Getting Back to the Basics: Addressing Foundational Weakness Affecting Law Enforcement Counterterrorism Intelligence Functions

Intelligence is at the core of the law enforcement response to the Boston bombings and is increasingly driving state and local law enforcement operations ranging from investigations to security plans for major events. Intelligence-Led Policing appears to be here to stay and, yet, at the core of this paradigm shift lays a struggle with the concept and practice of intelligence.

The symptoms of this struggle start at the most basic level – an understanding of what intelligence is. No two state or local police agencies define “intelligence” in the same way.[1]  What may be considered intelligence to one agency may be mere information to another.  What may be interpreted as actionable intelligence to one may be strategic or altogether mis-categorized by another.  This disparity is not, in and of itself, a fatal flaw that characterizes the weakness as intelligence priorities will always influence intelligence requirements.  The critical weakness is in how intelligence is defined, how that definition is understood, and how that understanding then shapes law enforcement’s collection, analysis, and ultimately response to criminal and terrorist activities. 

In the state and local law enforcement community, the word “Intelligence” is often used synonymously with the word “Information.”  This is incorrect and dangerous.  It is dangerous because it belies both a capability and perception that operational decisions are formulated and based on as well as decisions on case focus, allocation of resources (human and budgetary), and courses of action. The misuse of the term intelligence creates in the mind of untrained officers the idea that they know what intelligence is, and therefore the distinction between intelligence and information. Ultimately, the term and the function are degraded and lose their intended purpose.

So what? Why should we be concerned with a matter of semantics?  In short, because the terms we use within law enforcement, law enforcement intelligence, and the greater intelligence community (IC), shape and affect the law enforcement intelligence practice.^[2] The reality is that in most cases law enforcement agencies do not employ or practice intelligence functions in the classic sense - which is to say they do not conduct or engage in any type of predictive analysis.  Instead, they pretend to engage in intelligence practice by calling information, gleaned from investigations, that has not been vetted through a proper intelligence process (i.e.: properly collected, assessed, integrated, analyzed, disseminated) intelligence. Many even go so far as to refer to pin clusters reflecting various crimes – commonly associated with Computer Statistics (COMPSTAT) – on a pin map as indications of future crime trends and therefore intelligence.[3] Although capturing historical data is important and contributes to overall knowledge of the threat environment in and of itself, without having been analytically vetted it can hardly be considered predictive.  Continued synonymous and interchangeable use of the terms intelligence and information reinforces the misconception that many agencies truly have an intelligence capability and function.  As many seasoned intelligence practitioners can attest, there is a significant distinction between gathering information and using intelligence to support tactical, operational, and strategic outcomes, and aide in the decisions making of senior law enforcement personnel.^[4]

As I learned during my time as an intelligence analyst for the military, intelligence and information are substantively similar but qualitatively distinct. The Department of Defense (DoD) defines intelligence as “the product resulting from the collection, processing, integration, evaluation, analysis, and interpretation (author’s emphasis) of available information concerning foreign nations, hostile or potentially hostile forces or elements, or areas of actual or potential operations.”^[5] The term is also applied to the activity, which results in the product and to the organizations engaged in such activity.  The intelligence community on the whole has accepted and adopted this definition.  According to Parker, University of Michigan, information is defined as “pieces of raw, unanalyzed data that identify persons, organizations, evidence, events, or illustrates processes that indicate the incidence of criminal events.”^[6] The most salient term within this definition, that word which distinguishes intelligence from information, is unanalyzed. An essential ingredient for the application of intelligence is an understanding and appreciation of the nature and constituent elements of intelligence, as a term, a product, and a value based effort.

To be effective, the law enforcement community must interpret intelligence-related language in a manner consistent with the broader intelligence community. This uniformity in lexicon, meaning, and application provides the basis and foundation for common standards, policies and practices that encourage professionalism, purpose, and collaboration among law enforcement intelligence functions, and intelligence sharing.^[7]

There are very real-world consequences to not getting this right: News reports are replete with incidents of “intelligence failures” due to lack of intelligence coordination, sharing, disparate systems, poor training, or misplaced resources and funding.  Since the 9/11 attacks, fusion centers, created and mandated to facilitate the production of actionable intelligence for state, local, and even federal agencies, have failed.[8]  According to a recent Senate report “fusion centers have often produced irrelevant, useless or inappropriate intelligence reporting for the Department of Homeland Security (DHS), and many centers failed to produce any intelligence whatsoever.”[9] The unfortunate reality is that the saying “when you’ve seen one fusion center you’ve seen one fusion center” is more fact than fiction.

