Criminal Intelligence for Analysts PDF

Vienna International Centre, PO Box 500, 1400 Vienna, Austria Tel.: (+43-1) 26060-0, Fax: (+43-1) 26060-5866, www.unodc.org Criminal Intelligence...

Vienna International Centre, PO Box 500, 1400 Vienna, Austria Tel.: (+43-1) 26060-0, Fax: (+43-1) 26060-5866, www.unodc.org Criminal Intelligence Manual for Analysts United Nations publication Printed in Austria *1058435* V.10-58435—April 2011—100  UNITED NATIONS OFFICE ON DRUGS AND CRIME Vienna Criminal Intelligence Manual for Analysts United Nations New York, 2011 © United Nations, April 2011. All rights reserved. This publication was made possible through funding received from the Government of the United States of America. The designations employed and the presentation of material in this publication do not imply the expression of any opinion whatsoever on the part of the Secretariat of the United Nations concerning the legal status of any country, territory, city or area, or of its authorities, or ­concerning the delimitation of its frontiers or boundaries. This publication has not been formally edited. Publishing production: English, Publishing and Library Section, United Nations Office at Vienna. Contents 1. An introduction to intelligence.......................................... 1 2. The intelligence process................................................ 9 3. Example of a national intelligence model: the United Kingdom................ 17 4. Evaluation of source and data........................................... 25 5. Analysis and analytical process........................................... 29 6. Basic analysis techniques: link analysis..................................... 35 7. Basic analysis techniques: event charting................................... 49 8. Basic analysis techniques: flow analysis.................................... 53 9. Basic analysis techniques: telephone analysis................................ 59 10. Inference development................................................. 65 11. Presentation of results.................................................. 71 Annex I. Sample: criminal information and intelligence guidelines................ 81 Annex II. Making recommendations........................................ 87 Annex III. Criminal Intelligence Databases.................................... 89 iii 1.  n introduction to A intelligence FROM INFORMATION TO INTELLIGENCE Before we can properly discuss and explore information, intelligence and analysis in theoretical and practical terms, we need to have some common understanding as to what these terms mean. Some definitions of these three key terms are as follows: Information - Knowledge in raw form Intelligence - Information that is capable of being understood - Information with added value - Information that has been evaluated in context to its source and reliability Analysis (of either information or intelligence) - The resolving or separating of a thing into its component parts - Ascertainment of those parts - The tracing of things to their source to discover the general principles behind them - A table or statement of the results of this process Understanding properly the difference between these terms and how they interact is important, however even at this early stage, these definitions point to key differences. Information is quite simply raw data of any type, whilst in contrast intelligence is data which has been worked on, given added value or significance. INFORMATION + EVALUATION = INTELLIGENCE The way in which this transformation is made is through evaluation, a process of considering the information with regard to its context through its source and reliability. In its simplest form, intelligence analysis is about collecting and utilizing information, ­evaluating it to process it into intelligence, and then analysing that intelligence to produce products to support informed decision-making. 1 2 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS All these decisions involve applying our natural ability to “analyse” information, an overall ­process which can be usefully broken down into a series of stages, or questions we ask of ourselves, as follows: "" What exactly is the problem; what decision do we have to make and why is it significant or important? "" What information do we already have or might we reasonably obtain that could be relevant to the problem in hand. Where is it/how can we get it? "" What meaning can we extract from the information; what does it tell us about what’s going on? "" Is there only one possible explanation, or are there other alternatives or options. Are some more likely than others? "" How do these affect the decision we have to make, are some options potentially better than others; do some carry greater risk of success and/or failure? "" Are we ready to take action with a reasonable level of confidence, or do we need to gather more information first? If so, what else do we need and where/how can we get it? The process of applying these questions, evaluating the answers, and then choosing how to respond, to act, is the essence of what analysis is about. By bringing this process under our conscious control, we can monitor it, develop and improve it, and subject it to quality checks which can be quite complicated to grasp. Beginning that development of awareness and skill is critical. The practical advantages of developing an ­individual’s analytical skills are many, but can be summarized as follows: ANALYSIS GOES BEYOND THE FACTS It can tell you how good (or poor) your information/intelligence is It can tell you things you didn’t know before It can tell you what you need to know to understand a situation It can tell you where to look further It can help you to communicate your understanding to others The origins of intelligence analysis Knowledge has the potential to be equated to power. The concept of collecting and utilizing information to support decision making in some formal, structured way is nothing new. In order to obtain advantage over adversaries, it is imperative to possess the most up-to-date, accurate information regarding amongst other things, their intentions and capabilities. This rule applies in every field, be it politics, business, military strategy, or criminal intelligence. In ­addition, it is a process that has always been, and still is, continually developing and evolving, in response to changes in social/cultural factors, technology, organizational needs, and new/ higher levels of analytical skill. Reviewing the historical background, the “roots” of intelligence and analysis as a process and as a profession is a useful and important exercise. Raising our understanding of the origins of intelligence and analysis helps us to understand both where we are now and how/why we  AN INTRODUCTION TO INTELLIGENCE 3 arrived at this point. It also raises our awareness of how intelligence analysis is a continually changing, evolving practice, which if it is to remain relevant and useful in a practical sense constantly needs a fresh, flexible approach, new ideas, new skills, new techniques. The one constant for the professional intelligence analyst is that no two tasks or projects are ever exactly the same; every new piece of work requires a fresh approach. There are many examples throughout history of military, religious and community leaders actively tasking individuals with information-gathering exercises and then basing their decisions on the information obtained in this way. Perhaps the earliest recognized text on the subject of information gathering and intelligence-based actions is “The Art of War, The Art of Strategy” written in the 5th Century BC by Sun Tzu, a Chinese mercenary warlord. He was renowned for his ability to command military campaigns whose success owed a lot to his effective ­information-gathering and intelligence-led decision-making. It says much for the quality of this work that it still remains in print today, and is essential reading for military and corporate strategists and intelligence operatives worldwide. From these early beginnings throughout history until relatively recent times, employing information-gatherers for primarily military goals has been a common trend. What is more, a methodology arose from this process that basically involved direct contact between the information gatherer(s) and the client/decision-maker, as illustrated on figure 1-1: Figure 1-1. Basic tasking model Product (decision or action) CLIENT Instruction Raw tasking information support INFORMATION GATHERER(S) This method had certain notable features: 1) The sheer logistics involved (no real technology for transport or communication) created a massive time delay between the tasking of the information gatherer, the obtaining of the information, and the delivery of the information to the “end-user”. 