OSINT & The Intelligence Cycle Part Five: Dissemination

Following the analysis and production phase, the fifth phase of the OSINT intelligence cycle is dissemination. This phase consists of the final distribution of an analytical product for others to consume. Keep in mind that this does not mean that the intelligence cycle ends here and that the analysts just move on to their next assignment.

Though this part of the cycle will vary depending on the organization, it often includes some sort of feedback loop so that the consumers of the intelligence product can offer feedback and ask additional questions of the OSINT analysts. This feedback and the additional questions posed can then be fed back into the planning phase of a new intelligence cycle. When going through the dissemination phase I recommend keeping the following things in mind:

Don’t Forget the BLUF

The BLUF (Bottom Line Up Front) should be included with any product being disseminated, either in the email body or as a summary on the internal Wiki or Webpage where the document will be released. This short summary should contain all the important details of the product and show why the consumers need to pay attention to it. This is where you “sell” your product to your target audience, tell them why they need to open and review this document and what benefit it will provide them.

Keep in mind that many in your target audience likely consume intelligence from several other analysts and sources, so you are competing for their time. Failure to entice your target audience into actually opening up the intelligence product may result in them not giving your intelligence product the appropriate time for review or feedback.

Properly Mark or Redact Sensitive Information

Even if your organization has stringent handling and dissemination guidelines, once you release something to a wider audience you always run the risk of it being spread further than you intended, possibly even leaked to the public or an adversary group. Be sure to go over anything prepared for release with a fine-toothed comb and remember to properly mark with any applicable classification, distribution, or other requirements to reduce the risk that your final product is handled or disseminated improperly. When releasing to a wider audience I recommend redacting or removing sensitive details that aren’t necessary for the consumer to know. Many of the things that I will redact or remove when releasing to a wider audience include sensitive sources, unreleased methods or exploits, and any information that might compromise ongoing collection efforts. Also do not forget to double-check any screenshots and make sure you have not included your sockpuppet account information in any of the embedded images.

Tailor Distribution

There is a delicate balancing act that must occur when distributing an intelligence product. Chances are you don’t want to release the product to everyone in your organization, nor do you only want to provide it to a single point of contact, such as management, where it will go to die in an overcrowded email box. Siloing off information is great for mitigating leaks but is a major hurdle for sharing intelligence widely or quickly. Conversely, disseminating to more users than is necessary increases the risk of unauthorized sharing or leaking. Most analysts would want to distribute it somewhere in between these two extremes. One recommendation is to provide it to multiple consumers across the same relevant teams so that you don’t have a single point of failure, but also aren’t sending it to teams that lack the need to know. If necessary, leverage executive assistants to get your product on the desk of high ranking officials that likely get hundreds of emails daily.

Maintain Open Channels for Feedback

Intelligence occurs in an ongoing cycle. Without a proper feedback loop analysts may duplicate mistakes or fail to measure up to the standards set by the consumers of their products. Anytime a final product is disseminated analysts should provide their consumers with some form of contact for obtaining feedback. The target audience likely possess working knowledge of the topic, and may be able to provide more information which the original analysts may not have focused on. They may also be able to point out additional intelligence gaps which help drive the new planning and collection requirements for another cycle.

Conclusion

The dissemination phase is the portion of the OSINT intelligence cycle where the final intelligence product is shared with the appropriate consumers so that they may leverage the information and analysis and provide any feedback or follow up questions. This phase provides OSINT analysts with additional information which shapes the next planning phase in the subsequent intelligence cycle, with additional cycles occurring as needed. Each cycle’s feedback loop is routed into the next planning phase until all follow-up questions are satisfied or as new information becomes available.