intelligence hs

05 June 2006 1

Gathering and Using Intelligence in Terrorism Investigations

Presentation

by

Harjit SANDHU

05 June 2006 2

“ “ If you know the enemy and know yourself, you If you know the enemy and know yourself, you need not fear the results of a hundred battles.” need not fear the results of a hundred battles.”

““If you know yourself but not the enemy, If you know yourself but not the enemy, for every victory you will suffer a defeat.” for every victory you will suffer a defeat.”

““If you know neither yourself nor the enemy, If you know neither yourself nor the enemy, you are a fool and will meet defeat in every you are a fool and will meet defeat in every battle. ”battle. ”

- Sun Tzu, 500 BC- Sun Tzu, 500 BC The Art of War (Sunzi bingfa)The Art of War (Sunzi bingfa)

“What enables an intelligent government and a wise leadership to overcome others and achieve extraordinary accomplishments is…

foreknowledge

Foreknowledge can not be gotten from ghosts and spirits, can not be had by analogy, can not be found out by calculation.

It must be obtained from people, people who know the conditions of enemy.”

05 June 2006 4

Technology can not substitute humans.

is information that has had value added.

Intelligence Intelligence

“Intelligence” has many definitions in the filed of investigations.

“Information” is often referred to as intelligence.

However, in the simplest of terms “Intelligence” is information that has had some value added, that explains what that information may mean.

605 June 2006

Overview of Intelligence Cycle Intelligence is not static but a dynamic

concept. To be useful, it is essential to put in place

a proper mechanism for management of intelligence.

To understand the true potential of intelligence, one must understand the intelligence cycle.

Intelligence Cycle: helps organize one’s information Identifies gaps in one’s analysis

705 June 2006

Intelligence Cycle Cyclical in nature Always reviewing after each stage Used in everyday life Never ends

Processing(evaluation &

Collation)

Processing(evaluation &

Collation)

Analysis

Dissemination

Planning

Collection

INTELLIGENCE CYCLE

05 June 2006 9

Stages of the Intelligence Cycle

PlanningCollectionEvaluationCollationAnalysisDisseminationFeedback

05 June 2006 10

The Intelligence CycleThe Intelligence Cycle

EVALUATIONEVALUATION

COLLECTIONCOLLECTION

COLLATIONCOLLATION

ANALYSISANALYSIS

DISSEMINATIONDISSEMINATION

RE-EVALUATIONRE-EVALUATION

PLANNING

05 June 2006 11

Planning

The Plan Informal Formal

Types of Tasking Self initiated Policy related National Level Case Specific

05 June 200605 June 2006 1212

PlanningPlanning

Identify the questions that Identify the questions that need to be answeredneed to be answered

Who? Who? What?What? When?When? Where?Where? Why?Why? How?How?

The Intelligence CycleThe Intelligence Cycle

COLLECTIONCOLLECTION

The directed, focussed gathering of information through overt and covert means from all possible sources including law enforcement and non-law enforcement agencies and individuals

05 June 2006 14

Sources of Information collection

Confidential Informants Undercover Operation Previous Investigations Information Storage and Retrieval Systems Personal Surveillance Technical Surveillance Interchange Open Sources Interviews Interrogation Debriefing use of legal instruments (such as search warrants and

subpoenas) to obtain information from protected sources or uncooperative subjects

The Intelligence CycleThe Intelligence Cycle

EVALUATIONEVALUATION

Grading the worth of the source and the substance of the information.

Transmitting an assessment of the worth of a piece of information to all its subsequent readers.

COLLECTION

EVALUATIONEVALUATIONThe Admiralty The Admiralty

SystemSystem

Grade Definition

A= Completely Reliable

B = Usually Reliable

C = Fairly Reliable

D= Not Usually Reliable

E = UnreliableF = Cannot be Assessed

SOURCE RELIABILITY SOURCE RELIABILITY ScaleScale

Grade Definition

1 = Confirmed

2 = Probably True

3 = Possibly True

4 = Doubtfully True

5 = Improbable

6 = Cannot be Assessed

INFORMATION INFORMATION VALIDITY ScaleVALIDITY Scale

EVALUATIONEVALUATIONThe Admiralty The Admiralty

SystemSystem

A1A1 = Completely reliable (source and the information is

confirmed)

F3F3 = Source cannot be assessed but the information is possibly true

EVALUATIONEVALUATION

The Admiralty SystemThe Admiralty System

05 June 2006 19

Three point classification• UNMIK uses the 3rd digit also, such as A/1/5.

