Monthly Archives: October 2012

Ethics in Intelligence Analysis

I’ve got an article up over at the new issue of Foreknowledge.  The original version is below…

The most recent edition of U.S. Department of Justice’s Global Justice Information Sharing Initiative (Global) Law Enforcement Analytic Standards mentions ethics only twice in its 44 pages. The first is its inclusion as one of 30 ‘core competencies’ that are to be addressed in initial analytical training over a (minimum) 40 hour training program. The second provides some detail into the specific aspects of ethics that should be focused on.

Analysts must be able to apply their agency’s policies, guidelines, and operating procedures to information and intelligence sharing, analysis, and dissemination.

While important, intelligence personnel are often left to their own devices when presented with serious ethical questions. These questions can be broken down into two broad categories that I refer to as sins of commission and those of omission.

An agency is in competition with another over scarce resources. In furtherance of that end a supervisor approaches a junior analyst and asks for a product with a specific conclusion. When the analyst tells her supervisor that she’s not sure the data supports that conclusion, the supervisor replies: ‘C’mon, you can make statistics say anything.’

Sins of commission, where someone in power attempts to strong arm an analyst to deliver a particular judgment, are rare among those agencies that have strong tradition of professionalism, community and where analysts are able to progress beyond the lowest levels of the organization. Paul Pillar, a veteran analyst with the Central Intelligence Agency, wrote about such attempts in the context of intelligence analysis preceding the 2003 invasion of Iraq. Such instances of crude arm twisting within the federal Intelligence Community (IC) “…are rare and, when they do occur…, are almost always unsuccessful. 

Yet, in the United States, the past decade has seen an explosion of domestic intelligence personnel in law enforcement and ‘homeland security’ agencies. Most of these agencies have little to no orientation or traditions in intelligence analysis, are fragmented with few analytical personnel and rarely afford analysts the opportunity to rise within the organization to positions with decision making authority. It is under these conditions where analysts are most likely to be directed to produce politicized analysis and also where they will have the fewest opportunities for redress.

Sins of Omission

A political protest erupts in cities around the country. The protestors are dedicated to non-violence and, despite attracting large numbers of supporters, engage in little serious criminal activity. Yet, the movement attracts the attention of law enforcement and counter-terrorism officials who demand a steady stream of products linking the protest to other, violent movements despite little to no evidence of any such connection. As intelligence resources are focused on the movement, other criminal and terrorist threats are given lower priority and attention.

A more common and subtle ethical issue for intelligence analysts falls into this category. Intelligence personnel may be directed to focus their energies towards a particular conclusion for any number of biases or interests. The end result, however, remains the same. Analytical judgments are influenced and manipulated based upon the parameters under which intelligence personnel directed.

As in the case of the search for WMDs in Iraq, repeated requests to find evidence of a particular threat, along with increasing amounts of resources devoted to the question, inevitably leads to increased reporting. Often this reporting involves information of decreasing quality or repetitive reporting but its quantity can lead to superficial assessments that threats exist where they really don’t.

Raising questions about practices like this can be problematic for even experienced intelligence personnel. While in the federal IC, raising such questions may result in a transfer to a less desirable post or delayed career advancement, in the law enforcement or counter-terrorism communities the consequences can be much longer lasting. Many analysts in those communities work for small agencies and have few career opportunities other than moving to other agencies. Acquiring a reputation as not being a ‘team player’ can effectively destroy a career via informal channels.

Expecting analysts to both be aware of ways in which their work can be manipulated (consciously or not) and expecting them to act as warning system to prevent that occurring without training or support may just be too much for them to bear. New intelligence analysts frequently come into their agency wanting to both make a good impression and a difference in their community. The important nature of the work, culture of hierarchy and presence of people of great experience, even if in a non-intelligence field, can make the pressures against raising concerns formidable at best.

Gone Fission

That’s it for now, folks….TwShiloh is officially in semi-retirement.  I imagine I’ll be taking some time off but don’t delete me from your feed yet! At the very least I’ll be posting on an ‘occasional’ (rather than M-F) schedule.

And who knows…maybe this’ll just be a trial separation…

(bonus points if you guess who the title of this post is a hat tip to)

That Senate Fusion Center Report (Part 3)

Part 2

The report concludes with an evaluation of fusion center ‘success stories’. On their website , the DHS advertises a number of ‘success stories’ that supposedly highlight the importance of these centers in the counter-terrorism mission. It identifies 23 such cases. Keep in mind that fusion centers have been around since 2001ish, there are currently more than 70 of them (no one could get a straight answer as to exactly how many of these centers there are) and the federal government has poured in between $300 million to $1.5 billion dollars into them (again, no one seemed to thought that keeping track of expenditures was particularly important).

