NIM and intelligence
NIM and statistics
Dysfunction of NIM
The role of Principal Analysts
Legal Status of NIM
What then must be done?
Copyright notice: text from this website may be reproduced freely, so long as IntelligenceAnalysis.net is quoted as the source
About this website
Every so often, I expand here on the themes of this website by commenting on events, articles, and general goings-on.
When writing a report, the analyst will be aware of bits of information that must be mentioned, but which interrupt the flow of the report. Frankly, these can be a pain to weave in. The solution is to use footnotes. Examples of footnote use include:
September 2012 - The intelligence analysts nightmare: the nondescript crime
Let us say a detective asks the intelligence analyst to investigate a domestic burglary. On reading the crime report, the analyst finds that it is the dullest crime ever: someone broke into a house and stole some cash. Even with a lack of researchable material, however, there are two queries that an analyst can make as a matter of course.
First, research the same address for any previous burglary, going back as far as records exist. Occasionally, burglars will return to a house and break in again, since they are familiar with it from their first visit. If that does not produce a matching crime, try adjoining houses. If a match is found, the historical crime may feature more information that can be used to kick-start investigation into the current crime.
Second, research similar crimes the same day, within what seems a relevant geographical limit, and see if there is anything to corroborate a link. This is best illustrated with an example: I was asked to look into a distraction burglary where two white males turned up to fix a leak, and stole cash. The victim was elderly and unable to provide any further information on either offender description or modus operandi. With such little information to go on, the offence was indistinguishable from scores of similar distractions.
As the pair (probably) had a vehicle (not seen), the entire force area was searched for other distraction burglaries that day. About seven miles away, on another division, two white males did a burglary while claiming to mend a washing machine. The crime occurred about two hours later, making it feasible that it was the same pair. There were good descriptions of them, enabling further research. And as we could see which direction they were heading, we were able to put in a request to the adjacent police force.
In both approaches (researching the same address/same day) the idea is to make a leap from a crime that cannot be researched to one that has prospects for research.
June 2012 - City of London Police's Hydra
The City of London Police is advertising for two Heads of Analysis and Research, one vacancy in its Counter Terrorism and Specialist Crime section, and the other in its National Fraud Intelligence Bureau.
Both positions provide "Strategic and Threat Assessments"; in other words, management information, and statistical analysis, as explained on page 2:
This would not be a problem if the job titles described the roles accurately, such as Head of Statistical Analysis and Research, or Head of Management Planning.
But, of course, the job titles are so not clarified, because the City of London Police also wants to use the postholders for case crime and investigations, from page 2:
And from page 4:
A subtle nuance that suggests that City of London Police realises all is not well is on page 3:
Actively embrace? Imagine a postman's job description that said, "Actively embrace the delivery of letters to householders". Something is not quite right with that expression - what is it?
One of the points made in a previous Telex (October 2010 - Jill Dando Institute gets it wrong, again) is that "analysis" is used to implement hobbyhorses; the result is that every latest fad is imposed on the analyst. Of course, to describe the analysis of crime causation as a fad is unjust; it is important role in its own right. But in the context of it being imposed on intelligence analysts doing their job, it becomes a "fad".
What's the solution?
City of London Police has produced virtually identical job descriptions for two Heads of Analysis and Research, to be employed in different departments, and both doing statistics and crime investigation. City of London Police is therefore making a cardinal error identified previously on this site; confusing what analysts are used for (i.e. counter terrorism and fraud intelligence) as opposed to what analysts are used as (statisticians or investigators).
What City of London Police ought to do is to employ one Head of Statistical Analysis and Research, and one Head of Intelligence Analysis and Research, each to cover both departments. It is as straightforward as that.
May 2012 - Analysts' reporting etiquette #5
Analysts, along with other staff, are sometimes told to use CAPITALS when typing people's names in reports, so that readers can locate them easily. That practice has existed throughout the twentieth century; capital letters were used for emphasis because that was how mechanical typewriters worked. Nowadays, word processors allow bold to be used as an alternative. But whether one uses capitals or bold, the important thing is that names, telephone numbers, car number plates, etc, are emphasized at least the first time they appear in a report, and/or at the beginning of subsequent paragraphs, where they feature prominently.
