As a recently-hired member of the National Security Council staff, you have been

As a recently-hired member of the National Security Council staff, you have been assigned to develop policy to counter the potential threat to US interests and allies worldwide from the Wagner Group (the Russian mercenary military organization). For starters, you have asked CIA to send over their senior analyst that covers the Wagner Group. You are meeting with the analyst tomorrow and you want to provide them a list of your EEIs to guide her future intelligence production so that it may inform your policy development. What intelligence information (EEIs) do you need to achieve this mission, and what collection disciplines would be best to task to answer your EEIs? Use below readings and other resources
• Joint Military Intelligence College – June 1999
Intelligence Essentials For Everyone
Occasional Paper Number 6 • Week 6 Class Notes
Intelligence Analysis; Policy & Practice Week 6 Class Notes Introduction If the IC lacks the necessary information to analyze to satisfy a consumer’s requirements, then it will determine how to collect more information to feed into the intelligence cycle to answer that consumer’s needs. An intelligence collection discipline or a set of them (depending on the challenges of collecting against a target) will be applied against the intelligence “gap” or “problem.” The collection disciplines or “ints” are grouped into five major types: o HUMINT (human intelligence) o IMINT/GEOINT (imagery or geographic intelligence) o SIGINT (signals intelligence) o OSINT (open source intelligence) o MASINT (measurements & signatures intelligence) To help you think about all the different means to collect intelligence, it might be good to divided intelligence collection into two main types; literal and non-literal (See Table 6-1.). Literal information is in the form that humans use for communications. No special exploitation is needed except for translation. Nonliteral is the opposite, as technical expertise is needed to process and exploit it. British author Michael Herman divides literal as “…access to human thought process…” and nonliteral as “…observations of measurements of things…”1 Literal Intelligence Nonliteral Intelligence OSINT IMINT/GEOINT HUMINT ELINT and FISINT COMINT Acoustic/Seismic CYBER Biometrics/ Biologics/Medical Foreign Material Exploitation (FME) Table 6.1: Types of Literal & Nonliteral Intelligence Collection Disciplines. Of note, all of these “ints” are spread across the electromagnetic spectrum including HUMINT (think of eyesight!) (See Figure 6.1.). 1 Clark, Robert, Intelligence Collection, Sage Press: 2014, Wash DC. 2 Figure 6.1 Collection Disciplines & the Electromagnetic Spectrum. Intelligence Collection Disciplines Definitions2 SIGINT Signals intelligence (SIGINT) is derived from signal intercepts comprising — however transmitted — either individually or in combination: all communications intelligence (COMINT), electronic intelligence (ELINT) and foreign instrumentation signals intelligence (FISINT). The National Security Agency is responsible for collecting, processing, and reporting SIGINT. The National SIGINT Committee within NSA advises the Director, NSA, and the DNI on SIGINT policy issues and manages the SIGINT requirements system. 2 Definitions are from the Office of the Director of National Intelligence Shorter Wavelengths / Higher Frequencies Longer Wavelengths / Lower Frequencies MASINT HUMINT GEOINT SIGINT HUMIN T RADAR Cosmic Rays Gamma Rays 3 IMINT/GEOINT Imagery Intelligence (IMINT) includes representations of objects reproduced electronically or by optical means on film, electronic display devices, or other media. Imagery can be derived from visual photography, radar sensors, and electro optics. Geospatial Intelligence (GEOINT) is the analysis and visual representation of security related activities on the earth. It is produced through an integration of imagery, imagery intelligence, and geospatial information. NGA is the manager for all imagery intelligence activities, both classified and unclassified, within the government, including requirements, collection, processing, exploitation, dissemination, archiving, and retrieval. GEOINT has a legal definition thanks to Congress: The term “geospatial intelligence” means the exploitation and analysis of imagery and geospatial information to describe, assess, and visually depict physical features and geographically referenced activities on the earth. Geospatial intelligence consists of imagery, imagery intelligence, and geospatial information. Source: US Code, Title 10, Section 467 (10 USC 467) MASINT Measurement and Signature Intelligence (MASINT) is technically derived