Week 4 Lecture: The Intelligence Cycle

INMS 600 Week 4 Lecture: The Intelligence Cycle Introduction The purpose of intelligence is to provide decision makers, policymakers and operators with information, warning, and situational awareness. Many times, intelligence is responsive, providing information and analysis after an event has occurred. However, the goal for intelligence organizations is to be proactive and to stay ahead of events as much as possible. We introduced the intelligence cycle with the article by Nicholas Krohley on The Intelligence Cycle is Broken in which the thesis is that the intelligence cycle has developed systemic, structural flaws. The process of collecting data to produce intelligence information for customers is described as the intelligence cycle. This week we will describe how customer intelligence requirements and needs are addressed in a six- step process. This is supported in readings that cover some of the perspectives of the IC and the phases of the intelligence cycle that address intelligence requirements. USAF RC-135 SIGINT Collector It is important to understand the intelligence process. The intelligence cycle is comprised of four fundamental steps – direction, collection, analysis, and dissemination. Information is collected and processed into actionable intelligence. It is a time proven process for the creation of intelligence. Direction is the beginning and based on addressing requirements and gaps. o Standing information requirements. o Specific information requirements. • o Priorities. Collection is the tasking of the intelligence enterprise to address requirements. o Intelligence collection plan based on source access. o Determine the most appropriate sources. • o Assign multiple assets. Analysis is the evaluation of the collected information. o Analysts use critical thinking and problem-solving logic. • o Assess all available information. • Dissemination provides the newly created intelligence to the appropriate customer. o Deliver briefings, reports, documents, and studies. 1 Legacy Intelligence Cycle • • Requirements-based • Collection Processing & Exploitation • Analysis • Production • Dissemination In the military, the commander’s Priority Intelligence Requirements (PIRs) are based on anticipated and stated priorities. PIRs are intended to fill a gap in the command’s knowledge and understanding of the battlefield or force threats. For example, will the enemy strike? If so, where, when, how, and with what force strength. This is how intelligence requirements are developed and the first step in the intelligence cycle. Source: The World of Intelligence and Counterintelligence The Intelligence Cycle is made up of processes and through a system of checks and balances. During planning whether in acquisition, policy or operations, the planners assess what they know, don’t know, or already have information. Thus, the requirements process begins. Managing Requirements Managing requirements has always posed challenges for senior officials in the intelligence business. For context, in the 1970s, intelligence requirements used for collection management and analysis priorities were contained in the Director of Central Intelligence’s Directive that used a priorities scale of one to seven, with one the highest. In a time of constrained intelligence budgets USS Pueblo SIGINT Collector there was severe competition for fulfillment of intelligence needs by senior policymakers and military commanders. 2 Staff officers quickly realized that if one’s priorities were ranked less than two, collection, processing, analysis, and reporting was problematic. Priorities were adjusted periodically by an interagency committee. The meetings of the interagency committee sometimes devolved into strong disagreements as advocates for a specific requirement would argue for increasing its priority. Over time the great majority of requirements were ranked one or two, effectively negating the value of a prioritization system. Eventually the senior leadership of the intelligence community recognized that the system was broken and needed to be changed. In 2003, the ODNI implemented the National Priorities Intelligence Framework (NIPF). The NIPF is the DNI's guidance to the IC on the national intelligence priorities approved by the president. It is a classified document that summarizes the United States' priority intelligence priorities for intelligence support. The NIPF is updated twice a year and coordinated among the individual agencies and organization in the Intelligence Community. One benefit of the NIPF is that it is reviewed by the National Security Council (NSC) and not left to a subordinate interagency mechanism. It gets everyone on the same page which is important in synchronizing the entire IC. One of the NIPF’s primary purposes and most important function is that it validates threats, and guides collection and analytical efforts. At the NSC, the requirements of the DoD, Departments of State, Homeland Security, Justice, Treasury, Energy, CIA, and other organizations are reviewed. This results in a longer-term perspective and balanced against immediate military operations support. The Council is the President's principal arm for coordinating policies among various government agencies and has a very important role in overseeing the intelligence priority process. Over the years, the military has demonstrated an insatiable appetite for intelligence, especially in wartime. The urgency of many military requirements has tended to squeeze out the fulfillment of less time-sensitive, but nonetheless important national requirements. This is because the capacity to provide intelligence support is limited – that is, intelligence is a scarce item, demand exceeds supply. This is also referred to as highdemand, low density intelligence, surveillance, and reconnaissance (ISR). 