March 2012 - unForging the links
Her Majestys Inspectorate of Constabulary (HMIC) and Her Majesty's Crown Prosecution Service Inspectorate (HMCPSI) have produced a report: Forging the links: Rape investigation and prosecution (locally stored copy). The report examines intelligence gathering across twelve forces with particular regard to serial and linked offences, and makes numerous recommendations. The report loses its way, however, on the matter of analysis. The following passages are from page 28:
The report is saying that links were made on the off-chance, rather than the analyst working in a careful way. To remedy this, the report goes on:
The report makes two recommendations:
An indication of difficulties in the report's understanding of investigative analysis lies in the first paragraph quoted; to repeat (my emphasis):
The report is saying that, since the attacks were in the same general location and on the same day of each week, the series should have been discovered by the analyst. This statement is based on an assumption that the analyst ought to be looking at attacks by area and day. This understanding, however, is at odds with the analysts actual starting point, which is the attack itself; working correctly, the analyst should be no more or less likely to identify a series whether it occurs in the same area, or on the same day each week, or not.
Lets illustrate this with an example; let us say a stranger rapist slaps the victim several times. A potential starting point is to research the database for any sex attacks (non-domestic) with the word slap (or similar) in the free-text, over the past few years (at least). Anything fewer than a hundred matches and the analyst may as well skim-read the lot. More than a hundred matches and it may be necessary to refine the search to produce a more manageable list. Essentially, what the analyst is looking for is corroboration, something in the crime reports other than the slapping that also bears a similarity to the original offence; this could be the offenders description, what the offender said, or something else the offender did. Where and when the offence occurred are also corroborators but, unless and until the analyst decides differently, they are no more or less important than any other aspect of the MO. For all the analyst knows, it may be the rapists' discoloured right thumbnail that identifies the series.
A second clue is in the third paragraph:
"Victims, locations and offenders" is a reference to the Problem Solving Triangle, which is a statistical and environmental approach to understanding crime; it is not an investigative approach to working out who did it.
The same paragraph yields a further clue: "... police resources cannot be focused quickly enough". This is the language of the statistician, who allocates patrols, cars, etc according to crime types and volumes. Now we begin to see why the report is preoccupied with looking at crimes by location and day of the week. But it is not the role of the intelligence or investigative analyst to focus resources, but rather focus attention on a specific offender.
Lets consider the reports two recommendations: the first, quite rightly, is that forces should always assume stranger rape to be potentially part of a series; the second is that forces produce rape problem profiles, defined on page 7 as (my emphasis):
This shows that rape problem profiles are statistical and sociological in nature, designed to understand sex offences as a whole. The report is therefore confusing statistical and investigative analysis from start to finish, leading it to the assumption that linking attacks involves compiling rape problem profiles and looking inside them for patterns, such as when and where crimes occur. The correct means of linking crimes, however, is the opposite: taking the attack/attacker as the point of reference and undertaking lines of research outwards.
This mistake is why police forces fail to link rapes in the first place, meaning that the report is setting in place the causes of the problem it is seeking to solve.
January 2012 - Starting intelligence development with case crime
It is sometimes suggested that intelligence development is proactive when targeting known offenders, but reactive when starting with the unsolved crime. This distinction is meaningless; starting with the target and working forward to the crime is no different from starting with the crime and working backwards to the offender; in both cases, the analyst is trying to link one to the other. Pro-activity is better understood as a state of mind rather than a method; if the analyst is engaged in research which he sees good reason for, then it is proactive. Reactive is when research is conducted for no other reason than ticking a box.
Using the unsolved crime to start intelligence development can have six benefits:
None of the above should be taken to mean that it is wrong to target individuals from the outset; doing so has its own advantages, may work better for some analysts, or be more effective in some situations. I list the benefits of starting with unsolved crime only to offset the negative and inaccurate description of it as reactive.