intelligence data other than imagery and SIGINT. The data results in intelligence that locates, identifies, or describes distinctive characteristics of targets. It employs a broad group of disciplines including nuclear, optical, radio frequency, acoustics, seismic, and materials sciences. Examples of this might be the distinctive radar signatures of specific aircraft systems or the chemical composition of air and water samples. The Directorate for MASINT and Technical Collection, a component of the Defense Intelligence Agency, is the focus for all national and Department of Defense MASINT matters. An interesting component of MASINT is foreign material exploitation or FME. FME is the exploitation and study of actual equipment the enemy uses. So, that equipment needs to be acquired by means, sometimes covert, sometimes on the battlefield or through assistance of allies. Think about this historical example—during the early months of WWII, the Japanese Zero fighter plane was technically superior to anything the US forces possessed. That was true until a crashed Zero was found virtually intact in a bog in the Aleutian Islands and taken back to the mainland for study by aeronautical engineers and scientists. The result was the US Navy’s new Hellcat fighter plane, which was designed to be technically 4 superior to the Zero. Soon the Japanese lost control of the air due to its huge losses due to the Hellcat’s superior combat performance. Occasionally, MASINT is confused with FISINT (foreign instrumentation signals intelligence—a form of SIGINT). Here is a way to avoid that. FISINT gathers signals from an instrument intentionally placed on a platform to transmit various types of information for evaluation by engineers and scientists. MASINT gathers data that naturally come from a process, machine or some other phenomenon. For example, the North Koreans test a new ballistic missile—they will have placed instruments on the missile to provide data back to them for scientific analysis—interception of those signals by an adversary is FISINT. MASINT would be a piece of metal that makes up the missile, or the residue from the launch pad when the missile is initially launched.3 HUMINT Human intelligence (HUMINT) is derived from human sources. To the public, HUMINT remains synonymous with espionage and covert or clandestine activities; however, overt collectors, such as diplomats and military attaches, perform most of this collection. It is the oldest method for collecting information, and until the technical revolution of the mid to late twentieth century, it was the primary source of intelligence. Mainly the Central Intelligence Agency, the Department of State, the Department of Defense, and the FBI as well as numerous other federal, state and local law enforcement agencies use HUMINT. Collection includes clandestine or covert acquisition of photography, documents, and other material; overt collection by personnel in diplomatic and consular posts; debriefing of foreign nationals and US citizens who travel abroad; and official contacts with foreign governments. Law enforcement would call HUMINT-confidential informants, interviews, etc. To improve HUMINT throughout the IC in response to the recommendations made by the WMD Commission, the CIA, working closely with the ODNI, restablished the National Clandestine Service (NCS). The NCS serves as the national authority for coordination, de-confliction, and evaluation of clandestine HUMINT operations across the Intelligence Community, both abroad and inside the United States, consistent with existing laws, executive orders, and interagency agreements. 3 Lowenthal and Clark, editors, The 5 Disciplines of Intelligence Collection, Sage Press: 2016, Wash DC. 5 Other aspects of HUMINT include the Defense Attaché System and intelligence liaison. Defense Attaché System Dating back to the late 1800s, the US has posted military officers to various countries worldwide as part of diplomatic missions. These overt intelligence collectors have diplomatic protection and are composed of officers from the five US armed services as well as the US Coast Guard. Today, the US Defense Attaché System is administered by Defense HUMINT, part of the Defense Intelligence Agency. Intelligence Liaison Mostly functions to facilitate sharing of intelligence between allies, intelligence liaison officers supplement the Defense Attaché System. But unlike the attaches, liaison officers are usually embedded within the intelligence agencies of allied nations. Bilateral or multilateral agreements or treaties govern how the exchange of intelligence information will occur within each country’s respective foreign disclosure program.4 For example, the “Five