What this author contends is that many of the problems that plagued so called state and local law enforcement intelligence functions and capability before the 9/11 attacks still exist because state and local agencies do not speak the same language.  More importantly, when they do seemingly speak the same language they do not interpret that language in the same way! The problem becomes even more acute when agencies share the same border or overlapping jurisdictions. This lack of common definitions, language or lexicon will continue to result in indicators, warnings, and actionable intelligence being misinterpreted and leading to missed opportunities.

State and local law enforcement intelligence functions across the U.S. are not currently equipped, trained, manned, or organizationally aligned to produce or provide their respective agencies with finished actionable tactical, operational, or strategic intelligence products.  Many major city law enforcement agencies, if they have a dedicated intelligence function at all, have not fully appreciated or harnessed the power potential that an appropriately trained, staffed, and equipped intelligence section can provide.  With the exception of the New York City Police Department – which has over thirty two thousand police officers – most agencies do not appreciate or have the vision to recognize the potential value of intelligence functions, enough so as to properly staff or dedicate appropriate resources.  Recently the Chicago Police Department disbanded their fledgling intelligence unit, a unit that reportedly played a substantive and instrumental role in thwarting a planned attack at the recent NATO summit.^[10]  This example, unfortunately, is symptomatic of the general lack of understanding and appreciation for the value that intelligence functions provide.

State and local law enforcement intelligence application, in its current form, is unable to provide a uniformly credible and valuable intelligence capability or function. This lack of capability and function creates a knowledge gap in the threat domain that can potentially be exploited by criminals, criminal organizations, or terrorists. It’s time to take a hard look at some of the reasons why we are failing.

Defining Intelligence, Identifying Value, and the Importance of Leadership

Although many major state and local law enforcement agencies may not field intelligence functions, the basic foundation and resources within do exist. There are personnel who possess a willingness to develop the expertise and a desire to produce intelligence products.  Many investigative personnel have the cognitive and analytical abilities necessary to matriculate into capable intelligence analysts. In many departments, the basic organizational structure and framework is in place and can be refined to effectively and efficiently collect, process, integrate, analyze information, and produce a viable and informative finished intelligence product.  It begins with leadership, and state and local law enforcement speaking the same language, applying the same meaning, and recognizing the powerful potential of law enforcement intelligence.

To be effective, the law enforcement community must interpret intelligence related language in a manner consistent with the broader intelligence community. This uniformity in lexicon, meaning, and application provides the basis and foundation for common standards, policies and practices that encourage professionalism, purpose, and collaboration among law enforcement intelligence functions, and intelligence sharing.^[11]

Many major city law enforcement agencies do not have an “intelligence” section, unit, or organization, as defined. Many have neither the collective expertise nor the training or resources to effectuate rigorous analysis that will turn information into intelligence, and, by extension provide the commander with predictive insight.

Without an analytical capability an intelligence function cannot exist.  Intelligence is a specialized form of knowledge and activity that informs the commander, uniquely aiding his/her judgment and decision-making.^[12]  Existing law enforcement intelligence functions (and all of their component entities) neglect to provide predictive meaning and only provide dated and historical case briefings. This approach fails to provide predictive meaning and, therefore does not uniquely aid the commander in the decision making process. In short, the commander is forced to guess about what is coming next. While the commander will never have ALL the intelligence he/she needs, he/she should be able to make decisions based on analyzed, accurate intelligence. 

Abating the misuse of the term intelligence, begins with a consistent and uniform definition of intelligence, a value-based intelligence effort, and leadership. These are the first steps on the road of changing law enforcement culture around the use of intelligence.

The value of intelligence can be defined in terms of the finished intelligence product, and how it enables the commander to make a thoughtful, informed decision. How the commander interprets value, therefore, dictates the direction of the intelligence efforts.

In order to provide value, law enforcement intelligence functions need to be structured so collections, intelligence analysis, and intelligence products are driven by the agency’s documented intelligence directives. The easiest and most efficient way of optimizing the production of finished intelligence products is by organizing intelligence functions into “Desks” or “Cells” that not only reflect the directives, but are physically located in the same space.  For example; an international or foreign section that is comprised of desks that reflect specific foreign terrorist groups (i.e.: Al Qaeda, Hamas, etc.); a domestic section that is comprised of desks that reflect specific domestic terrorist or extremist groups (i.e.: Sovereign Citizens desk, Black Seperative desk, Animal Liberation desk) and so forth. The personnel assigned to each desk or cell will be responsible for acquiring expertise, utilizing all source collections to gather information on their area of focus, and providing intelligence analysis and products on their respective problem sets. 