December 2011 - One database, two accounts
When searching a crime database for similarities in reports, the intelligence analyst will frequently need to look at different crime reports simultaneously. Some databases, however, only allow one report to be displayed on-screen at a time, forcing the analyst to go in and out of reports. Intelligence analysts with such a set up should ask the IT department to arrange two accounts or usernames, so the database can be opened twice, and each version displayed on screen at the same time, and operated independently of the other.
November 2011 - area-based policing and detection do not mix
The U.S. Department of Justice website features an interview with Chief Superintendent Bilson of the Metropolitan Police, who explains the National Intelligence Model to an American audience. The interview can be found by going here, selecting "Perspectives in Law Enforcement" on the left hand side, and scrolling down the list of interviews. What Chief Superintendent Bilson describes is the use of statistical analysis: monitoring crime levels by type, area, time, etc and deploying patrols accordingly. The following excerpt is about 20 minutes in:
In the Model, there are three broad meetings that are recommended. The first is a strategic meeting once a month, where we look for the latest crime information, trends, patterns, and we set the priorities. The second meeting that we hold every two weeks we get into the detailed deployments of which areas, which times, which resources are we going to deploy The third meeting is the daily management meeting where we review overnight crimes, trends did we make all those taskings and deployments, and what impact have we had.
So, putting all that to work in Hounslow were focused on problems and deployments right across the range of policing businesses here; so, my patrol officers get tasked, we get to an extent now where we can start to get predictive around where crime might occur, and target our resources in to resolve that.The emphasis on statistical analysis becomes more explicit in the example cited:
We noticed that, late on in the evenings and at the weekends, we were getting outbreaks of disorder, and we were getting street robbery. We tasked the analysts to get into the crime patterns and information that we had already, and come up with a profile so we understood what was going on. That analysis told us a very clear block of Friday and Saturday evening, midnight to one in the morning, was our hottest time for crime. We were able to deploy resources into the area. We stopped any of the crime by just being a visible presence on the streets and being proactive and stopping and searching people there.Superintendent Bilson goes on:
A call came in later, from a witness who had seen a suspect in another part of the town; [a] patrol officer was able to get there and arrest him, and once she had got the suspect back to the station, the investigators were then able to reach into the intelligence model, and the analysts provided them with analysis of the linked series, and it resulted in that suspect being charged with a series of offences for street robberyA successful example of analysis not
Let me explain what Supt Bilson is describing: the statistical analysts did their job of describing crime in the area - but then went beyond their competence by playing detective and linking crimes on the basis of similarity. In so doing, they failed, not because their choice of links was necessarily wrong, but because of what they did not link.
Investigative analysis is done by reading a crime report first, and then searching for linked crime reports. The analysts in the above example did the opposite; they collected crime reports by area and time, and then read what they had to assess which were linked.
Understanding this distinction is critical: intelligence analysts take individual crimes as the starting point, meaning their research of MO and suspect descriptions can be taken beyond the locale, and to crimes that occurred months or years previously; parameters are continually adjusted as new information is obtained. This is how crimes are linked and solved not by looking in a pre-determined area and period, comparing crimes within and concluding that some are linked. They may well be, but such a conclusion can only ever be incomplete, and possibly misleading. If the analyst does not have the instinct to dig and dig, detectives will be left wondering: what else is out there, and how would that affect what we have?
So, the link analysis described in Supt Bilsons narrative is no such thing; the offender was not identified, except for a witness who saw him, quote, in another part of town. That point alone illustrates why an area-based perspective is no good for crime detection. The analysis described by Supt Bilson is successful only in its correct context; that of establishing frequency and type of crime in a place or period, in order to establish priorities, deploy resources, and advise on crime prevention measures.
October 2011 - Police Oracle
Police Oracle is a website that supports police and civilian personnel by providing news, law updates, equipment sources and recruitment. Here is their job vacancy search tool, relating to analysis:
I used the search tool to bring up the current list of analyst jobs; the first I came across was "Traffic Management Planner". The next two in the list were "Intelligence Analyst" and "Intelligence Officer".