3 The limited capacities of national intelligence are one underlying rationale for the significant investments in intelligence, surveillance, and reconnaissance (ISR) capabilities made by the military services. The military services invest significant resources into operational and tactical ISR capability. Implementing Requirements The management of the implementation of requirements differs within the national intelligence community and in the homeland security and law enforcement intelligence communities. When the IC was initially established, the DCI was responsible for the satisfaction of intelligence requirements for many customers in government. The DCI established interagency committees to work on collection and analysis. For example, the SIGINT Committee, headed by a DCI official and with membership from all the IC agencies, reviewed, approved, and established the priority for all intelligence SIGINT Ground Station requirements that could be satisfied by the collection of signals intelligence. The Committee on Reconnaissance and Exploitation (COMIREX) did the same for satellite imagery collection. The requirements management approach has evolved as has the structure of the ODNI. The Director of NSA is delegated with the responsibility to meet the requirements of all SIGINT customers. NGA is responsible for managing GEOINT requirements. The National Clandestine Service, which reports to the Director, CIA, is responsible for clandestine HUMINT requirements. The National Intelligence Officers in the National Intelligence Council have assumed greater responsibilities interest. A requirement may result in multi-INT taskings to collect specific data. MASINT is probably the least known and understood intelligence collection discipline. The Defense Intelligence Agency’s Central MASINT Office (CMO), is the principal user of MASINT data. Measurement and Signatures Intelligence provide important collection capability against weapons of mass destruction target sets. For example, a requirement related to human rights and war crimes may result in tasking for the collection of intercepted communications, imaging of suspected burial sites, special reports from human sources with access, compilation of open source materials, and specialized technical collection (MASINT). 4 Measurement Signatures (MASINT) The IC uses automated systems to keep track of taskings related to requirements. While management of the high-level requirements is centralized, the implementation of requirements satisfaction is not. The agencies that manage technical collection operations, such as the NSA or NRO, operate computerized systems to direct the detailed operations of their collection systems. This optimizes their efficiency against the prioritized target set that reflects the DNIapproved underlying requirements. The tasking and control of technical systems is a very expensive part of the intelligence collection process. Fortunately, law enforcement and Homeland Security agencies subordinate their intelligence processes to this common NIPF so all agencies are operating under the same guidelines. Variation Among the Communities The requirements process within the DHS is relatively new. Intelligence requirements are primarily driven by the mission to detect and prevent terrorist acts. Unlike some of the foreign intelligence requirements in the NIPF, the homeland security requirements are time-driven by specific terrorist plots and focused on small cells or individuals. While there are some similarities with law enforcement intelligence requirements, the DHS is principally focused on preventing future terrorist acts, whereas, law enforcement intelligence often is retrospective and related to an event that has already taken place. 5 Homeland security intelligence requirements are less substantive and more procedural. The requirement to share and disseminate intelligence to state, local, and tribal law enforcement elements is an example. Later in this course we will examine the managerial challenges that come with homeland security intelligence requirements. The requirement processes for law enforcement differ from that established for the national intelligence community. The inclusion of vulnerability and risk assessments in the process is a significant difference from the primary threat analysis approach of the national security intelligence process. The law enforcement community had been using intelligence long before 9/11 and relied more on intelligence in support of criminal prosecutions more than prevention. Law enforcement and national security agencies face many of the same challenges. They need to detect threats based on raw information from a variety of reporting sources, recognize connections between disparate pieces of information, and create actionable analytical products. Intelligence sharing with other agencies is essential to prevent a criminal action or mitigate the impact of an event. Relationships, cooperation, and collaboration at all levels is critical to ensure that raw information is reported, shared with appropriate units, processed, and analyzed, and disseminated for more