4 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS 2) Using information collectors who operated by visiting locations and witnessing events either personally or through intermediaries guaranteed that the information collected would be limited by their senses and their ability to remember accurately what they saw; such infor- mation would thus always be highly subjective, and tend towards being based on opinion rather than fact. 3) The volume of information collected in return for such a large investment of time and resources would be extremely small. Any investigation generates vast amounts of information; the larger the enquiry, the more information the investigator has to deal with. The problem for investigators is that no matter how good the system used to store all this information, they are always limited by their own mental capacity to embrace the information as a whole, to “take it all in” at once. This understanding of the whole of the information is crucial to valid decision-making. Fully understanding a small part of the whole information available means that in fact the investiga- tor only has partial understanding of the whole situation. Partial understanding must incorporate a degree of misunderstanding. Misunderstanding leads to poor conclusions. It might reasonably be taken as some measure of the importance and value of intelligence and analysis that despite these potentially crippling limitations the process still proved to be a decisive factor in the success of military and political campaigns throughout these times. Methods in acquiring information changed only slowly throughout history until towards the end of the last century. The massive growth in technology that began then, and still continues today, brought about what has proved to be a massive change in methods of information- gathering, which in turn created a demand for new approaches to analysis and intelligence. This process began in the late 19th Century with the advent of telegraphy and telephony, which allowed for messages to be sent almost instantaneously over greater and greater distances. At a stroke this removed the resource and time problem that the former methods suffered through their need for the information gatherer to move between source and client. This change carried with it a number of benefits. Firstly, the “response time” between a client asking for information and receiving the result was vastly reduced; this represented a clear benefit in that it improved the clients’ ability to react quickly on the basis of such information. In addition, this development also had a knock-on benefit in that there was less time for the information source to “forget” or “lose” information whilst they were in transit, thus the quality of information also improved. Similarly, the lack of need for the information to be physically carried back to the client created a vast saving in resources; information gatherers were able to spend less time travelling/passing on information, and thus more time collecting information. The overall result of this change was ironically that these benefits also carried with them a new problem for the client. Much larger quantities of information were gathered, far more quickly than before, and the reaction time for making decisions was reduced. In addition, controlling the process of information-gathering itself became a problem, with a new need for more ­emphasis on new tasks and orders for information-gatherers created as a result of their new, improved performance.  AN INTRODUCTION TO INTELLIGENCE 5 Thus where before the process involved information passing between information gatherer and client, because the new system created an information “overload”, a new problem arose in that the client simply was unable to process all the information received effectively and quickly and then react to it. The analyst A necessity arose for the client to return to a situation that enabled speedy interpretation of information and decision-making. This created a need for an intermediate stage between the information gatherer and the client, where the bulk of the information could be received, recorded, evaluated and examined to interpret and extract meaning, before the result of this process was passed to the client. This was the origin of the function of an analyst, and the process remains in essence the same today, as illustrated on figure 1-2:1 Figure 1-2. Developed tasking model Product (decision or action) CLIENT Decision/ Intelligence action ANALYST Instruction Raw information/ tasking intelligence support INFORMATION GATHERER(S) 1 The analyst may be supplied with raw information or with evaluated information in the form of intelligence, or with both. 6 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS The core function of the analyst can be broken down into a three-phase process, as follows: "" To gather information, to understand it and the relevance or relationship of each piece to all of the others. "" To develop this information objectively to arrive at an understanding of the whole. "" To communicate this understanding to others and so to put the intelligence process to practical use. The problems As this new methodology developed, and the variety, range, and accessibility of information sources expanded, the result was that relatively speaking, the “analyst” function grew in size, number and influence. Simply put, as more information was passed back to the “centre”, and more reliance placed on intelligence-led decision-making, organizations found that more and more people were required to evaluate information in order to generate, disseminate and analyse intelligence. This ongoing situation has implications for today’s intelligence units and analytical staff. The more information that is collected, the more it aids analysis and thus decision making. However it also increases the subsequent workload, which in turn forces an increase in staff and ­productivity or a loss of effectiveness. In simple terms the increase in information to be analysed combined with the increased need for analytical product tends to always exceed the improved efficiency that having more/better trained analysts can offer. In other words, effective, ­professional analytical process tends to bring more work upon itself. Criminal intelligence analysis What is “criminal intelligence”? To most people, including criminal investigators, the term conjures up images of collator-style systems used to store and retrieve the information we ­collect about crime and criminals. As the volume and variety of the information we collect has expanded, we have gradually introduced more and more complex systems to assist with its storage and retrieval. Viewed in this limited context, the introduction of information ­technology (IT) has been a notable success; the use of IT for the storage and retrieval of crime ­information is now almost second nature to the operational criminal investigator, and there is no doubt that without these tools, as a service we simply would not be able to cope with the task of recording and collating criminal information. Collecting information in itself does not result in obtaining intelligence. Information must be properly evaluated before it can be acted upon. The value of criminal intelligence can be enhanced further by analysis. When available intelligence is too complex and large in volume for simple action, it must be analysed in order for meaningful results to be obtained. Currently, insufficient use can be made of the information we collect on crime or criminals to develop real “criminal intelligence” , either by intelligence units themselves or by their ­customers, the operational criminal investigators. Even with all the new systems for storage and easy access to criminal intelligence, investigators can still fail to make real use of this invaluable resource other than as a “ready reference” to the facts unless they properly evaluate this information and use analysts to analyse the intelligence that this process produces.  AN INTRODUCTION TO INTELLIGENCE 7 Criminal intelligence analysis (CIA) is a philosophy which sets out how we can approach the investigation of crime and criminals by using the intelligence and information that we have ­collected concerning them. It provides techniques that structure our natural deductive powers and thought processes, the “natural intuition”, which proficient investigators use subconsciously all the time. It also provides tools that help us to understand the information we collect, and to communicate that understanding to others. The way forward The criminal intelligence analyst is every bit as much an investigator of crime as the operational investigator. The key to CIA being of value as an operational tool is that the results of analysis have to be of direct value to the investigation. It follows then that the best results can only be achieved when the analyst and investigator work together in partnership, integral parts of the same team. In the same way, the analyst and detective need to share many of the same skills needed to be good criminal investigators. The basic problem for intelligence analysts is putting intelligence and information together in an organized way so that the difficult task of extracting meaning from the assembled information is made easier. Only when the proper explanation of what the original information means has been derived can this intelligence be put to practical use. The techniques and systems embodied in this manual are practical tools, which can be of value in any investigation. Intelligence analysis and organized crime The advent of criminal intelligence analysis is directly linked to the transformation of individual crime into organized or group crime. The effective use of intelligence is crucial to a law ­enforcement agency’s ability to combat criminal groups. Intelligence analysis also provides the agency with the knowledge required for effective management of its resources. With appropriate tasking, the products of intelligence analysis can assist in developing strategic plans to tackle current problems and prepare for future anticipated ones. Criminal intelligence analysis permits law enforcement authorities to establish a pro-active response to crime. It enables them to identify and understand criminal groups operating in their areas. Once criminal groups are identified and their habits known, law enforcement authorities may begin to assess current trends in crime to forecast, and to hamper the ­development of perceived future criminal activities. Intelligence provides the knowledge on which to base decisions and select appropriate targets for investigation. While the use of criminal intelligence analysis is appropriate to support investigations, surveillance operations and the prosecution of cases, it also provides law enforcement agencies with the ability to effectively manage resources, budget, and meet their responsibility for crime prevention. At the dawn of the last century, “organized crime” was synonymous with the Cosa Nostra. The picture of organized crime today is quite different. Many of the new criminal groups, with well-developed organizational structures, are established for obtaining power and wealth. These groups include outlaw motorcycle gangs, Russian organized crime, Asian organized crime, ­African organized crime, drug cartels and a myriad of street gangs—Asian, Korean, Hispanic, black, white supremacy, to name just a few. Levels of complexity are increasing even further with fluid almost structure-less networks evolving, such as West African criminal networks. It should be noted that cooperation between different organized crime groups and networks is commonplace. 