Seriously, folks, how can the management of traffic be regarded as the same category as criminal intelligence and investigation? I have written to Police Oracle the following, and will update this entry with their reply:
"On using the job search tool, I discovered that Police Oracle has only one category for 'analyst'. This is incorrect, since there is no single job of 'analyst', but two: intelligence (or investigative) analysts, and analysts involved in management, planning and statistics. Consequently, when I tried the 'analyst' search option, it brought back matches of Traffic Management Planner and Intelligence Analyst, even though one is not comparable to the other. Please could Police Oracle consider two categories of 'analyst': intelligence/ investigative and statistical/planning, to avoid confusion".September 2011 - Analysts' reporting etiquette #4
Given the practice of "tasking analysts", an intelligence analyst may wonder: if I am doing my own intelligence work, what reason do I give? How do I explain myself?
The answer is to start one's report along the following lines: "This report represents research into a burglary in Anytown on 14 August 2011, reference C1234/11".
That's it. An analyst does not justify their right of choosing a subject for analysis; they exercise it.
August 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 4 of 4
Last month's Telex concluded by asking: why does IACA feature intelligence analysis on its website; why does it want crime statistical analysis and crime intelligence analysis to come together? A clue to the answer is the sentence highlighted below, from the IACA article How does Crime Analysis differ from Intelligence Analysis (for the article in full, see my entry of May 2011):
The sentence is saying that the analyst community is divided in its views. Such a division would seem, on the face of it, inexplicable; how can a group of analysts, who are presumably all thinking people, have opposite conclusions on the same thing?
Before I offer an explanation, consider the following scenario:
This scenario, based on a real example, shows how misinterpretation of words can have the reverse effect to what is intended. The senior manager refers to crime types but, by the time his instructions reach the analysts, his words are assumed to mean crime cases; this is because, in an intelligence environment, where the instructions are being applied, this is the natural interpretation. Were analysts to comply with the instructions as relayed, they would spend all their time looking at personal offender details (where offenders live, who they associate with, what cars they own, etc), none of which would be actionable, since it does not include the crimes the offenders are supposed to be doing. Which, of course, is not what the senior manager meant.
Returning to the apparent divide between analysts who support, or oppose, the combining of statistical and intelligence analysis, I suggest that this is what is happening:
This explains why there are analysts who believe that the professions are separate, and why there are those who think there should be no distinction at all. This is not a divide as such, but a monumental misunderstanding on the part of the latter. There is not, and never can be, a continental drift-like coming together of the intelligence and statistical analysis communities. Any perceived overlap will always, on close examination, be revealed to be square pegs in round holes, and vice-versa.
Fortunately, the means by which analysts can determine which of the two professions they belong to is very simple. If an analyst is looking at actual offenders, actual crimes, actual victims, actual vehicles, actual stolen property, and so forth, then it is intelligence work. If the analyst is looking at offenders, crimes, victims, vehicles, etc by category, then it is statistical. It is as easy as that.
July 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 3 of 4
IACA's feature What Crime Analysts Do (cache) lists five functions, three of which are statistical, one is intelligence, and one is split. This comment will focus on the two with an intelligence element.
The above is almost entirely statistical in content except for two words: "Series" (in the title) and "who", in the concluding paragraph. If these two words are omitted, the function would read just fine as an example of statistical analysis, referring, as it does, to trends and hotspots, etc. How then, does the identification of crimes series get included? Focus on the second sentence: "If a burglar starts targeting drugs stores in your jurisdiction, a crime analyst will let you know on the second incident".
To understand why this understanding of linking crimes is wrong, consider how crimes are linked in practice. First, crimes occur. The intelligence analyst reads the reports, selects one that is researchable, and researches the MO, suspect description, etc against existing information. The analyst selects previous crimes that are believed to link and, in so doing, identifies a possible linked series and offender (the latter if not by name, then by method). The analyst is thus linking crimes from the past to those in the present. The analyst is then able to identify future crimes in the series, because he knows what he is looking for.
Now, consider again IACA's version of how to identify a crime series: "If a burglar starts targeting drugs stores in your jurisdiction, a crime analyst will let you know on the second incident".
