working hypotheses. The simplest approaches often are an excellent start. With due regard for protecting documents and information, a great deal can be done with pieces of paper, a whiteboard, a table, and perhaps a corkboard. Maps often are vital adjuncts, maps that can be written upon.

There are automated equivalents of all of these functions, and each analyst will have a personal balance between manual and machine-assisted methods. Unquestionably, when quantitative methods such as modeling and simulation are appropriate, the analyst will want computer assistance, and possibly consultation from experts in methodology. When combining maps and imagery, especially different kinds of imagery, a geographic information system is usually needed to normalize coordinate systems, scale and magnification, and the ability to suppress certain details and add others.

Outlining, possibly in a word processing program, or using visualization tools such as mind maps can give structure, as can file folders and index cards. Data bases, with statistical techniques such as correlation, factor analysis, and time series analysis can give insight.

Some analysts speak of a Zen-like state in which they allow the data to "speak" to them. Others may meditate, or even seek insight in dreams, hoping for an insight such as that given to August Kekulé in a daydream that resolved one of the fundamental structural problems of organic chemistry.

Krizan took criteria from. Regardless of its form or setting, an effective collation method will have the following
attributes:
#Be impersonal. It should not depend on the memory of one analyst; another person knowledgeable in the subject should be able to carry out the operation.
#Not become the "master" of the analyst or an end in itself.
#Be free of bias in integrating the information.
#Be receptive to new data without extensive alteration of the collating criterion.

Semantic maps are related to mind maps, but are more amenable to computer discovery of relationships.

The more interactive that the relationship between producer and consumer becomes, the more important will be tools:
:* Collaboration tools. These include all media: voice, video, instant messaging, electronic whiteboards, and shared document markup
:*Databases. Not only will these need to be interoperable, they need to reflect different models, when appropriate, such as the semantic web. There may no longer be a clear line between databases and web applications.
:*Analytic tools. These will cover a wide range of pattern recognition and knowledge organization.

The nature of analysis

An analysis should have a summary of the key characteristics of the topic, followed by the key variables and choices. Increasingly deep analysis can explain the internal dynamics of the matter being studied, and eventually to prediction, known as estimation.

The purpose of intelligence analysis is to reveal to a specific decision maker the underlying significance of selected target information. Analysts should begin with confirmed facts, apply expert knowledge to produce plausible but less certain findings, and even forecast, when the forecast is appropriately qualified. Analysts should not, however, engage in fortunetelling that has no basis in fact.

The mnemonic "Four Fs Minus One" may serve as a reminder of how to apply this criterion. Whenever the intelligence information allows, and the customer's validated needs demand it, the intelligence analyst will extend the thought process as far along the Food Chain as possible, to the third "F" but not beyond to the fourth.

Types of reasoning

Objectivity is the intelligence analyst's primary asset in creating intelligence that
meets the Four Fs Minus One criterion. To produce intelligence objectively, the
analyst must employ a process tailored to the nature of the problem. Four basic types of
reasoning apply to intelligence analysis: induction, deduction, abduction and the scientific
method.

Induction: seeking causality

The induction process is one of discovering relationships among the phenomena under study. It may come from human pattern recognition ability, looking at a seemingly random set of events, perhaps writing them on cards and shuffling them until a pattern emerges.

An analyst might notice that when Country X's command post with call sign ABC sent out a message on frequency 1 between Thursday and Saturday, an air unit will move to a training range within one week. The acknowledgement will take one day, so the analyst should recommend intensified COMINT monitoring of the appropriate frequencies between Friday and Sunday. Another kind of causality could come from interviews, in which soldiers might describe the things that warn them of an impending attack, or how the ground might look when an improvised explosive device has been emplaced.

While induction, for human beings, is usually not at a fully rational level, do not discount the potential role of software that uses statistical or logical techniques for finding patterns. Induction is subtly different from intuition: there usually is a pattern that induction recognizes, and this pattern may be applicable to other situations.

Deduction: applying the general

Deduction, is the classic process of reasoning from the general to the specific, a process made memorable by Sherlock Holmes: "How often have I said to you that when you have eliminated the impossible, whatever remains, however improbable, must be the truth?" Deduction can be used to validate a hypothesis by working from premises to conclusion.

The pattern of air maneuvers described above may be a general pattern, or it may be purely General X's personal command style. Analysts need to look at variables, such as personalities, to learn whether a pattern is truly general doctrine, or simply idiosyncratic.

Not all intelligence officers regard this as a desirable approach. At his confirmation hearing for CIA Director, Gen. Michael V. Hayden said he believes that intelligence analysis should be done by "induction", under which "all the data" are gathered and general conclusions determined, rather than by "deduction", under which you have a conclusion and seek out the data that support it.

Trained intuition

Analysts need to harness trained intuition: the recognition that one has come to a spontaneous insight. The steps leading there may not be apparent, although it is well to validate the intuition with the facts and tools that are available.