The creation of a desk system, physically collocated, will have an immediate two-fold effect. First, it will ensure a historically based, nuanced understanding of any one particular problem set while supporting and encouraging analytical processes.  Second, it will ensure that information is not horded or stove piped as the close proximity of investigators/analysts will encourage discussion, sharing, and oppositional points of view.

Oppositional points of view, particularly as it relates to intelligence analysis products, are necessary and integral to the commander’s decision-making process. They form the basis for additional questions, clarity, and options.  A robust and functional intelligence section will provide this.  Receiving intelligence assessments from one source, even if that source is the FBI, is myopic and potentially dangerous as it is an intelligence product that is interpreted by the filter of one source. A capable and credible intelligence section will be able to provide an independent view and assessment that can corroborate, support, or potentially refute some or all aspects of intelligence produced from outside resources.  Further, it will provide for visibility on emerging problems unique to a particular agencies area of responsibility. It will also go a long way towards creating the basis for credibility in the organization.  However, it must be noted that oppositional points of view are founded on good training and education in the intelligence arts.

Law enforcement intelligence functions, as a community, need to mandate and institute a standardized, basic 40-hour intelligence analysis course for its intelligence personnel in order to uniformly enhance the quality of information collected and overcome inconsistencies in skill level and training.  State and local law enforcement agencies should solicit intelligence analysis training from both public and private vendors. Uniform intelligence training and education is a critical component of a successful intelligence function.  A standardized, accredited, and certified basic intelligence and intelligence analysis course, recognized nationally will reduce or prevent potential exposure to liability, as well as address gaps in the finished intelligence product.  Lack of adequate, certified training, directly affects the productivity, motivation, and morale of law enforcement intelligence personnel as well as contribute to disparate quality of intelligence products.

Providing basic and continued intelligence training to intelligence personnel will substantially enhance counter-terrorism and intelligence capability by exposing personnel to emerging technologies and intelligence tradecraft.  This recommendation is based on the premise that educating each asset in the information sharing chain – from the Cyber Unit investigators/analyst to the intelligence section investigators/analysts – creates a much more robust analytical capacity. By informing the collectors of the raw data that will become the foundation for analysis and investigations, state and local law enforcement agencies can take a step toward ensuring that personnel know why they are collecting, assessing and passing on information and what the overarching objective of that activity is – the creation of actionable intelligence, whether it be strategic or operational.  It will also teach those involved a common language and an understanding of the intelligence cycle that serves as the foundation of counter-terrorism analysis activities.  But maintaining and harnessing the sharp edge of intelligence personnel knowledge and skill will be short lived if a succession plan to transfer expertise is not in place.

State and local law enforcement agencies with intelligence functions need to have effective and efficient succession in place for loss of personnel due to transfers, promotions, or retirements. With every loss there is a substantive drain in the existing institutional, historical, and experiential depth and quality. If there is no system in place to transfer that knowledge base and expertise to replacement personnel then the functions’ capabilities and competence diminishes substantively. In other words, if there is no overlap between incoming and outgoing personnel the unit will degrade and provide no value. Loss of expertise is a devastating drain of nuanced insight that cannot be easily replaced. Quite frankly, in many cases, it appears that very little forethought and preparation by command staff, in the case of law enforcement intelligence functions, is ever contemplated concerning the succession of personnel. This last point brings us to leadership.

The value of command leadership in the nurturing, training, guidance, and direction of an intelligence function, cannot be understated.  A commander who is uninterested in developing or expanding his/her own intelligence expertise on the one hand but seeks to understand, appreciate, and develop a quality intelligence function on the other is a disaster waiting to happen.  The effectiveness and competence of an intelligence function, especially in law enforcement, is wholly dependent on command staff.  An intelligence function cannot exist without an intelligence manager – a leader who understands and appreciates the value an intelligence function can provide and the value that intelligence personnel represent.  In order to gain value from an intelligence function, a commander needs to know what the collective training, skill, and competency level of his/her intelligence function is, and how to leverage that function to optimize intelligence production. Much of that value begins with asking the right questions.

The Value of the “Right” Question

Case intelligence briefs that do not provide plausible potential outcomes or help fill gaps in the commander’s knowledge gaps serve no purpose but to inform the commander of what he/she already knows.  Being briefed on the status of cases is valuable because the commander is informed of developments in investigations since the last briefing. However, these are only updates and provide absolutely no intelligence or predictive value. Tactical, operational, and strategic decisions concerning Divisional, Bureau and Department dispositions cannot be supported by historical reviews and recent updates of various cases. In many cases, the briefers have lost sight of what they are supposed to be briefing, and the leaders have lost sight of the intended purpose of an intelligence briefing. There are two reasons for this; 1) not knowing the definition of intelligence (discussed above), 2) not asking the right questions.