8 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS Criminal groups continue to be involved in ventures such as trafficking in human beings, drug trafficking, extortion, fraud and murder. Some are now moving into new criminal enterprises such as high-technology crime. The explosion of Internet resources in the last few years has opened new opportunities for financial gain for criminals. This escalation of high-technology crime is a challenging and relatively new arena for law enforcement. Criminal organizations are more sophisticated and dynamic than ever before. The challenge for law enforcement is to be prepared for this increasing sophistication in order to reduce the impact of criminal activities on our communities. In order to accomplish this, law enforcement agencies need forward looking, assertive, and comprehensive strategies to counteract the threat of organized crime groups. Criminal ­intelligence analysis, when tasked and used effectively, can be a major asset in the law enforcement arsenal. Countries with greater experience within criminal intelligence, such as the United Kingdom, have developed national intelligence models to help standardize how criminal intelligence is used. Information technology is very much key to intelligence sharing. Particularly in this age of sophisticated multinational crime, including terrorism, a failure to share intelligence and ­information effectively limits the efforts of all states in combating it. 2. The intelligence process INTELLIGENCE The word intelligence can be used to describe the process of interpreting information to give it a meaning. It has also been used to describe a group or department that gathers or deals with such information or to describe the product of such activity or department. At its simplest, intelligence might be described as processed information. Narrowed down to law enforcement use, “intelligence” could be described as information that is acquired, exploited and protected by the activities of law enforcement institutions to decide upon and support criminal investigations. INTELLIGENCE: KNOWLEDGE (PROCESSED INFORMATION) DESIGNED FOR ACTION Intelligence always involves a degree of interpretation resulting in an inevitable degree of ­speculation and risk. The amount of speculation and risk is dependent upon the quality and quantity of information. Intelligence is usually divided in two main areas: Strategic intelligence: Focuses on the long-term aims of law enforcement agencies. It typically reviews current and emerging trends changes in the crime ­environment, threats to public safety and order, opportunities for controlling action and the development of counter programmes and likely avenues for change to policies, programmes and legislation. Operational intelligence: Typically provides an investigative team with hypotheses and inferences concerning specific elements of illegal operations of any sort. These will include hypoth­eses and inferences about specific criminal networks, ­individuals or groups involved in unlaw­ful activities, discussing their methods, capabilities, vulnerabilities, limitations and intentions that could be used for effective law enforcement action. A good knowledge of operational intelligence is a highly recommended pre­requisite to ­developing strategic intelligence capability. The development of operational intelligence in itself will provide an important source of intelligence to consider from a strategic perspective. 9 10 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS INTELLIGENCE Vs EVIDENCE It is important to emphasize that a state’s national legislation will dictate the way intelligence can be used for law enforcement purposes. The process of intelligence gathering in relation to a specific investigation is usually a prelude to any evidence gathering phase. Legislation will also dictate whether intelligence material gathered during the course of an investigation is protected from disclosure in criminal proceedings EVIDENCE: DATA FROM WHICH TO ESTABLISH PROOF This part of the investigation responds to reported events and explains what took place and who was involved. Intelligence analysis aids investigations by helping to target available resources and identifying information gaps to focus the investigation more clearly. It also helps to avoid duplication of effort and prevent straying into areas of no relevance. To obtain maximum benefit, an analysis capacity should be employed at the earliest possible stage of an enquiry, preferably at the beginning, although, logistically this is not always possible. THE INTELLIGENCE CYCLE The concept of the intelligence cycle is broadly recognized as the foundation of the intelligence analysis process, at both operational and strategic levels. Figure 2-1. The intelligence cycle Dissemination Tasking Inference Collection developement Analysis Evaluation Collation Direction/tasking Intelligence analysis is driven by the needs of clients, i.e. consumers of the analytical product. The analytical effort is thus often directed through tasking by these clients. They take the ­initiative at this stage of the cycle, but the principle of partnership requires that both they and the providers share a responsibility for working together to ensure that the requirements for the analytical product are clearly defined and understood by both sides.  THE INTELLIGENCE PROCESS 11 The initial questions that have to be asked are: "" Who tasks? "" How do they task? "" Why do they task? "" What tasks are set? In general these questions will be answered within the environment in which the analyst sits and therefore no hard and fast rules can be given in this respect. It is essential that a good client/analyst relationship exists in order for tasking to function effectively. The analyst must be objective, not influenced by preconceived ideas, but at the same time willing to accept the task without prejudice. Tasking can take two basic forms: "" The client expresses a requirement for an analytical product focusing on a subject or a range of subjects of concern. "" The client formulates a general expectation for the analytical provider regarding an area of risk, threat or opportunity. After the task has been clearly defined, the analytical unit commences its own planning for the remaining phases of the intelligence cycle. Collection The intelligence process relies on the ability to obtain and use data. However, the first and most basic problem to overcome lies with the collection and storage of this data which comes in many forms, from electronically retrievable to “hard copy”. COLLECTION: THE GATHERING OF DATA Care must be taken at this early stage to avoid data overload which is always a problem for any agency but data ignored because the provider believed it not to be relevant can cause problems later on. COLLECTION PLAN: A FORMALLY DEFINED APPROACH TO DESCRIBING THE INFORMATION NEEDED AND MEANS OF ACQUIRING IT The issue of planning all the activities in the intelligence process is particularly significant in the collection phase. In both operational and strategic intelligence analysis the topics and the scope of the analysis should be clear before considering further actions to be undertaken. A collection plan in which the information needed is identified, and the means of acquiring it are laid out, is imperative to ensure the orderly and precise collection of relevant information. 