What is happening is this: IACA, run by statisticians, is looking at crime in terms of categories (burglary, drugs stores, jurisdiction) into which new offences can slot. Thus, the selection of crimes is automatic and self-fulfilling. Grouping crimes in this way is suited to statistical analysis because it is how analysts identify "problems and trends"; in this case, an increase in burglaries at drug stores in a particular jurisdiction. From this, police management can launch counter-measures, such as targeted patrols and crime prevention initiatives. But this is not how crimes are investigated or crime series identified. Crime investigation starts in one way only, and that is by reading the crime report; from that instant, all pre-determined categories cease to have relevance, because the individual crime, and thus the offender, becomes the category.
Here is IACA's second function pertaining to intelligence:
IACA commences, "Intelligence is special information that..." Stop right there. The reference to "special information" places IACA's definition of "intelligence" in the cloak-and-dagger realm of source information, surveillance, and so on.
The problem is this: if IACA regards "intelligence" as the collection of information, special or otherwise, then where does that leave actual intelligence, that is, the integrated picture formed by the links that join the information? IACA does not know, because it does not acknowledge the relevance of investigation.
Intelligence is formed by linking, and linking is driven by investigation. No investigation, no linking; no linking, no intelligence. Investigation is the element that is absent from IACA's thinking, and this is brought into focus in the final paragraph:
This is not what charting is about. The purpose of link charting is to enable analysts to understand progress arising from investigations that they are conducting, alongside the investigating officer. Doing a link chart to show known relationships misses the point; the analyst should be discovering relationships as they explore the information. It is the discovery of new relationships that is the analyst's objective, not displaying old ones. Ditto, IACA's suggestion of producing charts for court presentations; while it is important that intelligence is available to counsel and jury in the form of charts, this is a presentational matter that is addressed when the analysis is finished.
And let's read once more the sentence cited earlier: "If a burglar starts targeting drugs stores in your jurisdiction, a crime analyst will let you know on the second incident". So, IACA does not understand the relevance of investigation to identifying crime series, either.
Blindness to the investigative element compromises IACA's ability to understand intelligence analysis, and explains why it presents intelligence analysis as "special information" and/or an extension of statistical analysis. Neither definition is correct, nor is each compatible with the other.
How to undo this? The means is to extract the references to "crime series" and "who" from the function on "crime series, trends, etc" and place them in the "intelligence" function. Once that happens, the two components will integrate, and reveal intelligence to be the examination of both individuals' actions and associations, formed by linking crime to crime, crime to person, person to person, and all the many permeations, such as person to car, car to address, to bank account, to mobile phone, and from specific phones call back to one or more crimes. This new understanding will inevitably mean that IACA's notion that intelligence is related to statistics will have to be dropped.
It will also force the question: why does IACA feature intelligence analysis on its website at all, given that its original remit was to represent crime statisticians. Is it launching some sort of land grab? An explanation will be offered next month.
June 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 2 of 4
The previous entry argued that IACA's attempt to reconcile crime analysis and intelligence analysis was flawed. This entry will explore this further with reference to its feature "What is Crime Analysis?" (cache).
There is a potential problem with the question "What is Crime Analysis?" or, to be more precise, the term "crime analysis" itself. Crime analysis can be taken to refer to two different things: categories of crime (statistical analysis) or actual or individual crime (intelligence analysis). Confusion can be avoided so long as everyone knows which of the two meanings is being used, and sticks to it; in the USA, crime analysis has historically meant statistical analysis. Unfortunately, IACA has forgotten.
When we look at IACA's above list of analytical tasks, the first we see is solve crimes; this is not statistical, because it relates to an actual or individual crime. The third task on the list is find and apprehend offenders, which is another way of saying solving crime, and so is the fourth task, prosecute and convict offenders. So, tasks one, three and four are intelligence analysis.
In contrast, six of the eight remaining tasks involve planning, resource allocation and crime prevention, and so fall into the statistical camp of analysis. To take each in turn:
The final two tasks on IACA's list (enacting policies and educating the public) are auxiliary or supporting skills, which are not analytical in nature. These two aside, therefore, all the tasks on IACA's list can be categorised as either statistical or intelligence. In fact, there are no analytical tasks that cannot be categorized as one or the other. If IACA understood this, it would have two lists, not one.