Of those 23 cases, more than half (14 in total) clearly had no nexus to terrorism. These included things like (and I’m not kidding):

  • Fusion Center Contributes to Decrease in Auto Theft (Let me guess…by having all employees lock their car doors?)
  • Fusion Center Enables a Teenage Runaway to Return Home Safely (What did they do, buy her bus fare for her?)
  • Fusion Center Supports Federal Partners through the Use of Facial Recognition Queries (translation: made a database query)

The bottom line is that these ‘successes’ are all things that could be done even if fusion centers never existed.

Ten years….72 facilities…hundreds of millions of dollars and what do they have to show for it? They helped a runaway get back home.

But wait, I can hear you say, what about the 9 ‘terrorism-related’ cases? Stopping one 9/11 would make this whole endeavor worth it, right?

Glad you asked.

Of the nine events I labeled ‘terrorism-related’ (and I was trying to be generous here), none were involved with disrupting plots but rather with supporting investigations that had already begun. And that brings me to a point I’ve been hammering away at for awhile. In none of these cases was there any real analysis going on. Rather (based upon the descriptions by DHS and the subcommittee’s deeper look into four of the ‘best’ cases) fusion centers were used to do database checks, information sharing and perhaps some tasks considered ‘entry-level’ analysis (link charting, PowerPoint summaries of case information, etc.).

So, let’s stop trying to teach a dog to wear cloths and walk on its hind legs. To paraphrase Mr. Johnson, even if we can get them to do it, it won’t be done particularly well. Pull the analysis function out of fusion centers and leave them to do the information sharing and case support functions. They’ve demonstrated they can do those reasonably well, it’s what they’re comfortable with and we can stop wasting resources doing the other stuff.

Then…concentrate analytical resources into regional centers. You have a much better chance of achieving a critical mass of analytical talent to actually get some substantial work done. If you remove the component of those centers that have actual arrest powers you can get off the hamster wheel of arrests and seizures as a metric for success.

But beyond these *ahem* successes, the subcommittee also found evidence of fusion center work that hindered investigations and at least one instance where fusion center work could have led to serious international problems. You may remember I wrote about this incident here but what I didn’t know at the time is that while the DHS was publicly distancing itself from the fusion center’s assessment, it was also referencing the same, incorrect, report in its own products. AND, it never issued a correction.

Kvick Tänkare

Mike Bennett has put his vampire audio novel ‘Underwood and Flinch’ up on You Tube.  This is totally worth you time.  Mike does great stuff.

We’re coming up on Halloween so here’s a cool, creepy vid for you (h/t i09)

We’ll stick with the animal world with this brilliant infographic on cheetahs.  I include it here not only for its intrinsic value but as an inspiration into thinking about how other types of data (yes, I’m looking at you intelligence analysts) could be presented in different and (dare I say it) more effective ways.  Click on the image to see the thing in it’s big, animated glory.

huh…seem to be on an anatomy kick today.  Check out these amazing pics of animal skulls from the NYTimes.  Lesson learned today:  Do NOT screw with the Chinese water deer.

Estragon42 has  put up a bit of fiction asking the questions ‘What if Hemingway deployed to Afghanistan?‘ Check it out.

Finally, courtesy of Discover magazine, is this piece summarizing research that seems to indicate that people that sign their documents on the top of documents (before they’ve entered data or made a statement) their information is more accurate than if they sign at the bottom of the document (after they’ve already done the work).

People are often dishonest in little ways on forms, rounding numbers in a beneficial direction or failing to mention a relatively small item as part of a larger list. If they sign a form once they’ve done all that, they don’t go back and correct it; instead, they’ve already woven a story to themselves—consciously or not—about why what they did was perfectly fine.

It’s worth noting that most intelligence products do not have the author(s) names attached.  Now, there’s usually a very good reason for that.  Namely, that the analysis done is supposed to represent the agency’s position and not the individuals.  Additionally, there’s a security issue as well.  Knowing that analyst ‘A’ is the one who writes all the stuff about security issues in Outer Mongolia opens that analyst up to targeting and influence.