• Handling Code 1:• May be disseminated to non EU law enforcement agencies where no adequate safeguards

exist • (permission from HOU /HOI before dissemination)

• Handling Code 2:• May be disseminated to non-prosecuting organisations operating within Kosovo• (permission from Desk Office before dissemination)

• Handling Code 3:• May be disseminated to other law enforcement and prosecuting agencies, where adequate

safeguards for the rights of individuals exist, including law enforcement within the EU / USA • (permission from Desk Office before dissemination)

• Handling Code 4:• Only disseminate within originating agency / force. Specify internal recipient (s)

• Handling Code 5:• No further dissemination. Refer to the originator.

Factors affecting Evaluation“ What people perceive, and how they process the information are influenced by multiple factors. These factors or influences include:

•past experience,

•education,

•“cultural values”

• role requirements,

•organizational norms

•information received.” (Heuer)

Some Evaluation Pitfalls

• Single source evaluation• Perception and Analyst Bias• View of the facts• Mind-set• Prejudice• Lack of knowledge • Cognitive Dissonance

05 June 2006 22

Evaluation

“An authoritative evaluation of sources will ameliorate inconsistency, lack of clarity, substantive bias, and poorly supported judgment.”

-Richards Heuer, Jr in “Psychology of Intelligence Analysis”

05 June 2006 23

Evaluation Summary

Look beyond what is in front of you?

Think out of the box Just because it is in

print, does not mean it is true?

Can be trial and error – use your experiences and that of others around you.

The Intelligence CycleThe Intelligence Cycle

COLLATIONCOLLATION

The storage, integration and retrieval of information produced by the collection phase (after irrelevant and incorrect information has been removed).

Must be properly indexed, cross referenced and readily accessible to enable rapid and efficient use.

COLLECTION

EVALUATION

05 June 2006 25

Collation involves …Collation involves …o Filtering out non-Filtering out non-

relevant informationrelevant informationo Orderly Orderly

arrangement of arrangement of remaining remaining informationinformation

o Brings into focus Brings into focus relationships relationships

o Highlights Highlights information gapsinformation gaps

05 June 2006 26

Methods of Collation

Must identify the best tool for the assignment

Electronic Methods Databases – Excel – Access Data mining /Data Warehousing

Manual Methods – Organization of paper files Creating index system

The Intelligence CycleThe Intelligence Cycle

ANALYSISANALYSIS

The heart of the Intelligence Process and the most critical component in the Intelligence Process.

The assembly of “bits and pieces” of information so as to establish pattern or meaning.

The development of hypotheses based on the pattern(s) revealed.

Time to utilise the Analysis

tools & techniques.

COLLECTION

EVALUATION

COLLATION

05 June 2006 28

Analysis

.

Analysis is the interpretation interpretation of the collected information or intelligence

Analysis looks beyond the facts as gathered

- it determines what the facts mean

We compare, contrast, and review data, looking for what is there and also what is missing…

05 June 2006 29

Types of Analysis

@ Tactical Analysis

@ Strategic Analysis

@ Case Analysis

@ Link Analysis

@ Pattern Analysis

@ Movement Analysis

@ Telephone calls Analysis

05 June 2006 30

Types of Analysis- contd.

@ Content Analysis

@ Activity-flow Analysis

@ Association Analysis

@ Record Analysis

@ Descriptive Analysis

@ Geographic Distribution Analysis

05 June 2006 31

Types of Analysis- contd.

@ Indicator Analysis@ Net-worth Analysis@ Statistical Analysis@ Warnings/ Vulnerability and

Threat Analysis@ Visual Investigative Analysis

The Intelligence CycleThe Intelligence Cycle

The LOOP back from Analysis to Collection is made whenever we discover we are unable to make a proper analysis due to lack of, or inaccurate, information.