This mixing of two professions does not appear to be unintentional on IACA's part for, elsewhere on its website, it gives prominence to the following statement:
The quote says that the responsibilities of intelligence analysts and planning/management analysts "similar" and that they are different titles for one profession of crime analysis.
The statement is extracted from the report Enhancing the Problem-Solving Capacity of Crime Analysis Units, which can be downloaded here. What is apparent on reading the report is that it has no relevance to investigative or intelligence analysis; indeed, its introduction explains:
So, despite acknowledging its non-relevance to intelligence work, the report states, in a manner that could be construed as cavalier, that intelligence analysis is just a different job title for management and planning analysis. The report thereby exemplifies a problem that is seen elsewhere: that discourse on intelligence analysis is frequently commandeered by people who don't actually do it, who don't know what it is, yet who freely lay claim to it as an extension of statistics. The result is the drawing up of "shopping lists" of analytical tasks and skills, such as that on the IACA website, that make no distinction between the two professions and, worse, present the two as one.
I will go more into the mechanics of this, next month, with reference to IACA's feature on "What Crime Analysts Do".
May 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 1 of 4
One of the main themes of intelligenceanalysis.net is how the distinction between intelligence and statistical analysis is confused because of language; for example, in the UK, statistical analysis is referred to as strategic analysis, which confusing because strategic is a level of analysis, not a type.
The United States has a similar problem: statistical analysis is referred to as crime analysis, which is potentially confusing because it could also be taken to mean intelligence analysis, that is, investigation of an actual crime.
The U.S. based International Association of Crime Analysts (IACA) recently tried to undo this confusion with the article copied below. Readers should read it all the way through and come to their own conclusions, before reading my own comments, underneath.
NB: shortly before I was due to upload this entry, the IACA page was removed, so it may not now be representative of IACA's views.
Note the attempt to define intelligence analysis and crime analysis:
Seeking to clarify definitions by referring to historical experience is flawed; consider the above paragraph in a different context:
Such a statement can be true, but one does not define a shape by reference to what it is used for, but by reference to what it is. Circles are round, and squares have four sides. In the context of data, there are two types of analysis; that which concerns actual people, places and events, and that which concerns categories of people, places and events. These two disciplines do not need to be justified; they just are.
Instead of assuming these definitions as self-evident, IACA seeks to discover them by looking at (in the first paragraph) what analysts are used for, (in the fourth and fifth paragraphs) the locations at which they work, and (in the penultimate paragraph) the levels at which they are used. All this is unnecessary and distracting.
Happily, the article reaches the correct position in its fourth and fifth paragraphs:
Correct. There are analysts employed as investigators (usually called intelligence or investigative analysts) and there are analysts are employed as statistical analysts (also called problem-solvers, crime analysts or strategic analysts; take your pick). What is the relationship between the two? None, there isn't one, and IACA makes no case that there is; but instead of leaving it there, IACA adds:
Sounds like a fudge. IACA acknowledges that the two functions have "different audiences, products, and goals" (correct) but that they share "common tools, techniques and skills", which is incorrect (since when did statisticians and investigators share tools, techniques and skills?). It says crime analysis and criminal intelligence exist "side-by-side under a common banner"; no, they don't: crime analysis exists alongside crime prevention, management planning, resource allocation and partnership; intelligence analysis exists alongside detection, forensics, informant handling, surveillance and prosecution.
Given that the text has been removed from the IACA website, it may no longer represent the Association's standpoint, but there is much more on the IACA website of a similar nature. The next few entries of this Blog will examine examples, and then try to work backwards to explain why IACA should attempt the above explanation of the difference between crime analysis and intelligence analysis.
1 April 2011 - about Tasking
i) Where tasking fails
Imagine an intelligence analysts job as a sheet of paper. Analysts are free to explore what is on that paper. A tasking is when someone puts an item on that paper, and says, Investigate this. Although the analyst undertakes the tasking, it is not their underlying job. The tasking is in addition to the analysts function of exploring and self-tasking. Even if the tasking is a year-long investigation, covering 99% of that sheet of paper, the relationship between the base job and the tasking does not change.