What are the right questions?

Rendering a review and revealing new developments of a case is fine, but that should take all of three minutes.  The remaining time should be dedicated to answering the following questions:

1. What does it mean? (Analysis)
2. Why is it important? (Significance)
3. What are the tactical, operational, and strategic implications? (Reasonable potential outcomes)
4. What are we missing? (Gaps)

Briefers should not be allowed to make unqualified statements or assertions.  For example, when briefers state that an individual or group is affiliated to or funded by a group of interest, the commander needs to ask the following: How do they know that? Where did they get that information? How was it corroborated, and what is the analysis based upon? Is it circular reporting – what were the origins of the information that led to supporting the finished intelligence? Over time, the culture and operating practice will adjust so that these questions are anticipated.

The need to answer the “right” questions will, in turn, force law enforcement intelligence functions to assess their strengths and weaknesses and initiate any restructuring required to enable them to answer those questions. From an intelligence standpoint, this should be the sole focus of the command staff.  Mission success hinges on the ability to answer these questions.  Doing so will provide VALUE!

Who is Providing the Analysis and the Intelligence Product?

For agencies that do not have an organic intelligence function and therefore not providing the commander with finished intelligence products, who or what entity is?  If the commander has access to or is receiving finished intelligence products from another agency or entity (i.e. FBI, Fusion Centers, DHS, etc.) that includes the unique interests and concerns of the agency and city in question, then there is no need for an organic intelligence function.

If the commander relies on other agencies for intelligence, it is important to understand the motivation and substance behind what is provided.  In other words, outside agencies will provide the commander with what they think the commander should know, not necessarily what the commander needs to know.  This is dangerous because that intelligence is not filtered through, influenced, or shaped by information captured by resources within the agency. That also means that the end product does not include nuanced information about the threat domain – an omission that leaves the door open for misperception and miscalculation by the end user.  The information being provided may be ninety percent accurate, in and of itself, but that additional ten percent provided by organic, nuanced insight may radically change the entire complexion of the treat environment and, therefore, change the commander’s decision process.

Ultimately, the reliance on intelligence analysis and intelligence products from outside agencies tends to undermine the growth of an intelligence function at a state or local agency and nearly ensures that the agency in question will never get a truly accurate picture of the criminal threats it faces. State and local law enforcement agencies need to develop straight forward, all source, robust collections plans, aligned with their directives, in order to support the analytical process and reduce exclusive dependence on outside agencies for finished intelligence products.  But “collections” have to have a purpose and a direction.

Why Collect?

Collecting information serves no purpose if it is not being processed and analyzed. It is only valuable when it has been processed – analyzed – and proves actionable tactically, operationally, or strategically. That is not to say that the information collected is not important, but it provides no value as potential intelligence if it is merely being stored in some unknown repository.  Additionally, the information that is collected – in accordance with identified directives – in and of itself is partial.  It is information that exists in a vacuum because it has not been assessed, compared or integrated with information collected by other entities (FBI, DEA, and other partners).  Even if the information was processed and analyzed, it would not be as complete or as accurate as it could be. 

The following questions must be asked when it comes to collection: What are we collecting? Why are we collecting it? How is it adding value to our intelligence process and our investigations? Where is it going? Who is analyzing and making sense of it? What does it mean? Are we collecting information for collections’ sake?

Part of the problem stems from the lack of a coherent job description for a collections manager at the state and local law enforcement agency level. This includes a description of the necessary qualification, training, and experience a collections manager should have.  Additionally, there needs to be a codified description of the duties, responsibilities, and functions of the collections manager.^[13] This lack of oversight leads to haphazard collections, direction, and confusion about priorities.^[14]

Untapped Resources

Intelligence drives operations. This is an age-old axiom. It is the key to victory on the battlefield and success in any counter-terrorism mission. Intelligence products and the personnel required to produce intelligence products have to be a priority. The question has to be asked: What is more important – filing reports that have yet to produce any meaningful actionable intelligence, or having a functional and capable intelligence unit that can provide the commander with substantive intelligence products and options to guide decisions?

Identifying the right people to do intelligence work is imperative. Not everyone or anyone has the requisite cognitive skill set, aptitude, imagination, or desire to become effective and capable intelligence analysts.  The learning curve is steep and requires dedicated individuals willing to commit to long hours of analytical training, reading, and thinking. What this means is agencies have to survey their personnel in order to identify, recruit, and reassign the best-suited personnel to the task.