Eyes” alliance (United Kingdom, Australia, Canada, New Zealand and the United States) allows for defense intelligence liaison officers aka DIALs to be placed within each other’s intelligence communities. In my work with Coast Guard and Navy Intelligence, and now the ODNI, I often worked with the liaison officers and other government officials from all of these countries. Foreign disclosure is a small but important component of intelligence liaison as well as diplomacy. To quote a former shipmate of mine when describing what he did as a foreign disclosure officer, “I make copies of classified material and give it to foreign nations.” Of course, he and I (It was my first job in the Naval Intelligence Reserve Program.) were conducting foreign disclosure in accordance with Navy and IC policies. See the optional reading folder for the ODNI’s IC directive and policy guidance on foreign disclosure. Check out this link for more info on foreign disclosure as well. Check out the policy documents on foreign disclosure on this week’s Blackboard webpage under the Optional Reading folder. OSINT Open-Source Intelligence (OSINT) is publicly available information appearing in print or electronic form including radio, television, newspapers, journals, the Internet, commercial databases, and videos, graphics, and drawings. While open source collection responsibilities are broadly distributed through the IC, the major collectors are the DNI’s Open Source Enterprise (OSE) and the National Air and Space Intelligence Center (NASIC). 4 Foreign disclosure is part of the production and dissemination phases of the intelligence cycle. 6 The US Congress has defined OSINT as: “Open-source intelligence (OSINT) is intelligence that is produced from publicly available information and is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.”5 Review the table below for a summary of the intelligence collection disciplines. Intel Collection Discipline Sub Discipline Examples/Types HUMINT Overt Defense Attaches Military personnel Govt. personnel Observers (military personnel/civilians) Covert/Clandestine Agents/Spies Confidential Informants/Witnesses Non-Official Cover Official Cover IMINT/GEOINT Active Radar, Laser Passive EO, Infrared, Multispectral, Video SIGINT ELINT Radar Signals COMINT Cell phone, Radio FISINT Missile Instrumentation OSINT World Wide Web, grey literature MASINT ACINT Sonar, Shotspotter RADINT Geiger Counter FME Foreign military equipment Table 6-3. Summary of Intelligence Collection Disciplines. 5 Department of Defense Strategy for Open-source Intelligence (Pub. L. 109–163, div. A, title IX, §931, Jan. 6, 2006, 119 Stat.3411) https://www.govinfo.gov/content/pkg/USCODE-2011-title50/html/USCODE-2011-title50-chap15-subchapI-sec403-5.htm 7 TCPED Process6 Each intelligence collection discipline, regardless of if it is a technical or non-technical “INT,” must go through its own tasking, collection, processing, exploitation, and dissemination process (TCPED) to produce intelligence to be integrated into the intelligence cycle. Think of TCPED as a sub cycle within the larger intelligence cycle. Let’s examine each of those TCPED steps in detail: • Tasking: sending a request for information to a HUMINT collector or technical collection asset/tool/system. • Collection: determining what information to acquire, and then acquiring it. • Processing: getting the information into a useful format, such as transcribing and translating a foreign language broadcast into English. • Exploitation: Validating and analyzing the acquired information and organizing into a usable product. • Dissemination: Sending the information to the requestor and sharing it with any other consumer who may need it. Let’s look at the processing and exploitation parts of TCPED with GEOINT as an example. GEOINT has three traditional levels of processing and exploitation, which are time driven. Thanks to the advances in information technology, both the quality and timeliness of the following GEOINT processing and exploitation phases have improved dramatically since the early 1970s:7 • First Phase Exploitation: When timeliness is the dominant factor, an imagery product is delivered to consumers within 24hrs of the imagery being taken, in many cases, even faster. In these cases, the imagery is highly perishable and is meeting Indications & Warning Intelligence needs. • Second Phase Exploitation: This imagery product typically is delivered days after the imagery is obtained. The extra time provides to prove a more organized and in-depth review, most likely an all-source analysis, of the target. • Third Phase Exploitation/Analysis: This is really a form of all-source analysis providing detailed and complete reports on targets. May take up to a week to complete. So, it appears the intelligence collection TCPED process is a mini-intelligence cycle within the larger cycle. It gives credence to the analysts, and ultimately the consumer, that the information provided them through the collection phase is reliable and attempts to meet their needs. 