Where tasking fails is where it is assumed to be the job itself; i.e. the underlying sheet of paper is thrown away, allowing the analyst to undertake only what is left. Suddenly, the analyst is no longer able to explore and develop intelligence freely; they are restricted and this conflicts with the investigative outlook and initiative that analysts are expected to possess. Although tasking is said to make analysts more effective, analysts who do only taskings will do those taskings less effectively than those who are free to do self-tasked work alongside, since only the latter are able to think and operate fully like analysts.
Supervisors who do not understand this hover round the analysts desk, asking, Why are you doing work for which you have not been tasked? So long as the analysts work on formal taskings is proceeding satisfactorily, it is no-one elses business why the analyst is doing additional work. Intelligence analysts are employed for a reason, which is to develop actionable intelligence; the analyst does not need permission to do this. This goes double for when a newly appointed manager says: No more analysis until we have decided our new priorities. Such pronouncements have no basis, and can be ignored.
ii) Why self-tasking succeeds
If an intelligence analyst is confronted with ten overnight crimes, it will be clear which one is most suited for intelligence analysis. This is the one with the most researchable data. The analyst can get straight to work. With experience, the analyst can get a feel for what will be achieved by the research before he or she has even started.
If the analyst is tasked by others to look at one of those ten crimes, the selection will be for reasons other than analytical suitability; for example, a crime which is of a type prioritised by the force. No matter how laudable these reasons are, they are political, and bear no relation to the analysis potential. Consequently, there is a ten-to-one chance that the crime chosen will be the one most likely to get a result.
Analysts need to understand that taskings reflect needs of other people in the organisation. But people raising taskings also need to understand the effect on the analysts productivity. There is no quicker way to reduce the output of analysis than through endless taskings. Self-tasking is invariably more successful, because the analyst instinctively gears it to getting a result.
1 March 2011 - Lateral thinking
I want to add to my posting of 4 January 2011 on training and recruitment (below). I once investigated distraction offences where males offered to do work on the outside of buildings; they made reference to putting up scaffolding. While researching, I came across another distraction involving females offering to do wallpapering. Since offender description and modus operandi were different, I saw no reason to link them; in fact, I saw reason not to link them: women are not men, and wallpapering is not scaffolding. Period.
However, the officer in the case pointed out to me that women would not be expected to work on scaffolding; they would instead do the female equivalent, such as work on the inside of the building. Suddenly, the idea of women offering wallpapering being linked to men offering scaffolding seemed very plausible.
Looking at something from a different perspective, and coming to an alternative conclusion, is what is referred to by "lateral thinking". The two crimes did not match when compared in the usual way, that is, directly. But the conflict in the MO and descriptions was resolved when the relationship between the two groups was considered.
The difficulty with lateral thinking as a concept is that there is no button inside ones head that can be pressed to activate it. One does not say, Okay, I cant find the answer, so Im now switching to lateral thinking.
The reason why the detective saw the connection that I missed was experience. Experience is how investigators and analysts acquire the ability to make links that are not immediately obvious: undertaking investigative research, skim-reading a lot of crime reports, thinking like a detective.
Training courses that seek to train analysts in lateral thinking are therefore missing the point; they need to train the intelligence analyst to think like an investigator, and the lateral thinking will follow naturally.
15 February 2011 - Analysts' reporting etiquette #3
Intelligence analysts discover things; the pieces of information they rely on may be old, but what they discover - linked information, i.e. intelligence - is news. After the analyst has reported to the case officer, he or she will probably report to a regular management meeting. The case officer will not usually be at that meeting, but his area sergeant or supervisor will be.
If the analyst's report is specific and actionable, the analyst should inform the sergeant of its findings before the meeting. This is because the sergeant will want to be seen to be aware of what is happening on his patch in front of others, particularly if the meeting's chairman, perhaps his superior, is likely to fire a question at him, such as: "What are you doing about the analyst's discovery?" The sergeant will not want to be on the back foot.
So, while updating meetings is part of a formal process, give a thought to who might like to know, beforehand.