12 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS The collection plan should include the information categories that are important to the analysis, the specific data items needed to do the analysis, possible sources of information and sources to be contacted with specific requests, and a schedule to indicate when the information was requested and when it is needed by. In order to avoid “chaos”, a structured collection plan approach where the analyst is proactive, imaginative and explores all avenues to gain ­information is vital. The three main types of sources of information are open, closed and classified. "" Open source (OSINT) is information that is publicly available. One very notable subset of open source information is so called “grey literature”. It can consist of research, technical, economic reports, “white papers”, conference documentation, dissertations and theses, ­discussion papers, subject-related newsletters, etc. One of the main difficulties in working with this type of source is evaluation as information available in the public domain can frequently be biased, inaccurate or sensationalized. "" Closed source is information collected for a specific purpose with limited access and ­availability to the general public. Closed source information is often found in the form of structured databases. In the context of criminal intelligence analysis, these databases will largely include personal data collected as part of ongoing targeting operations, or broader criminal records, vehicle registration data, weapons licensing, etc. "" Classified is information collected by specifically tasked covert means including use of human and technical (image and signals intelligence) resources. Use of classified ­information can significantly enhance the quality of an analytical product, as it is usually highly accurate; however, it can also make an analytical product significantly less actionable due to ­restrictions on dissemination. The intelligence analyst must become an all-source analyst, i.e. selecting information sources for their relevance for the project rather than for availability or ease of access. An all-source analyst must avoid becoming a victim of a traditional concept that only closed or classified data sources are useful and contain valid and relevant data. The use of open sources often gives additional credibility to the final product or triggers off collection of further closed or classified information. Selection of sources can also be regarded from the angle of cost effectiveness. Use of open sources instead of deploying expensive covert assets may significantly reduce the budget for a collection exercise, or alternatively, permit the acquisition of more information within an estab- lished budget. Use of open sources can also help protect or conserve sources of closed and classified information. At the same time, as exploration of open sources often requires handling extremely large data volumes, an analyst involved in OSINT should receive specialist training in the subject or be supported by an OSINT expert. The ultimate objective of an operational intelligence analyst is to bring about the arrest of the criminal(s) under investigation and/or the disruption of a criminal group’s activities. The aim of the team should therefore be to develop the most useful sources and collect the information most likely to produce successful results. A common starting point is to identify the criminal’s associates—however, the objective should always be to identify relationships between individuals and their roles in the criminal activities, rather than identifying associates for their own sake. A major issue in a collection exercise is the language of the source. Intelligence analysis is particularly appropriate for investigations of organized crime activities, which very often have a cross-border dimension. Exclusion of information (including open source information) purely on the basis of language can have a seriously damaging effect on the quality of an analytical product. Language training of analysts is one solution. Use of translation software is another.  THE INTELLIGENCE PROCESS 13 An intelligence collection plan may contain the following elements: "" Problem definition—the intelligence problem needs to be precisely and clearly formulated "" Project aim—ideally a one-sentence definition of an intelligence requirement "" Project scope—it expands the definition of the project aim and sets out the actions expected from the analyst. It also contains a detailed description of the scope and purpose of ­collection measures and sources. Evaluation The validity of an inference is directly linked to the quality of the data behind the inference. Thus data evaluation is a key element of the intelligence cycle. It should be conducted ­simultaneously with or immediately after its acquisition, to ensure that the evaluation takes place within the context in which information had been acquired (as it is difficult to evaluate information that has not been submitted correctly within a local environment). Evaluation requires a separate assessment of the reliability of the source (the provider of the information) and validity and accuracy of the information. EVALUATION: AN ASSESSMENT OF THE RELIABILITY OF THE SOURCE AND THE QUALITY OF THE INFORMATION The source and the actual information must be evaluated independently of each other and therefore it is imperative that the person completing the report has a sound knowledge of the evaluation system. The two most widely used systems are 4 x 4 and 6 x 6 (See chapter 4 “Evaluation of source and data” for further details of this key process). Collation Collation is transfer of collected information and/or intelligence into a storage system (be it a filing cabinet or a computerized data base) in a structured (indexed, cross-referenced) format that permits rapid and accurate access. It is not equivalent to bulk filing of every bit of ­information or document acquired during collection. Irrelevant, incorrect and otherwise useless information is weeded out. COLLATION: THE ORGANIZATION OF THE DATA COLLECTED INTO A FORMAT FROM WHICH IT CAN BE RETREIVED AND ANALYSED Data integration and analysis The analysis stage of the intelligence process is a key one. Analysis can be described as in-depth examination of the meaning and essential features of available information. Analysis highlights information gaps, strengths, weaknesses and suggests ways forward. ANALYSIS: THE CAREFUL EXAMINATION OF INFORMATION TO DISCOVERS ITS MEANING AND ESSENTIAL FEATURES 14 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS The analytical process is aimed at the use and development of intelligence to direct law ­enforcement objectives, both for short-term operational aims and for long-term strategic reasons. The scope of analysis and its overall credibility depends on the level and accuracy of acquired information, combined with the skills of the analyst. Analysis is a cyclical process, which can be performed to assist with all types of law enforcement objectives. Different types of crimes and criminal operations require different scenarios, but in all cases the information used should not be pre-filtered through an artificially and arbitrarily imposed selective grid. Data integration is the first phase of the analytical process. It involves combining information from different sources in preparation for the formulation of inferences. Various techniques may be used to display this information, the most common being the use of charting techniques. "" Link charting—to show relationships among entities featuring in the investigation "" Event charting—to show chronological relationships among entities or sequences of events "" Commodity flow charting—to explore the movement of money, narcotics, stolen goods or other commodities "" Activity charting—to identify activities involved in a criminal operation "" Financial profiling—to identify concealed income of individuals or business entities and to identify indicators of economic crime "" Frequency charting—to organize, summarize and interpret quantitative information "" Data correlation—to illustrate relationships between different variables The next step in the analytical process is interpretation or logical reasoning, which requires going beyond the facts. The disciplined approach to analysis requires the maximum amount of information to be assessed at the time of integration to determine its relevance. Excluding information at the beginning of the process can easily lead to the significance of a vital piece of information being overlooked. This can lead to incorrect analysis, which can ultimately jeopardize an enquiry. Analysis often identifies additional projects that are tangential to the original one. In the past, it was usual to undertake these projects simultaneously and in conjunction with the main one. This approach led to dispersing of resources, delays and overall lower quality of the final product(s). Through experience, it has now become accepted that analytical projects should be undertaken sequentially, one at a time, or by independent teams of analysts. Data description and integration techniques, like link analysis, are not an end in themselves. They are simply tools used by analysts in the process of deriving meaning from information. The first truly analytical product is an inference. An inference comes from the premises—one common mistake is to intuitively develop an inference and then look for premises that would support it. This emphasis on the primacy of premises should be reiterated by means of a ­statement such as “the premises that led me to my inference are…” and not “the premises ­supporting my inference are…” (When presenting results, however, the starting point is the inference—the big idea—followed then by premises from which it came). A “premise” in inference development is used to identify facts or pieces of information that go together to make a particular point. Premises are the first and key stage in the true process of data analysis as against data description. Understanding how premises are identified is crucial to developing inferences. Premises are the closest link to the described information, and thus are the most objective and accurate representation of data. For any given set of premises derived from a particular set of information, the premises may be combined in different ways to suggest different inferences.  