6 Lowenthal and Clark, editors, The 5 Disciplines of Intelligence Collection, Sage, 2016. 7 Lowenthal and Clark, editors, The 5 Disciplines of Intelligence Collection, Sage, 2016. 8 Evaluation of Intelligence Information Why should collected information be evaluated? Easy answer—the need for sound analysis. “Analysis refers to the process of transforming the bits & pieces of information that are collected in whatever fashion into something that is usable by policymakers and military commanders.” – Adam Shulsky, Silent Warfare: Understanding the World of Intelligence The concern here is that if you put “garbage into the system, then what you get out of the system is garbage.” Two of the classic examples of evaluating intelligence are the rubrics used to review HUMINT and IMINT. Let’s look at HUMINT evaluation first. Evaluation of HUMINT is done in three parts: • Source Credibility • Source Frequency (how often the source provides information) • Information Evaluation Of note, this HUMINT evaluation system is also used in OSINT, particularly that OSINT derived from the World Wide Web. Why? Because humans are behind the content on the Web. Source Credibility Reliable No doubt of authenticity, trustworthiness, or competency; has a history of complete reliability Usually Reliable Minor doubt about authenticity, trustworthiness, or competency; has a history of valid information most of the time. Fairly Reliable Doubt about authenticity, trustworthiness, or competency, but has provided valid information in the past. Not Usually Reliable Significant doubt about authenticity, trustworthiness, or competency, but has provided valid information in the past. 9 Unreliable Lacking in authenticity, trustworthiness, or competency; history of invalid information Cannot be Judged No basis exists for evaluating the reliability of the source Source Frequency Constant Provider Sources primary purpose is to provided information on the target or subject Frequent Provider Source often provides information on the target or similar subjects. Limited Provider Source occasionally provides information on the target, subject or similar subjects. New or Unknown Provider Sources First known time providing information on the target or subject. Information Evaluation Confirmed Confirmed by other reputable independent sources; logical in itself consistent with other information on the subject. Probably True Not confirmed; logical in itself; consistent with other information on the subject. Possibly True Not confirmed; reasonably logical in itself; agrees with some other information on the subject Doubtfully True Not confirmed; possible but not logical; no other information on the subject 10 Improbable Not confirmed; not logical in itself, contradicted by other information on the subject Cannot be Judged No basis exists for evaluating the validity of the information. Evaluating Imagery/GEOINT The National Imagery Interpretability Rating Scale (NIIRS) is a subjective scale used for rating the quality of imagery acquired from various types of imaging systems. The NIIRS defines different levels of image quality/interpretability based on the types of tasks an analyst can perform with images of a given NIIRS rating. The idea is that imagery analysts should be able to perform more demanding interpretation tasks as the quality of the imagery increases. The NIIRS consists of 10 levels, from 0 (worst quality) to 9 (best quality). Because different types of imagery support different types of interpretation tasks, individual NIIRS has been developed for four major imaging types: visible, radar, infrared, and multispectral. Check out the NIIRS scale online here. Collection Management This may be my second favorite part of the intelligence business—the process of assigning the right collection asset or assets to help solve an intelligence problem. Often a case of finding the “square block” to fit into the “square hole,” collection management is both an art and science. Many technical collection systems (SIGINT, IMINT, MASINT) have hard deployment parameters—if the target is not within them—then it is useless to deploy that collection asset. The art is focused on the use of HUMINT and OSINT as well as the melding of all the collection disciplines together in an attempt to collect data to satisfy the consumer’s need. The fun is determining what team or group of collection systems will produce sufficient intelligence to fuel adequate analysis. There are two major variables impacting that choice: the target’s location and material composition, and the priorities or availability of the collection systems. A good collection manager, with much assistance from the responsible analyst, must know as much about the target as possible to optimize the utilization of collection systems. Then the collection manager has to balance what systems could collect against the target versus what systems are actually available (priorities) within a reasonable timeframe that will allow the collected information to be useful. 