1 February 2011 - when statistics is not statistics
Before Christmas I met an intelligence analyst who said that statistics was a very useful tool in investigation and intelligence. I asked for an example. He explained that in credit card fraud prevention, software programs use algorithms to measure frequency, volume, etc, thereby flagging up potentially suspicious uses of credit cards. For instance, the program would recognize payments on a credit card normally averaging £50 a day and on spent local purchases rising to £5,000 a day and sent to a foreign bank account; this would trigger an alarm.
My analyst friend is mistaken; this is not statistics, because the computer program is not monitoring transactions en bloc, but transactions per card. Calculations therefore regard actual transactions compared against the cards own history, and/or against (the average of) actual transactions on other actual cards. In other words, transactions are not swimming around, unassociated, in a database, but are linked to cards and/or people from the outset.
Software programs that monitor mobile phones operate on the same principle: every one of billions of phone calls is linked to a handset or sim card via the billing or telecommunication process. The mathematics employed in these algorithms is wholly different to crime statistics such as hotspots where crime and disorder is unlinked and consequently grouped under other criterion not related to a person. So, the two uses of mathematics are not comparable.
4 January 2011 - the other problem with intelligence analysis training and recruitment
This site has pointed out the chief flaw in recruitment and training for intelligence analysis, which is the attempt to mix two unrelated fields, intelligence and statistics. But there is another flaw, relating solely to perception of intelligence.
Intelligence analysis is commonly said to be about the following:
While none of these descriptions is strictly wrong, they are associated with disciplines such as science and computation, even philosophy, and give the impression that analysts are doing something clever, brainy or academic. Job advertisements often insist on the need for academic ability by limiting applicants to those with degree level qualifications.
I am going
to explain, in one paragraph, why intelligence analysts need be no smarter than
anyone else. An analyst does not look at a piece of information, A, and derive
more meaning than the next person. What the analyst does is to search a
database in relation to A, finds B, and then looks at A and B together.
Greater understanding develops as a result. An analysts insight does not
flow from intellectual ability, but from asking a series of questions and
piecing together the answers.
Training courses veer from teaching nebulous intellectual concepts at one end to narrow mechanical tasks at the other: commodity flow charting, financial profiling, association chart construction. The result is that analysts produce charts which, while technically perfect, have a stale air about them. Something is missing from the analysts approach. Training courses recognize this and try to provide the missing element by combining the chart with the intellectualism, encouraging analysts to ask the following type of questions:
This approach does not work, because such questions are designed to see depth in linked information. The fault is this: analysts will know the significance of linked information because they were the ones asking the questions that led to it. The issue for trainers is therefore: how to get trainees to ask questions that seek out linked information in the first place.
[The previous paragraph is important; please re-read it until it sinks in]
The only way to ensure that trainee intelligence analysts ask the right questions is for trainers to regard them as investigators from the outset; to say to trainees: you are detectives, so think like detectives, find out what happened, and who is responsible. This recognition is critical, because it provides words like hypothesis and inference with a context, and therefore meaning. Without this context, training courses are rudderless, and so are their trainees.
Contrast training courses in intelligence analysis to those which need not feature the word analysis in the course title, such as telecoms, financial and internet investigation courses. These courses represent the most complex investigations that analysts are likely to undertake, yet are devoid of references to cognitive thinking. These courses do not try to teach trainees how to think (thinking being an assumed ability) but instead limit their attention to teaching practical skills on how to link A to B.
So, there are two steps that need to be taken to correct intelligence analysis training. The first, as explained elsewhere on this website, is to de-mix it from statistical analysis, and to get terms such as patterns and trends out of intelligence analysts heads.
The second is to eliminate the emphasis on intellectualism. The success of telecoms, internet and financial courses suggests that training courses in intelligence analysis would be more effective if trainers stopped trying to think of analysis, and more in terms of investigation skills for the computer-based detective. A ten-day course on the typical questions and lines of enquiry that analysts need when investigating the common crime types - linking crime to crime, crime to person, person to person, and all the permeations - would be infinitely more useful than modules on problem-solving triangles, and the like. Analysts would return to their forces, armed with a set of practical skills, and know exactly what to do.See here for Telex's in 2010