scrutiny and evaluation. Unfortunately, many times the puzzle is pieced together after the fact. The Intelligence Cycle - Supporting Law Enforcement The intelligence process is described in the National Criminal Intelligence Sharing Plan (NCISP), was adopted by the Department of Justice after approval by the U.S. Attorney General, the Director of the FBI and Secretary of the Department of Homeland in October 2003. In basic terms, the intelligence process is a cyclical process by which raw information is collected, evaluated, analyzed, and transformed into finished intelligence that decision-makers can use. 6 Planning and Direction Planning and direction are comparative to the Requirements Phase of the national security Intelligence Cycle with perceived areas of threat or risk are identified. Law Enforcement planning and direction is based on the identification and assessment of threats, and application of resources toward this threat. For example, in Canada’s Criminal Intelligence Service , increasingly uses law enforcement strategic targeting to address organized crime, and utilizing new resources, partnerships, and methods to combat the spread of international criminality. Collection Police collect information everyday using various methods and sources. Collection is what police do every day. Officers on the beat report incidents occurring. Citizens lodge complaints. An important element of law enforcement collection is the Suspicious Activities Report (SAR). These are products that serve the same function in the national intelligence model, but in the law enforcement community, these reports initiate action. Collection plans have primarily been used to produce short or long-term assessments of criminal groups and/or activities. The sources vary from open sources, to covert surveillances, to data from confidential informants and very like HUMINT collection. Processing and Collation Collection and analysis in the law enforcement field includes four activities: the reliability and validity of the raw information; the method by which the information was collected to ensure that it is within Constitutional parameters; the degree to which the information integrates with existing data; and, the final requirement, to de-conflict the results of multiple agency collection on similar or the same targets. Analysis Critical thinking, structured analytic techniques and creative thinking are applied to the data to extract the significant information from the data. Actionable intelligence refers to the intelligence information used to move forward an action or policy. As you go through the remaining weeks and readings of this course consider the analytical underpinnings of each case to discern the veracity of the evidence and decisions. 7 Dissemination Intelligence is of little value unless the right customer received it in a timely manner. This phase requires consideration of the issues of need to know versus need to share, a distinction that dictated change to the national security policy. The former DNI, James Clapper, called this the sweet spot between sharing and protecting information. The conditions under which law enforcement organizations share intelligence and information is governed by third agency rule restrictions including the prohibitions against sharing information from grand jury proceedings. Law Enforcement Sensitive markings are taken seriously. This is key in law enforcement intelligence because public outcry against ‘intelligence excesses’ which can have a very negative impact on police-community relations. Reevaluation The feedback and re-evaluation phase assessing if there is a return on investment in intelligence. This is also where the process re-starts, as new information might not only change the existing analysis but solve the case. The Intelligence Cycle in the Corporate World In the business intelligence realm, the implementation of requirements differs from organization to organization. Regardless of the approach or system used, the manager responsible for requirements must maintain a system and oversight process. This includes developing Key Intelligence Topics (KITs) to enable organizations to act in a proactive rather than responsive mode. There are three functional categories of an organization’s intelligence requirements that a manager should be permitted to define and refine before launching into capabilities and planning. Conclusion The Intelligence Cycle is the core process of intelligence for it provides a framework for all in the IC to follow. It provides management, structure, oversight, collaboration, and continuous evaluation. As a closed loop system, the intelligence cycle ends when the originator of the request provides feedback as to the value of the intelligence. The NIPF brought more order and efficiency to the requirements process. There will always be more intelligence requirements than collection assets and analytical resources, but it is time proven and has a history of success. But the IC must manage change and the impact that technological innovation is having on the intelligence cycle. Collection is streamed and has increased voluminously in the last 20 years. There is 24/7 global reach and the availability of real-time open source information from the public domain has yet to be realized. The large number of diverse sensors, and availability of multi-Int information is consuming and requires an accelerated intelligence cycle that can support the IC customer and consumer. 8 9