11 Of note, most IC agencies will have a collection management team to engage the national collection systems, and also commercial space-based systems, for their respective agency’s needs and to manage any tactical or operational collections systems they may operate. The analyst and collection manager will use one or more systems to “tip-off” the use of another. For example, HUMINT reporting from Damascus, Syria indicates the Syrian Govt. is moving its elite troops only at night. Knowing this, the collection manager could task a space-based infrared system to confirm that HUMINT report. I often did this—in one case, I analyzed HUMINT, which led me to target an area with IMINT systems, which indicated the original HUMINT was incorrect. I then used that information to revise my HUMINT tasking for that target area. Okay, so let’s employ a very simple intelligence collection management rubric with a fictional case. • You are the lead analyst in DIA’s Defense Counter Terrorism Center Hezbollah team. • The Defense Attaché in Lebanon reported via HUMINT report regarding a new combat swimmer training facility in Sidon, Lebanon. Possibly for the Hezbollah. The HUMINT report is provided below: FOR TRAINING PURPOSES ONLY FROM: USDAO BEIRUT LE TO: DIA WASHINGTON DC//DCTC// SUBJ: IIR 2013-086 SUSPECT HEZBOLLAH COMBAT SWIMMER TRAINING FACILITY 1. This Intelligence Information Report is based upon unevaluated intelligence information from a HUMINT source. 2. Source: Reliable multi-time provider 3. DOI: 08/21/2013 4. Report: Lebanese government officials have provided information to the reporting officer indicating Hezbollah operatives, along with Iranian trainers from the Al Quds Force, have moved their combat swimmer training base from Bandar Abbas, Iran to the Lebanese port of Sidon in southwestern Lebanon. The source believes the move of the training facility may have been to increase Hezbollah capabilities against the Israeli Navy in the Mediterranean Sea. 12 The officials provided a location of the base to be two (2) miles north of the large quay handling the daily ferries from Cyprus. It appears other than normal private security measures that the base is hiding in plain sight. 5. Send any IIR Evals to USDAO Beirut. FOR TRAINING PURPOSES ONLY Figure 5-2. Map of Lebanon. Okay, now let’s take a look at our rubric: 1. Is the target mobile or stationary? (Aids in determining what IMINT system to task) 2. Does the target possess any communications systems or emitters to exploit? (Aids in determining what SIGINT system to task) 3. Are there HUMINT assets available for follow-up? 13 4. Is this a crisis situation (adhoc need) or a standing intelligence problem?8 (Helps in determining how long an analyst has to set up additional collection on the target) What are our first steps? The HUMINT report mentions two locations—one in Iran and one in Lebanon. Both sites could be imaged to confirm the original report and reveal more details about the site in Lebanon. Second step could be to send feedback to the collector via an IIR Evaluation9 , which will include additional questions for the collector to answer. Based upon info gathered from those efforts, you may have enough to bring in other systems (such as SIGINT) as needed. Some last thoughts regarding collection management: • Beware of relying on one or two collection disciplines. Be open to use as many as possible. • Don’t try to be an expert on all collection systems, but do develop a working knowledge so you can engage the collection managers in a thoughtful manner. • Develop a good relationship with the collection managers supporting your analytical effort. Bring them into your world as much as possible. In some cases, collection managers are embedded within analytic efforts in order to increase their background knowledge of the intelligence problem at hand. 8 Standing intelligence problems have been previously assigned and are part of the daily workload of an analyst or collection manager. 9 Call into the Thursday chat someday to hear about my adventures writing IIR evaluations