Polish cryptanalysts first were reading German Enigma ciphers in 1932, although the commercial version may have been broken by the British cryptanalyst, Dilwyn Knox, in the 1920s. Poland gave critical information to the French and British in 1939, and production British cryptanalysis was well underway in 1940. The Enigma, with German military enhancements, was quite powerful for a mechanical encryption device, and it might not have been broken as easily had the Germans been more careful about operating procedures. Throughout the war, Germany introduced enhancements, but never realized the British were reading the traffic almost as fast as the Germans.

US cryptanalysts had broken several Japanese diplomatic ciphers, but, without ever seeing the PURPLE machine until after the war, they deduced the logic. Purple was actually mechanically simpler than Enigma, but the U.S. Army team struggled with a mechanical reproduction until Leo Rosen had the unexplained insight that the critical building block in the Purple machine was a telephone-type stepping switch rather than the rotor used in Enigma and in more advanced U.S. and UK machines. Rosen, Frank Rowlett, and others of the team recognized Rosen's insight as based on nothing but a communication engineer's intuition.

Experienced analysts, and sometimes less experienced ones, will have an intuition about some improbable event in a target country, and will collect more data, and perhaps send out collection requests within his or her authority. These intuitions are useful just often enough that wise managers of analysts, unless the situation is absolutely critical, allow them a certain amount of freedom to explore.

Scientific method

Astronomers and nuclear physicists, at different ends of the continuum from macroscopic to microscopic, share the method of having to infer behavior, consistent with hypothesis, not by measuring phenomena to which they have no direct access, but by measuring phenomena that can be measured and that hypothesis suggests will be affected by the mechanism of interest. Other scientists may be able to set up direct experiments, as in chemistry or biology. If the experimental results match the expected outcome, then the hypothesis is validated; if not, then the analyst must develop a new hypothesis and appropriate experimental methods.

In intelligence analysis, the analyst rarely has direct access to the observable subject, but gathers information indirectly. Even when the intelligence subject at hand is a technical one, analysts must remain aware that the other side may be presenting deliberately deceptive information.

From these gathered data, the analyst may proceed with the scientific method by generating tentative explanations for a subject event or phenomenon. Next, each hypothesis is examined for plausibility and compared against newly acquired information, in a continual process toward reaching a conclusion. Often the intelligence analyst tests several hypotheses at the same time, whereas the scientist usually focuses on one at a time. Furthermore, intelligence analysts cannot usually experiment directly upon the subject matter as in science, but must generate fictional scenarios and rigorously test them through methods of analysis suggested below.

Methods of analysis

As opposed to types of reasoning, which are ways the analyst drafts the product, the following methods are ways of validating the analyst's results of reasoning. Structured analytic techniques are used to help challenge judgments, identify mental mindsets, overcome biases, stimulate creativity, and manage uncertainty. Examples include the key assumptions check, analysis of competing hypotheses, Devil's advocacy, Red Team Analysis, and Alternative Futures/Scenarios analysis, among others.

Opportunity analysis

Opportunity analysis identifies for policy officials opportunities or vulnerabilities that the customer's organization can exploit to advance a policy, as well as dangers that could undermine a policy. Lawyers apply the test ''cui bono'' (who benefits?) in a rather similar way.

To make the best use of opportunity analysis, there needs to be a set of objectives for one's own country, preferably with some flexibility to them. The next step is to examine personalities and groups in that target country to see if there are any with a commonality of interest. Even though the different sides might want the same thing, it is entirely possible that one or the other might have deal-breaking conditions. If that is the case, then ways to smooth that conflict need to be identified, or no more work should be spent on that alternative.

Conversely, if there are elements that would be utterly opposed to the objectives of one's side, ways of neutralizing those elements need to be explored. They may have vulnerabilities that could render them impotent, or there may be a reward, not a shared opportunity, that would make them cooperate.

Linchpin analysis

Linchpin analysis proceeds from information that is certain, or with a high probability of being certain. In mathematics and physics, a similar problem formation, which constrains the solution by certain known or impossible conditions, is the boundary value condition.

By starting from knowns (and impossibilities), the analyst has a powerful technique for showing consumers, peers, and managers that a problem has both been thoroughly studied and constrained to reality. Linchpin analysis was introduced to CIA by deputy director for Intelligence (1993–1996) Doug MacEachin, as one of the "muscular" terms he pressed as an alternative to academic language, which was unpopular with many analysts. He substituted linchpin analysis for the hypotheses driving key variables. MacEachin required the hypotheses—or linchpins—needed to be explicit, so policymakers could be aware of coverage, and also aware of changes in assumptions.

This method is an "anchoring tool" that seeks to reduce the hazard of self-inflicted intelligence error as well as policymaker misinterpretation. It forces use of the checkpoints listed below, to be used when drafting reports:

#Identify the main uncertain factors or key variables judged likely to drive the outcome of the issue, forcing systematic attention to the range of and relationships among factors at play.
#Determine the linchpin premises or working assumptions about the drivers. This encourages testing of the key subordinate judgments that hold the estimative conclusion together.
#Marshal findings and reasoning in defense of the linchpins, as the premises that warrant the conclusion are subject to debate as well as error.
#Address the circumstances