If state and local law enforcement agencies are serious about counter-terrorism and preventing an attack, they need to develop a real capability and function and not be satisfied with the status quo.  It starts with finding the right people, with the right skill sets and desires, and moving them into the right positions. This is especially true of human capital assigned to cyber intelligence functions. 

Cyber units can provide the greatest potential for return on investment. The discovery and disruption of numerous criminal enterprises and budding terrorist attacks began with cyber intelligence. Criminals, criminal organizations, and terrorist groups increasingly depend on cyber space to recruit, communicate, plan, and coordinate activities. Cyber units are at the cutting edge of intelligence collections and production.  Properly manned, trained, and supported they can act, in many instances, as the sensor queuing mechanism that can potentially detect emerging threats.  But this value packed capability on the state and local level is withering on the vine. 

As of this writing there are only two major city police departments that deploy operational cyber intelligence units (counter-terrorism intelligence centered), LAPD and the NYPD.  The increased use of web based mediums to communicate, coordinate, plan, and initiate cyber or kinetic operations by criminals, criminal organizations, and terrorist groups provides an early indications and warning capability that few other intelligence resources can match.  Recently a planned denial of service (DOS) cyber-attack, of a major Southern California Police Department, was uncovered due to early cyber detection methods.  If properly manned with the right assets cyber units will not only be able to detect and uncover potentially hostile efforts independently, but will also provide a higher order intelligence capability and function to the aforementioned “desks.” Additionally, with further development, expansion, and direction, they can provide an initial counter intelligence/operational security layer to cyber systems and kinetic operations respectively.

What is the Mission?

While every organization needs to define its fundamental purpose, philosophy, and values, this is especially true of intelligence organizations at the federal, state, and local levels.  At the state and local law enforcement level, where issues of transparency, privacy, and liability are a natural part of the operating environment, it is particularly critical. The mission statement should state: why the organization exists; the direction in which the organization is heading; and the needs the organization was created to meet. Without the guidance of a mission statement, it is difficult to establish priorities and to cultivate a common vision.  A powerful mission statement provides clarity and focus, goals and objectives.

Providing the Tools

Personnel – Personnel are the foundation of any intelligence function.  The intelligence and cyber sections within any state and local law enforcement agency need to be manned to adequate levels. Personnel need to be hand-picked and vetted for security, aptitude, and willingness to work in counter-terrorism and intelligence. We need to be able to identify, recruit, and have reassigned, individuals that want to work intelligence with much greater ease. Personnel issues are very sensitive as the emphasis in any state or local law enforcement agency is always on patrol.  But added personnel to the counter-terrorism intelligence functions acts as a force multiplier and allow agencies to maximize deployment and improve effectiveness.

Training –Succession – The unique knowledge and skill level developed over time, relative to intelligence functions, cannot be easily replaced. A succession plan for replacing personnel that retire, transfer, or are assigned to special details, with qualified candidates will help to alleviate the drain of expertise and nuanced knowledge and reduce the learning curve of potential replacements.

Leadership and Vision – Any intelligence effort begins with leadership and vision.  Without leadership and vision any state and local intelligence effort is doomed to fail.  For many law enforcement managers and executives, the only priority is to stop and reduce crime.  To that end, all other functions that do not produce immediate and tangible results fall by the wayside.  But intelligence capability and functions are not anathema to crime prevention and crime reduction strategies or priorities.  On the contrary, they are the sin qua non of making such strategies effective and viable. Commanders often see the two functions as distinct and separate.  This skewed perception and operating paradigm stems mainly from demonstrable experiences and examples of intelligence successes.  Commanders who fail to learn how to harness and capitalize on the power intelligence functions represent will always be relegated to reacting to crime – and, as an unintended consequence, relinquish the upper hand to criminals, criminal organizations, and terrorists. 

Concluding Thoughts

Optimizing state and local level law enforcement intelligence functions begins with the basics.  The start of developing effective and competent intelligence functions begin with defining and uniformly applying the terms of “Intelligence” and “information.” Law enforcement must interpret intelligence-related language in a manner consistent with the broader intelligence community. Uniformity in lexicon, meaning, and application provides the basis and foundation for common standards, policies and practices that encourage professionalism, purpose, and intelligence sharing.  Establishing a mission statement specific to intelligence functions will provide clarity, direction, and focus. The right resources and assets, with proper and continuous training, can then be assigned and leveraged effectively and decisively. Law enforcement, as a community, need to recognize that the 21^st century cyber environment represent a paradigm shift in intelligence collections, integration, analysis, and dissemination. Cyber intelligence units are now the front line and first line of intelligence capabilities and functions, increasingly providing the early indications a warning of emerging threats.  But none of these basic changes can happen without LEADERSHIP!