OSINT & The Intelligence Cycle Part IV: Analysis and Production

After the processing phase it is time to analyze the data and generate an intelligence product such as a report, graph, or briefing. The analysis and production phase of the OSINT intelligence cycle is where an investigator analyzes and condenses their data in order to develop key takeaways, trends, and recommendations, while also noting any next steps, projections, and questions that arise.

No matter how powerful or insightful collected intelligence is, it is the analysis and the ability to convey to others what the data means that really sets an investigator above their peers. During the analysis and production phase, some tips I suggest are:

Answer Original Questions

Remember the questions posed in the planning and direction phase? A major part of the analysis and production phase is taking the processed intelligence and analyzing it to answer these questions and any new ones that have arisen. Use these questions as a road map in developing your analytical product and to help ensure you remain focused and do not get too far into the weeds on unrelated items.

Answering these questions will also assist in formatting and organizing your analytical product into logical sections. What about questions that cannot currently be answered? Don’t fret if you cannot answer every initial question.

But for those that you can’t, be sure to...

Call Out Intelligence Gaps

In a perfect world an analyst will have all the answers, but this is unlikely to consistently be the case. So while the analysis and production phase is where an investigator will lay out all of the information that they do know, they should also explicitly call out any relevant intelligence gaps including any unanswered questions.

Noting what intelligence gaps exist helps identify what additional questions must be answered and what research needs to be done in the next iteration of the intelligence cycle. Calling out gaps also shows those consuming the analytical product that an investigator did consider other avenues and possibilities, even if it was not fruitful.

Use Competing Theories to Reduce Confirmation Bias

When you spend your entire career looking for criminals, sooner or later everyone starts looking like a bad guy. Many new analysts I’ve met fall into the trap of confirmation bias, particularly when it comes to attribution of a target or determining whether or not someone is guilty of a crime.

For this reason, I highly suggest taking each bit of relevant intelligence you analyze and assign it to a column that either A) supports your current theory or B) disproves your current theory. Afterwards take a look at both columns and see if there is enough data to not only support your theory, but also take a look at how strong the data that disproves your current theory is. Do not throw out relevant intelligence just because it completely invalidates your current theory.

Instead, take a step back and reexamine the data. Analysts should let data tell the story instead of forcing the data into a box that tells the story the analyst favors.

Evaluate Relevance, Bias, and Reliability

Not all intelligence is created equal, and the validity, relevance, reliability, and potential bias of collected intelligence should always be taken into consideration during your analysis. An OSINT intelligence analyst wants to provide the best and most complete information possible, and that sometimes includes noting any backstory information that might suggest the intelligence being analyzed is less than trustworthy.

When possible, rank these particular categories as it relates to your intelligence product so that your audience has the background on your intelligence sources and how credible or biased they might be. Also be mindful of disinformation and misinformation, and the likelihood of such campaigns as they relate to your analysis.

Convey High Level Information Visually

Not all data needs to be conveyed at a granular level, and for high-level information, such as patterns and trends, displaying the information visually can provide a “quick glance” for data that would otherwise take up too much real estate in your intelligence product if displayed in its entirety. The full data can be provided in an appendix for those wishing to see the raw data, but in many cases those who are consuming the intelligence product are only interested in the major trends or patterns and less so about the individual data points. After all, it is the analyst’s job to synthesize the data and provide it in a consumable way.

Conclusion

The analysis and production phase is where the magic happens. This is the portion of the OSINT intelligence cycle where the newly processed information is analyzed and compiled into a final report, briefing, or other analytical product. This phase should cull and refine everything that came out of the processing phase, and use it to display pertinent information such as patterns, trends, recommendations, or projections. Following the completion of this intelligence product, the only remaining step in the intelligence cycle remaining is the final dissemination of the analysis and findings.