Clarify the facts by repeating the Intelligence Cycle.

ANALYSISANALYSIS

COLLECTIONCOLLECTION

EVALUATIONEVALUATION

COLLATIONCOLLATION

The Intelligence CycleThe Intelligence Cycle

DISSEMINATIONDISSEMINATION

The distribution of the results and products of the Intelligence Process.

Need to know basis.

Operational - Short Term

Strategic - Long TermANALYSIS

COLLECTION

EVALUATION

COLLATION

05 June 2006 34

Going through the four previous intelligence processes of collection, evaluation, collation, and analysis are of little use unless the information/intelligence/product is made available to the right people.

It is also important that the availability of the intelligence is timely. That is to say that it is disseminated: in time for the target audience

to act on it in the appropriate manner

05 June 200635

Disseminated information

should be the three “C’s”

• CLEAR

• CONCISE

• CLOCK (in time for the target audience to act)

05 June 200605 June 2006 3636

Intelligence, unlike French Wine, Intelligence, unlike French Wine, does not get better with age.does not get better with age.

Good timely intelligence is absolutely a Good timely intelligence is absolutely a must for any successful operation.must for any successful operation.

05 June 2006 37

Dissemination includes..

•Written reports

•Oral presentations and briefings etc.

05 June 2006 38

Oral Briefings

Time Saving

Direct Contact

Current and up to-date

05 June 2006 39

Be Prepared

Don’t get caught with your pants down !!

Oral BriefingsOral Briefings-The risk-The risk

The Intelligence CycleThe Intelligence Cycle

RE-EVALUATIONRE-EVALUATION

Considering the process, product and its use to identify what can be improved:

Effectiveness of Reporting

Results of Analysis

Staff Deployment

Determine Priority

DISSEMINATION

ANALYSIS

COLLECTION

EVALUATION

COLLATION

05 June 2006 41

Feed Back is very important

“ I have never thought of myself

as a good writer. Anyone who

wants reassurance of that should

read one of my first drafts. But

I’m one of the world’s great re-

writers.” James A. Mischener

05 June 2006 42

Feed Back comes from several sources

The review process The intended customer If further disseminated,

outsiders

05 June 200605 June 2006 4343

Re-evaluation- Re-evaluation- closing the loopclosing the loop

– Was the report relevant and reliable?Was the report relevant and reliable?

– If recommendations were made in If recommendations were made in the report, these need to be the report, these need to be tracked?tracked?

– Remember – the cycle is cyclical – Remember – the cycle is cyclical –

and we will always be re-visiting the and we will always be re-visiting the

stages.stages.

– In other words – An Intelligence In other words – An Intelligence analyst’s work is never finished…analyst’s work is never finished…

05 June 2006 44

Intelligence has.. Two objectives:

1. Proactive: to prevent commission of crime

2. Reactive: to help solve a crime that has already taken place (use in investigation).

05 June 2006 45

Intelligence types

• Strategic- for knowing capabilities and

vulnerabilities of target entities (long –term)

• Operational- for planning and conducting specific

operations

• Tactical- for planning local tactical activities

05 June 2006 46

Counter-Intelligence The crooks too adopt measures

similar to the one we use and employ informers to collect intelligence about the activities of the enforcement machinery

It is therefore necessary that planning process takes into account this factor and put in place counter-intelligence machinery

05 June 2006 47

Counter-Intelligence The purpose of Counter-intelligence is:

To impede and neutralize hostile intelligence operations;

To protect classified intelligence

Three factors need to be kept in mind: Recruitment Corruption Counter-counter Intelligence

05 June 2006 48

Sun Tzu’s 5 types of secret agents

Local agent- from among people of locality Inside agent- hired from among disaffected

officials Reverse agent/ renegade/double agent-

hired from among the terrorist agents Dead agent- transmits false information to

terrorists Living agent- comes back to report

This presentation was made on 05 June 2006

atPort of Spain, Trinidad & Tobago

as part of the Commonwealth Project on Capacity Building in Combating Terrorism

Harjit Sandhu

E-mail: harjitss@aol.comsandhu@un.org

Telephone: +31-70-512-5732+31-652 632 570