Production process of intelligence reports - understanding the intelligence cycle

Typically, intelligence users see intelligence reports that often go through a complete production process from requirements to product, a process also known as the intelligence cycle. The intelligence cycle is a structured process that outlines the steps involved in the eventual production of an intelligence product. The intelligence cycle is conceptualized in a variety of ways and generally ranges between four and six steps.

These steps can include: direction, collection, collation, assessment, analysis, reporting and feedback.

When conducting investigative Internet activities, the intelligence cycle should play a role in the process. The intelligence cycle moves from open source information to creating open source intelligence and ensuring that reports on the results are presented to decision makers.

1. Direction

In the first step of the intelligence cycle - confirm the direction and develop a plan.

Identify intelligence requirements and assign a plan for collecting data or information. To determine intelligence requirements, intelligence analysts receive specific needs for intelligence products.

During the direction phase, the analyst needs to understand the issues that must be addressed and develop an intelligence collection plan. The intelligence collection plan outlines the intelligence requirements to ensure that the collection works toward a clear purpose, summarizes the planned collection and lists priorities for the intelligence products.

2. Collection

Based on the intelligence requirements outlined in the intelligence collection plan, the second phase - the collection phase - is conducted. The collection phase follows the intelligence collection plan to ensure relevant, accurate, and valuable information that affects decision making. Internet information collection may involve multiple sources, which may include:

Social media platforms; online articles, newspapers, magazines, news and journal articles, motor vehicle registration and insurance records, satellite maps, corporate research sites, the dark web, digital marketplaces, public demographics, etc.

3. Collation

The third phase of the intelligence cycle - collating information - involves sorting, organizing, classifying, and indexing the collected data. During the collation phase, relevant information is grouped to summarize and corroborate the event record.

If audio and video recordings are archived during an Internet investigation, transcription or translation may be required. The collation process ensures that investigators or analysts involved in the intelligence cycle can locate, review, and group the collected information.

4. Assessment

In the assessment phase, analysts review the information collected, which should not be taken at face value, and for each piece of information, the assessment phase evaluates its validity and the reliability of its source. For this process, information is typically evaluated using an intelligence grading process.

Source Assessment:

Source assessment assesses the credibility of the source of information. There are roughly three source gradings:

a. Reliable Sources - Sources are known to be competent and well tested, and information previously received from them is usually reliable. Reliable information can be trusted and relied upon.

b. Untested - Information that has not been previously provided or has been provided that has not been confirmed and therefore cannot be judged to be reliable. Untested information should be treated with caution and verified before acting on it.

c. Unreliable - There are reasonable grounds to doubt the reliability of the source because of inaccuracies in previously provided information or ulterior motives. Corroborating evidence should be sought before making decisions about such information.

Carefully examine the source of information and evaluate and review any sources of information gathered from the Internet.

Information Assessment:

Information assessment describes the reliability of the information collected. There are roughly five levels of information assessment:

a. Direct knowledge of the source - first-hand information obtained by the source (usually a direct person);

b. Indirectly known by the source but not confirmed - information that the source has not witnessed themselves;

c. Indirectly known to the source - information heard from others;

d. Unknown - information that cannot be evaluated;

e. Suspected to be false.

For any information collected from the Internet, the information evaluation looks at the source of the information. If the information is posted by the subject or comes from an official source, the reliability is direct knowledge of the source. If the information comes from a post or comment by an unknown person, then the reliability is likely unknown.

Classification of information

During the evaluation phase, information is usually classified according to its sensitivity. Information collected from the Internet is usually collected as public information, but when grouped with internal data and information, it may end up being classified at any information classification level.

5. Analysis

The analysis phase takes place after the information has been collected, processed and evaluated. Analyzing information allows analysts to draw inferences and generate actionable intelligence for decision makers to use as a reference.

The analysis phase provides contextual insights that inform the analytical inferences and outlines the importance of the information. Recognizing the importance of information means understanding what is happening, why it is happening, how it relates to what is known, why it is relevant, and what will happen next.

Once the analysis is complete, the intelligence analyst generates a results-focused intelligence report and recommendations based on the findings.

Recommended countermeasures should consider:

a. The results generated by the analysis;

b. The potential risks of the response;

c. The short-, medium-, and long-term impact of the response;

d. And how to respond.

6. Reporting and feedback

The final phase of the intelligence cycle - results and feedback - is the timely delivery of intelligence to those who need it and review of the final product. Ensure that the intelligence products produced reach decision makers in the desired format.

Intelligence products can be short summaries, full reports, geospatial maps, oral briefings, or formal presentations. The intelligence analyst will deliver the analysis and recommendations in the format that best suits the target audience.

During the report generation phase, the analyst determines who should receive the intelligence product and what format they should receive it in. Analysts may need to produce multiple product formats to suit different audiences.

Feedback is provided in a timely manner after the report is generated to evaluate the intelligence product and review whether it meets the initial request. The results of the feedback are then finally adjusted and optimized by the intelligence analyst.