That being said, I’ve heard analysts say things like ‘I don’t care, my name’s not on this.’   There’s got to be a way to address both problems.

That Senate Fusion Center report (part 2)

Part 1

Now let’s talk about something that has concerned people about domestic intelligence generally and fusion centers specifically for a long time now.

Violations of civil liberties.

I’ve said before (and I maintain today) that a) I do believe there are violations of civil liberties and civil rights going on all the time in criminal and homeland security shops around the country and b) this is mostly do to incompetence rather than any real plan to deprive people of their rights.

And here’s where you can look at things as half full or half empty.  While the committee’s report identified numerous reports that was inappropriate it did note that ‘o the credit of officials participating in the review process, these reports were for the most part cancelled before publication.’

That’s good but fusion centers produce a whole host of information which doesn’t go through the DHS vetting process.  While, theoretically, every center is supposed to have a privacy officer and all products are supposed to be vetted for privacy/civil liberties/civil rights issues, unlike at DHS that position need not necessarily (or even usually) be a position devoted to those issues.  It can be an ‘extra duty’.  And when something is piled on as such, we all now how much attention and effort usually follows.

Beyond that, remember that there are pressures to produce numbers at these centers.  Quantity of reports = productivity = effectiveness = justifications for promotions and resources.

So, what to do if you don’t have much actual intelligence to report on but you have a lot of constitutionally protected activities going on (ideally conducted by people whose ideological orientation or socio-economic-racial background kinda makes you feel icky?

Well, you could always put out ‘officer safety’ bulletins or ‘situational awareness’ reports.  The reasoning can be ‘Oh, we’re not reporting on the protest or specific event, but there may be ‘public safety’ concerns…traffic might get snarled…people might pass out from heat exhaustion…you know.’

And here’s where you can see the jack-booted thugs behind the curtain or not.

You could say that these sorts of things are a ‘wink and nod’ way to pass along intelligence on constitutionally protected activity.  After all, a ‘situational awareness’ product coming from a ‘crime center’ or a ‘counter-terrorism’ shop will probably mean something different than if the very same product came from the traffic enforcement division, for example. I’m not sure I’ve seen any evidence of the level of self-awareness required to understand the concept of contextual information but it is there in any case.

And the ‘public safety’ argument only really holds water if there’s some evidence that such bulletins go out for similar, non-controversial, events.  Worried about traffic snarls?  Why aren’t you putting out a product when the American Legion holds fund raiser and parade? Oh, that’s right…your dad was in the Legion.  ‘Nuff said.

In those, you can make the most outrageous claims and just tack on a statement at the end that says ‘We recognize the rights of people to conduct first amendment activity and provide this for information only.’

So, what drives this sort of thing?  You can think it’s a grand conspiracy theory but I honestly believe it’s the result of people in over their heads making decisions on issues they aren’t qualified to make.  In the interest of careerism and institutional goals, they wing it, don’t think too much about the consequences and hope if the proverbial shit hits the fan it’ll be after they’ve been promoted out of there (or, retired and picked up a cushy security job with some corporation).

And that is what should drive you nuts.  The flaws identified by the Senate are the results of countless decisions made to let unqualified people feel like they are part of the big game.  As Tom Ridge (the genius who brought us color coded terrorism threats) said:

“We thought if we just threw the name out there, built a bunch of them, we’d feel a lot better.”

Yep…a sound basis for establishing a domestic intelligence program.

That Senate Fusion Center report (part 1)

Remember it?  Oh, how soon we forget.  Well, here’s what I’m talking about if you need a refresher.  I have, finally, gone through the whole report (download your own copy here) and wanted to talk about a some of the important issues it raises.

Now, before I go on, there is one important thing to mention.  This report confines itself to the role that fusion centers play in national couter-terrorism efforts and specifically how they plug into the Department of Homeland Security.  Now, those looking to rebut the report have pointed that out as a fatal flaw with the report.

Personally, I think those people should really just keep quite.  The last thing they want is someone actually looking to see if all those other claims about how effective and valuable fusion centers are actually true.

And in that regard, I’d suggest that many of the observations and shortfalls the committee identified can apply much more broadly than the committee intended.  While the fusion center contribution to national counter-terrorism efforts may look like ‘pools of ineptitude’, at least when talking about intelligence and analysis, it’s probably the aspect of what these centers do that’s most set up for success.