THE INTELLIGENCE PROCESS 15 There are four types of inferences: "" Hypothesis—a tentative explanation, a theory that requires additional information for ­confirmation or rejection. "" Prediction—an inference about something that will happen in the future. "" Estimation—an inference made about the whole from a sample, typically quantitative in nature. "" Conclusion—an explanation that is well supported. It should be noted that all inferences require testing in some manner before they can be accepted as fact. Dissemination An intelligence analyst has the responsibility of disseminating analytical products to targeted audiences, as appropriate. Much of the routine dissemination may be conducted by way of short notes. But intelligence analysts should be able to give oral briefings on larger ­investigations and write structured reports detailing the currently available information. DISSEMINATION: THE RELEASE OF THE RESULTS OF ANALYSIS TO THE CLIENT Throughout the whole process the client will have been in close consultation with the analyst, and would have been asked on numerous occasions to answer questions relating to the particular project. The dissemination process can take various forms, such as: "" Structured formalized reports "" A structured and formal oral presentations with supporting documentation "" Weekly overviews in the form of bulletins "" Ad-hoc briefing to intelligence and investigative teams The dissemination phase completes the initial cycle of the intelligence process. Re-evaluation Re-evaluation involves a continual review of the whole intelligence cycle to identify ways in which any stage of the cycle can be improved. To be of most value, re-evaluation should occur throughout the process, not merely be left to the last stage of the cycle. Re-evaluation can be directed at: "" Process "" Analytical product "" Use of the analytical product "" Effectiveness of reporting 16 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS "" Staff deployment "" Priority setting "" Analyst’s perspective "" Client’s perspective Intelligence activity is a collective process, as opposed to something one person or a group of people do as individual entrepreneurs. 3. E  xample of a national intelligence model: the United Kingdom The National Intelligence Model (NIM) of the United Kingdom is based on two premises: 1. There are three levels of crime in the United Kingdom: single-jurisdictional, multi-juris- dictional, and international. These are designed to impact on criminal business on all three levels: "" Level 1—Local issues—usually the crimes, criminals and other problems affecting a basic command unit or small force area. The scope of the crimes will be wide ranging from low value thefts to murder. The handling of volume crime will be a particular issue at this level. "" Level 2—Cross-border issues—usually the actions of a criminal or other specific problems affecting more than one basic command unit. Key issues will be identification of common problems, the exchange of appropriate data and the provision of resources for the common good. "" Level 3—Serious and organized crime—usually operating on a national and international scale, requiring identification by proactive means and response primarily through targeted operations by dedicated units and a preventive response on a national basis. 2. The desired outcomes of law enforcement are: community safety, crime reduction, criminal control and disorder control. The Model achieves this through four prime components which are fundamental to achieving the objective of moving from the business of managing crime, criminals, disorder and problems to the desired outcomes of community safety, reduced crime, and controlled criminality: "" Tasking and coordinating process "" Four key intelligence products "" Knowledge products "" System products. Tasking and coordinating process Tasking and coordination group meetings are chaired by a senior manager of a command unit who has the authority to deploy the necessary resources and comprise of people with key functional responsibility for the planning and execution of the law enforcement effort. 17 18 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS Strategic tasking is aimed at the setting up or amending the control strategy (i.e. priorities for intelligence, prevention and enforcement) and, having set the priorities, to make the principal resource commitments. Tactical tasking is aimed at commissioning and applying the tactical menu to the control strategy, responding to new needs and monitoring of implementation of agreed plans. The ­tactical menu comprises four elements: "" Targeting offenders in line with the priorities of the control strategy; "" The management of crime and disorder hot spots; "" The investigation of crime and incidents which can be shown to be linked into “series”; "" The application of a range of “preventive measures” such as closed-circuit television (CCTV) and lighting schemes or community action initiatives. Production of the intelligence products—the creation of the intelligence products requires the same commitment to resources and direction from the tasking and coordination group as the drive for intelligence capability. The key intelligence products are the “deliverables” by which intelligence-led policing can be implemented and its impact measured in terms of crime reduction, arrests, disruptions and enhanced community safety. Intelligence products are the result of the collaboration between analysts and intelligence officers in which the raw information is collected, analysed and ­interpreted, and represented with recommendations about required decisions or options for action. The intelligence led approach to law enforcement requires only four broad classes of intelligence product as shown in table 3-1 following: Table 3-1. Four categories of intelligence product Product Aim Purpose Description To identify the To establish law "" Aim (terms of reference) longer-term issues in enforcement priorities, "" Scope (functional/geographic) 1. Strategic assessment an area, as well as the determine resource scope of, and allocations, support "" Current situation/survey ­projections for growth business planning and "" Main objectives set/met in criminality. inform senior managers "" Progress since last assessment and policymakers; To set a control strategy: "" Major areas of criminality priorities for intelligence, "" Demographic/social problems prevention and "" Patterns/trends enforcement. "" Resource constraints (overview/ summary) To identify the To assist in the "" Current situation—progress on shorter-term issues in ­management of current ­targeting; crime and other series; 2. Tactical assessment an area this, with operations and plans, as hot spots; preventive measures prompt action, can well as reallocate "" Options for further action prevent a situation resources and efforts from deteriorating or according to changing "" Advantages/disadvantages. Best developing. needs and problems. courses of action "" Timeframe (short/medium) To monitor progress "" Resource implications/changes on current business in the “tactical menu”.  EXAMPLE OF A NATIONAL INTELLIGENCE MODEL: THE UNITED KINGDOM 19 Product Aim Purpose Description To provide a detailed To assist operational "" Personal record picture of the management in select­ing "" Criminal record (­potential) offender targets, guiding 3. Target profile "" Financial profile and his associates for ­investigations, shaping subsequent action. plans and maintaining "" Network/associations report supervision. "" Communications report "" Transport report "" Surveillance appraisal "" Intelligence gaps To identify established To assist management in "" Problem identification and emerging crime/ resourcing investigative "" Background and causes 4. Problem profile incident series and needs, targeting, hot crime hot spots. spot management, "" Scale of damage directing crime­ reduction "" Level of disorder/offending initiatives and crime- "" Perpetrators prevention measures. "" Internal/external links "" Social impact "" Resource implications Prioritization of intelligence work—a major responsibility of the tasking and coordination group is to resource, direct and sustain intelligence capability. For intelligence work to be fully ­effective, it needs adequate assets (sources, people, knowledge products, system products) and disciplines which ensure that intelligence activities follow the identified strategic and tactical priorities. Sources of information should not be limited to either reactive or proactive work. Much ­valuable data exists within the results of existing reactive work. A sufficient proactive capability is also essential. An investment in the right people for specific roles is a significant benefit. Three major ­components of work exist: data management, analysis and specific intelligence collection. The intelligence manager is the essential catalyst for bringing the business of the command unit, the intelligence collection and analysis together. All intelligence work should be supported by knowledge and system products. Knowledge products They represent a range of products, either local or national, which define the rules for the conduct of business or best practice by which skilled processes are completed, and under what conditions work between agencies may take place. The “knowledge products” approach also represents a useful way to manage gap analysis in moving personnel issues forward to a more professionally based intelligence regime for law enforcement. "" National intelligence model "" Data protection guidelines "" Codes of practice 20 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS "" National manuals and standards for: - Recording and dissemination of intelligence - Surveillance - Undercover operations and test purchases—Use of informants - Interception and accessing communications related data—- Case law on covert techniques - Local research and data access protocols - Local inter-agency access protocols - Intelligence training System products System products enable the collection, reception, recording, storage, use and dissemination of information. Broadly, they can be grouped into three types: "" Provision of access to means for data storage, retrieval and comparison during the research process access to large quantities of readily available law enforcement and other relevant data is the backbone of intelligence-led policing. Combination of nation-wide systems with the more local and specialized ones provides enormous potential for sophisticated analysis of criminal and other problems. The key to success, in terms of the quality of the analysed intelligence products, is the ability to access and bring together the data from disparate IS platforms. They may include diverse computerized systems that contain: - Crime records - Open source data - Intelligence files - Analysis tools - Specialized databases (e.g., firearms registration, driver licensing, criminal records, etc.) - Case management tools. "" Provision of access to facilities or systems for acquisition of new information and intelligence—the gathering of intelligence to fill identified needs may require the deployment of ‘human sources’ such as informants or undercover officers, or the deployment of human or technical surveillance resources. At the higher level of operations, there will be a requirement to access sophisticated covert entry techniques or intercept communications. The more intru- sive techniques are usually only available in serious crime cases and the requirement to protect the secrecy of methodologies makes it undesirable that they be used where they can not be deployed as such. Mobile surveillance resources are generally expensive and require a sound intelligence case to be made for their deployment. At the local level, intelligence units will require possession of technical surveillance facilities commensurate with the investigations pursued at that level, and clear systems in place through which more sophisticated facilities can be accessed when the need arises. Within police forces, the distribution of surveillance resources, and the systems for accessing the more expensive or sensitive, will be policy issues integral to the crime and intelligence strategies.  EXAMPLE OF A NATIONAL INTELLIGENCE MODEL: THE UNITED KINGDOM 21 "" Provision of operational security systems—intelligence is a valuable commodity and must consequently be handled with care. The “need to know” principle is widely recognized as the backbone of the intelligence doctrine. The correct balance to be struck between making information as widely available as possible to maximize its potential benefit, and restricting its availability to protect the security of sources, techniques and information, is critical. A number of access systems and facilities help support the integrity and effectiveness of the intelligence environment: - The informant registration system; - The provision and use of analytical tools of the right standard; - The provision of secure accommodation and secure storage facilities; - The provision of appropriate briefing facilities, suitably secure when necessary; - The adoption of a national standard intelligence recording form which may incorporate risk assessment and handling restrictions; - Controlled access to foreign law enforcement agencies. Analytical techniques and products The National Intelligence Model depends upon four key intelligence products as discussed earlier. These products, in their turn, derive from nine analytical techniques and products, which underpin the development of professional knowledge in effective proactive law enforcement techniques. Table 3-2. Nine types of analytical technique Product Description Purpose Assesses the impact of: "" Helping to identify best practice 1. Results analysis "" Areas for improvement "" Patrol strategies and tactics "" Post hoc debrief of incidents and "" Reactive investigations investigations as an aid to professional "" Proactive investigation development "" Crime reduction initiatives "" Other law enforcement policies and techniques "" Crime series identification Management decisions about prioritization 2. Crime pattern analysis "" Crime trend identification within the “tactical menu” of : "" Hot spots "" Hot spot analysis "" Crime series identifications "" General profile analysis "" Crime and disorder preventive and diversion initiatives Operationally, they are an aid to ­investigators and others in identifying new and emerging trends and requirements for further analysis. 22 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS Product Description Purpose Maintained assessments of the state of the Management decisions about prioritization criminal market around a commodity or of criminal and enforcement problems— service—drugs, stolen vehicles, prostitution the identification of targets and reduction etc. opportunities: 3. Market profiles "" Key players "" The aggregation of standard market "" Networks profiles maintained locally enables the building of a higher-level view "" Criminal assets "" The profile may trigger more detailed "" Associated trends in criminality analysis in target profiles, crime pattern These profiles are made up of other analyti- analysis or network analysis to support cal products, chiefly from network and operations crime pattern analysis. "" Nature of demographic changes "" Strategic decisions about resourcing and 4. Demographic/social "" Impact on criminality or apparently priorities in law enforcement trends analysis associated criminality "" Illuminates where future pressures are "" Deeper analysis of social factors which likely to arise and informs partners might underlie changes or trends in "" Use in planning of seasonal or other offenders or offending behaviour tactical operations in response to Could underpin a crime and disorder audit emerging social phenomena or or research into known or predicted social ­movements of people or demographic changes. Reveals detailed operational modality Highlighting needs for changes in: 5. Criminal business profiles including: "" Legislation or other form of regulation "" How victims are selected "" Resourcing to meet new threats "" Technical expertise employed by "" Operational planning in ascertaining key offenders points for disruption "" Weakness in systems or procedures "" Immediate crime prevention/reduction which are exploited by offenders opportunities "" Incorporates results from other types of "" Raising knowledge standards through analysis training and briefing products "" Key attributes and functions of Strategically: ­individuals within the network "" Indicating to management the "" Associations within/outside of the seriousness of of linked criminality for 6. Network analysis network strategic considerations "" Network strengths and weaknesses Tactically and operationally: "" Analysis of financial and ­communications data "" Informs target operations "" Inferences about criminal behaviour in "" Suggests effective lines of enquiry and association with target profiles opportunities for disruption "" Highlights gaps in the intelligence so as to drive source deployments The analysis of comparative risks posed by The compilation of risk assessments as a 7. Risk analysis individual offenders or organizations to: prelude to prioritizing intelligence or enforcement work at both strategic and "" Individual potential victims operational levels leads to completion of "" The public at large risk management plans. "" Law enforcement agencies  EXAMPLE OF A NATIONAL INTELLIGENCE MODEL: THE UNITED KINGDOM 23 Product Description Purpose Illuminates criminal capability and includes Support target operations by: information about: 8. Target profile analysis "" Informing target selection "" Associations "" Identifying needs for intelligence "" Lifestyle "" Indicating how sources and resources "" Operational modality may be deployed against the target "" Financial data "" Strengths and vulnerabilities "" Techniques which have worked or failed against the target in the past "" Can cover any form of offending, not limited to purely “criminal” activity The real time evaluation of and research The prevention of “mission creep” and 9. Operational intel- ligence assessment into: the prioritization of investigative needs arising from incoming intelligence during (research) "" Incoming information on associations a current operation, together with "" Other phenomena around suspects in a ­identification of resultant priorities for current operation ongoing intelligence work. "" May or may not be entirely the responsibility of an analyst 4.  valuation of source and E data Evaluation of sources and information Once information has been collected it must be evaluated, a stage in traditional law ­enforcement activity which can often be ignored. A full and proper evaluation requires the assessment of the reliability of the source and the validity of information. This stage is crucial to the ­intelligence process as a whole and as such necessitates an explanatory chapter of its own. A standardized system of evaluation has been developed using what is known as the 4 x 4 system, which is now widely accepted as common practice for law enforcement agencies. This system is for example used by analysts at Europol and any information received at Europol that is not evaluated will be assessed according to this system before use. Other agencies use variants of this system, but each can be easily interpreted by reference to the explanatory tables, and if necessary the information can be converted from one system to another. Figure 4-1. The evaluation process Source Source characteristics reliability Relationship of Information source to validity information Three fundamental principles apply to evaluation: 1. It must not be influenced by personal feelings but be based on ­professional judgement. 2. Evaluation of the source must be made separately to the information. 3. It must be carried out as close to the source as possible. 25 26 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS Evaluation tables using the 4 x 4 system Table 4-1. Source evaluation "" No doubt regarding authenticity, trustworthiness, integrity, competence, or A "" History of complete reliability B "" Source from whom information received has in most instances proved to be reliable C "" Source from whom information received has in most instances proved to be unreliable X "" Reliability cannot be judged Table 4-2. Information evaluation 1 "" No doubt about accuracy "" Information known personally to the source but not known personally to the official who is passing it on 2 "" Logical in itself "" Agrees with other information on the subject "" Information not known personally to the source but corroborated by other information already 3 recorded "" Information which is not known personally to the source and can not be independently 4 corroborated Evaluation tables using the 6 x 6 system Table 4-3. Source reliability A "" No doubt regarding authenticity, trustworthiness, integrity, competence COMPLETELY "" History of complete reliability RELIABLE B "" Some doubt regarding authenticity or trustworthiness or integrity or competence USUALLY (one count) RELIABLE "" History of general reliability C "" Doubt regarding authenticity, trustworthiness, integrity, competence (two counts FAIRLY and more) RELIABLE "" History of periodic reliability D "" Definite doubt regarding authenticity, trustworthiness, integrity, competence USUALLY NOT "" History of occasional reliability RELIABLE E "" Certainty about lack of authenticity, trustworthiness, integrity, competence UNRELIABLE "" History of unreliability F "" Cannot be judged  EVALUATION OF SOURCE AND DATA 27 Table 4-4. Data validity "" Confirmed by other independent sources 1 "" Logical in itself CONFIRMED "" Agrees with other information on the subject "" Not confirmed independently 2 "" Logical in itself PROBABLY TRUE "" Agrees with other information on the subject "" Not confirmed 3 "" Logical in itself POSSIBLY TRUE "" Agrees somewhat with other information on the subject "" Not confirmed 4 "" Not illogical DOUBTFULLY TRUE "" Not believed at time of receipt although possible "" Confirmation available of the contrary 5 "" Illogical in itself IMPROBABLE "" Contradicted by other information on the subject 6 "" Cannot be judged It is apparent that the two above evaluation systems differ by more than simply the number of grades, in particular where evaluation of information is concerned. The 4 x 4 system is based on a simple notion of personal knowledge. Hearsay information is afforded a lower rating. This simplicity has a value in itself, as evaluation becomes less subjective. Sanitization Following evaluation, it is advisable to continue with a system of sanitization. This is intended to protect the source or origin of the information from being detectable from the context or wording of the report. It also seeks to protect the circumstances or method by which the ­intelligence was obtained. To assist in this process the following sanitization guidelines are offered as examples of best practice: "" All intelligence should be accurately recorded. Reports for dissemination should only include intelligence related to the desired purpose of the dissemination; "" Care must be taken to remove from the text all material that in any way identifies the source; "" The timing and place of meetings with human sources may be irrelevant and could lead to the source being identified; "" Repeat intelligence from the same source could lead to the source’s identification. The use of a confidential source register, where reference numbers are randomly allocated, reduces this possibility; "" Sanitization should make it impossible for the reader to determine whether the source is human or technical; "" In some circumstances it may be advantageous to reveal a source’s true identity in the body of the intelligence without revealing their identity as the source. This may prove necessary, for example, where a source has been seen by other officers or criminals with the group of 28 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS named individuals, and not to name the source in the report might raise suspicions about his/her identity; "" Occasionally the intelligence of a single report will contain a range of intelligence material that could only be known by a limited number for individuals. Break this material into multiple reports and ascribe different references from a confidential source register to afford greater security; "" Where an officer is concerned that the contents of a report might indicate the source, reference should be made to a supervisor before dissemination or entry into an intelligence system takes place. Dissemination One further process to be completed at this stage, is to give guidance to any recipient on what they may do with the information. This may be done either by assigning a security ­classification to the report (e.g. secret, confidential, restricted), or by allocating a “handling code” which is a series of permissions and restrictions which determine who has the right or the need to be given access. The following is an example of a system of handling codes: Table 4-5. Handling codes 1 Dissemination permitted within law enforcement agencies in the country of origin. 2 Dissemination permitted to other national agencies. 3 Dissemination permitted to international law enforcement agencies. 4 Dissemination within originating agency only. 5 Permits dissemination, but receiving agency to observe the conditions specified. Such handling codes can be added to the codes allocated earlier to the source and information. Thus a code of B24 would translate as: B—Source from whom information received has in most instances proved to be reliable 2—Information known personally to the source but not known personally to the person ­passing it on 4—Dissemination within originating agency only Once intelligence is integrated into an analytical product, it follows that if the product contains any intelligence graded at ‘secret’, then the whole document would have this protective ­marking. Similarly if any item was graded with a handling code of 4—dissemination within originating agency only—then the entire product would bear the same restriction. 5.  nalysis and analytical A process The analysis stage of the intelligence process is critical for it concerns the examination of the meaning of the available information highlighting the essential features. Analysis highlights information gaps, the strengths, the weaknesses and pinpoints the way forward. Figure 5-1. The analytical process COLLATE AND EVALUATE NEW SIFT ALL DATA IN LIGHT AVAILABLE OF OLD DATA INFORMATION PREPARE FURTHER CHARTS AND GRAPHICS COLLECT CONSTRUCT FURTHER PRELIMINARY INFORMATION LINK DIAGRAM RE-EVALUATE AND REVISE INFERENCES YES DEVELOP PREPARE PRELIMINARY FOCUSED INFERENCES COLLECTION PLAN NO DEVELOP INFERENCES AND CONCLUSIONS ASSEMBLE FINAL REPORT The analytical process is critical to the development of intelligence to direct law enforcement objectives, both for short-term operational aims and for long term strategic reasons. The scope for analysis and its overall credibility is dependent on the level and accuracy of the information 29 30 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS supplied combined with the skills of the analyst. Analysis is a cyclical process, which can be performed on all types of law enforcement objectives. Different types of crimes and operations require different scenarios, but to enable effective analysis the type of information which is used should not be pre-set by artificial measures, but by the availability of the information and the legal restrictions of each country. Data integration is the first phase of the analytical process combining various types of informa- tion from different sources to establish areas of weakness in order to draw inferences for law enforcement action. Careful integration highlights information gaps and weaknesses in the enquiry, thus ensuring that the analyst will continue data collection, even at the earliest stages of analysis work. This stage of the process at the early part of an enquiry also allows the analyst to begin to develop hypotheses based upon limited knowledge. DATA INTEGRATION: COMBINING DATA IN PREPARATION TO DRAWING INFERENCES The next step in the analytical process is interpretation which frequently means going beyond the facts, asking the “what if ” questions. For this phase to be successful, the previous stages must be accurate and complete, to minimize the risk that the analyst takes in making an informed judgement based upon the information available. DATA INTERPRETATION: GIVING THE DATA A MEANING; GOING BEYOND THE INFORMATION AVAILABLE By integrating the data usually in the form of charts, but also as tables or maps, the analyst