So, we’ll begin in talking about the value of ‘intelligence’ that gets produced and disseminated from fusion centers. The subcommittee’s report reported that many of the reports that made their way to DHS were ‘useless’.  It should be kept in mind that fusion centers produce a whole bunch of reports and only the *ahem* ‘best’ are deemed worthy of being sent to DHS.

Which means, while DHS may think they’re getting spammed with intelligence crap, there’s a whole wave of it flowing from fusion centers that doesn’t make the cut.  The art of regurgitating information, sometimes from open sources and other times from other agencies may not have been perfected in fusion centers but it is certainly getting a great deal of practice.

In part, this is due to another observation made in the report:  Using quantity of production as a metric to determine value.

In a couple of cases there was a lot going on, .  In a couple of others they were looking for stuff so they could wave their flag.

Fusion centers (like any agency that equates activity for achievement) focus on things that are easy to count.  So, that encourages two sort of bad behavior:

  1. producing intelligence products that aren’t relevant
  2. producing products that are identical (or nearly identical) to reports from other agencies

This leads to everyone’s inbox getting clogged with products and makes it difficult to sift through what deserves attention and what should be sent right to the recycle bin.

(As an aside, another way to boost numbers without doing any work is to forward someone else’s product with a cover note.  That allows an agency to throw its logo on things and get credit with no real investment.  What it means to customers is that they can very well get the same product many, many times.  Hardly efficient.)

Why do these centers produce so much crap?  In part it has to do with training.  Despite the endless pronouncements about how important intelligence is, analysts, investigators, and supervisors have few, if any, training requirements for working in intelligence shops.  There are federal recommendations for 40 hours of training for analysts but even if you could get everyone to adhere to that, 40 hours does not an analyst make.

It just seems strange that in the army I had to go through 14 weeks of training in order to be an entry level analyst.  That allowed me to sit in the same room with intelligence people and learn.  I certainly wasn’t considered capable of independent activity.

We wouldn’t feel comfortable is our police or firefighters were given 40 hours of training and sent out into the world.  And yet, intelligence personnel in many of these fusion centers, expected to contribute to the national counter-terrorism strategy are essentially thrown to the wolves and expected to figure things out.

That problem is compounded by a marked lack of leadership in most of these centers.  When it comes to counter-terrorism (and, to be honest, most aspects of intelligence) most the most critical shortfall is the lack of any real direction and prioritization.  Instead, we perpetuate the myth of ‘all crimes, all hazards’.  Given that many fusion centers contain fewer than a dozen people, the notion that you could have a shop which is tracking ‘all crimes, all hazards’ is patently ridiculous.

He who defends everything defends nothing.

But…picking priorities entails risk.  After all, pick the wrong thing and you might get held accountable for it.  Pretend to cover everything and you’re all set to lobby your elected representative for more money to ‘fulfill the mandate’.

More tomorrow…


It’s October which means we here at TwShiloh are coming up on another year of successful blogging.

I had many reasons for starting this blog, lo these many years ago, but one was to run an experiment.  Could someone write about intelligence analysis from the ground level?  Would there be any interest in this sort of stuff?  Would there be enough to write about?

I think the answer to those questions are all ‘yes’.


While I love running this blog the posting schedule is pretty intense for a one-man operation.  I’ve got a number of new projects I want to work on, that I hoped to make some progress on over the past year, but the blog is a jealous god and she does not like sharing my attention.

Also, I’m getting the feeling that I’m running out of things to say.  I need to do new things, get some new experiences under my belt, expose myself to new ideas and then process them.

So, soon (I don’t know exactly when), I will be scaling back my posting schedule.  If I’m in your feeds, please don’t drop me…I still plan on posting at least once a week but if you enjoy your daily dose of TwS with your morning coffee you’ll probably need to start looking for an alternative.

We’ll see if I can stay away from regular blogging (I’m not sure I can after all this time).

Before then, however, I have some long pieces I need to write and get out.  Then, I’ve got a number of projects that I’ll probably share here.  There’s probably another week or so of daily reporting but I figured I’d give y’all some time to gird yourselves.

So, stay tuned.  ‘Cause shit’s about to get real…

Oh, before I go, I know there are some regular readers out there.  A few of you I’ve corresponded with and others, I suspect, have lurked in the corners.  My email is up in the corner there, I’d love to hear from you and your thoughts on my little experiment here.  What did (do) you like and what could you do without?  What would you like to see in the future?