is creating a platform from which interpretation can be carried out. Charts and other products are useful as briefing aids or as illustrations of ideas; however the underlying data and its ­meaning is what the analysis is all about. The manual will concentrate on these analysis ­by-products as they are extremely useful in firstly, helping to understand the overall intelligence analysis process and secondly, helping to determine the understanding of a particular problem. Figure 5-2. The process of analysis ANALYSIS DATA INTEGRATION INFERENCE CONCLUSION INTERPRETATION DISSEMINATION PREDICTION ESTIMATION HYPOTHESIS DEVELOPMENT  ANALYSIS AND ANALYTICAL PROCESS 31 By following the process over and over again, the analyst can begin to either support or refute the hypotheses already developed. It does not matter if an original idea is wrong, the most important aspect is to identify that it is wrong. As the overall enquiry continues the level of degree of accuracy of the ideas becomes stronger and the analyst can then begin to have greater confidence in the hypotheses. Thus a hypothesis provides a theory that can focus further data collection. The hypothesis or any inference should contain: Key individual or individuals - WHO? Criminal activities - WHAT? Method of operation - HOW? Geographical scope - WHERE? Motive - WHY? Time-frame - WHEN? The hypotheses or inferences made can be tested by the operational teams and feedback is then essential. Hypotheses contain a great deal of speculation and need to be confirmed, modified or rejected by the findings that come out of investigation. To test hypotheses structured data collection is essential and therefore a collection plan must be developed. In the process of analysis the following axioms and standards for analysts should be considered. AXIOMS FOR AN INTELLIGENCE ANALYST Believe in your own professional judgment You are the expert. Believe in your work and stand your ground if the intelligence supports your position Be a risk taker Do not be afraid of being wrong when forecasting trends or events. Taking risks is part of your job description. Only by taking risks you can maximize your value to your agency. It is better to make a mistake than to do nothing at all If you are wrong, and the facts call for it, admit it. Only those who don’t do anything make no mistakes. Avoid mirror imaging at all costs Mirror imaging is projecting your thought process or value system onto someone else. Your targets are criminals. Their mentality is completely different. You must learn to think like they do. 32 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS Intelligence is of no value if it is not disseminated Communicate the intelligence, conclusions and recommendations clearly and effectively and in a timely manner. What your client does not know has no value. When everyone agrees on an issue, something ­probably is wrong It is rare and not natural for a group of people in the intelligence community to fully agree on anything. If it does occur, it’s time to worry. Your client does not care how much you know, tell them just what they need to know Excessive details merely obscure the important facts. Form is never more important than the substance A professional appearance and appropriately selected formats are important, but they do not outweigh substance. Clients want to know what intelligence means, and they want it when they need it. Aggressively pursue collection of information that you need Never settle for less than all you need. If you fail to get access to the vital data source for any reason, you will be held responsible. Do not take the editing process personally If editorial changes do not alter the meaning of your message, accept them. If they do, speak up. Even then, it might be that a brighter mind has seen what you have missed. Believe in your product, but be self-critical. Know your intelligence community counterparts and talk to them You are not competitors; you are of the same breed. Become part of the network. Do not pick up the phone only when you need something. Do not take your job, or yourself, too seriously Avoid burnout. Writing you off as an asset will be a net loss to your agency (although it may not immediately see it exactly like this). The welfare of your family and your health is more important than nailing down a criminal, or scaling another rung on the career ladder. Your role in the larger order of things is not self-important. Your commitment, perseverance and dedication to the job will bring results only over a long term.  ANALYSIS AND ANALYTICAL PROCESS 33 TEN STANDARDS FOR ANALYSTS 1. Analysed data (i.e., intelligence) should be used to direct law enforcement operations and investigations 2. Analysis should be an integral part of every major investigation the agency pursues. 3. Analytical products should contain, as a minimum, a written report. Visual products may also be presented, but are only acceptable as an addition to, rather than in replacement of, a written report. 4. Analytical products should contain conclusions and recommendations. These are presented to management for their consideration regarding decision-making. 5. The development of an analytical product requires the application of thought to data. Data compilation that does not reflect comparison or other considerations is not analysis. 6. Analytical products must be accurate. Consumers must be able to rely on the data provided to them by analysts. 7. Analysis must be produced in a timely manner. 8. Analytical products should reflect all relevant data available through whatever sources and means available to the analyst. 9. Analyses should incorporate the best and most current computer programs, compilation, visualization, and analytical techniques available in the analyst’s environment. 10. Analyses should both reflect, and be evaluated upon, their qualitative and quantitative contribution to the mission and priorities of the agency or organization for which they are being produced. 6.  asis analysis techniques: B link analysis INTRODUCTION Much raw data in an investigation is collated into complex and detailed written reports. Other data pertinent to the analysis of the criminal enterprise or suspected criminal activity is fre- quently voluminous, and varied in form. The basic problem for intelligence analysts is putting information together in an organized way so the difficult task of extracting meaning from the assembled information is made easier. Link analysis puts information about the relationships among entities—individuals, organizations, locations, and so on—into a graphic format and context that will clarify relationships and aid in inference development. Link analysis can be applied to relationships among those entities, which might have been identified in a given analysis. Link analysis is a seven-step process. The product of the process is a link chart such as the example shown in figure 6-1. The seven steps of link analysis are: 1. Assemble all raw data 2. Determine focus of the chart 3. Construct an association matrix 4. Code the associations in the matrix 5. Determine the number of links for each entity 6. Draw a preliminary chart 7. Clarify and re-plot the chart Please note that the following detailed methodology describes the application of link analysis by manual means. The use of computer applications greatly simplifies the mechanics of this process but the still requires the same analytical thought process to be followed. 35 36 CRIMINAL INTELLIGENCE MANUAL FOR MANAGERS Figure 6-1. Example link diagram Longworth Inc. Frotner Baker Walls Adams Hays Rimco Inc. Phelps Inc. Deane Ronney Peters Best McDee Morton Davis Cole Horst Gaines Thomas Erwin Latt Erwin Associates 1. Assemble all raw data Assemble all relevant files, field reports, informant reports, records, etc. 2. Determine the focus of the chart Identify the entities that will be the focus of your chart. Read through your data and underline or highlight these entities, which may include names of people and/or Organizations, auto license numbers, addresses, etc. 3. Construct an association matrix An association matrix (figure 6-2) is an essential, interim step in constructing a link chart. It is used to identify associations between entities but is not used for presentation purposes. Regardless of which charts are going to be constructed, an association matrix should always be constructed first. Figure 6-2. Example association matrix The basis of the association is mileage between cities O AG IC N CH O D RK N RO LO YO EI 3958 N W O JA C NE IS 841 3469 E C D AN O RI 5282 5750 4801 FR N SA 2187 6747 3031 6613  Basis analysis techniques: link analysis 37 The distance between London and Rio de Janeiro can be found at intersection of the London column and the Rio de Janeiro row, which in this case shows 5,750 miles. This is the associa- tion between the two cities The entity names, which are the subject of the chart construction, are entered on the diagonal axis of the matrix. Individuals should be listed in alphabetical order. Organizations should be listed in alphabetical order, after the individuals. When Vehicle Registration Marks or addresses etc. are the entities being used, they should be arranged in alphanumeric order after the organizations. This action will assist when checking the matrix. Inserting an asterisk character (*) prior to the name of the entity may facilitate the counting of the associations. Figure 6-3. Association matrix using names of individuals and organizations in lw ll A rne Co ub an le hl Cl Er c om al La d ci or Ro e So sid ilf e ro W re lit le Fi ar Ca s St o’