Law enforcement intelligence analysis final examination prep, card set 1

Intelligence is the end product of a complex process, sometimes physical but always intellectual. The end product maybe a thorough description of the state of affairs, informed judgment, a single fact or best guess.

it is that activity whereby meaning, actual or suggested, is derived through organizing and systematically examining diverse information.

1.Support the police executive. ( Help the chief, Commissioner or superintendent to think outside the box)

2.  develop and maintain information on organized criminal groups or suspected terror/supporters and their activities.

3. support strategic, tactical, operational and protective law enforcement operations.

4. Support intelligence and investigate targeting

5. provide support and crisis situations

6.  monitor the potential for criminal activity.

7.Conduct counterintelligence

8.  develop indications and warnings ( based on criminal competitiveness, violence, criminal enterprises, corruption, suspicious activity.)

9.  Assist criminal groups/organizations potential for violence, economic growth/expansion (geographic), recruiting, mobility, and corruption.

10. Delienate the criminal infrastructure in the context of criminal and terrorist organizations and prioritize case for targeting.

11.  support law enforcement intelligence databases

Planning

direction

collection

reporting

evaluation

collation

analysis

dissemination

indexing, storage, repository

• 1. strategic
• 2. tactical
• 3. operational

1.  the chief, Commissioner or designee provides  information requests or asks questions to support a policy initiative; or states imperative concerning a criminological issue. ( Information requests or questions can concern short – or long – term issues)

2. the intelligence unit commander,  anticipating the Chiefs interests, generates information requirements or issues imperatives.

3. the intelligence process may be initiated by criminological or non–criminological events

4. the process may be initiated to update earlier generated intelligence information and products (i.e. assessments)  held believed to be stable. ( Remember, intelligence information is not static)

5. The process may be initiated as a matter of standard operating procedure

reasonable suspicion is (established)  based on information which establishes sufficient facts to give to a trained law enforcement or criminal investigative agency officer, investigator, or employee a basis to believe that there is a reasonable  possibility that an individual or organization is involved in a definable criminal activity or enterprise.

• 1. absence of an intelligence component
• 2.  overestimation
• 3. underestimation
• 4. lack of communication
• 5.  subordination of intelligence to policy
• 6. bias
• 7. denial
• 8. unavailability of information
• 9. received opinion

• 1.  good writing skills
• 2.  good oral skills
• 3.  computer skills
• 4.  possess professionalism/liaison
• 5.  flexibility/adaptability
• 6.  capacity/desire to learn
• 7.  possess initiative/motivation
• 8.  ability to organize, plan and prioritize
• 9.  knowledge of current events
• 10.coaching/teaching skills
• 11. operate under minimum supervision

An end product  about structure, infrastructure, activities, movements, plans, capabilities, intentions and motivations of criminal and terrorist organizations.

tactical intelligence can be the beginning of developing base–line information  about a criminological issue,  it can be the basis for intelligence development

officer survival information, assisting uniform officers to better handle specific calls, better response to specific locations, or better to handle specific types of offenders.

developing the criminal network surrounding a specific bad actor

this the end product used for the formation of policy and plans ( at federal, state, county, municipal and local jurisdictions). It is meant to support long-range planning.

It is information, knowledge or end product that supports an ongoing investigation. You may be developed as a result of an ongoing investigation or enforcement action

this type of intelligence is in an product " about persons and organizations that may have an interest, motive, intention and capability of mounting attacks against public officials and figures"

false

E. none of the above

information

any misunderstanding of the situation that leads an agency to take actions that are inappropriate and counterproductive to its own interests and that of the community or jurisdiction it serves

reliability, accuracy, timeliness and relevancy

• 1. strategic
• 2. tactical
• 3. operational

assessing criminal groups/organizations propensity/potential for violence, economic growth/expansion, recruiting, mobility and corruption

the police executive,  investigative and intelligence targeting, counterintelligence and there many other examples

operational analysis supports major criminal investigations, case preparation and case presentation

the analytical supervisor must understand intelligence analysis ( organization, activity, end product) to be credible and successful.

true

true

• 1. methods of territorial allocation
• 2. financial flows
• 3. allegiances and loyalties within criminal networks

true

true

• 1. collectors predilections
• 2. inefficient utilization of resources
• 3. non-direction

true

it provides them with an overview of  criminal capabilities, trends, and intentions  in order to allow for the formation of organizational policies and plans to combat criminal activity

True

information

false

false

knowledge of the enemy

events,  knowledge communicated by others,  knowledge obtained from another

newspaper companies

Central Intelligence Agency

true

• 1. organization
• 2. information collected
• 3. the fruit of spying (means to an end)
• 4.  the fruit of spying (the end)

true

true

true

true

• 1.  intelligence as activity
• 2. intelligence as an product
• 3.  intelligence is an entity-  a unit - organization

• 1. community
• 2. societal
• 3. physical
• 4. economic
• 5. psychological

corruption, structure, sophistication, multiple enterprises

• 1. selling ideas and concepts
• 2. maintaining intellectual rigor
• 3. developing understanding of  conceptual models

true

these are single clues, or sets of them, that point to a specific event or phenomenon; they contain two values; one which points to past events and another that points to signals or clues to look for, relative to events likely to occur

• 1.  likely changes to policies, strategies, programs and legislation
• 2. threats to public safety and order
• 3. changes in crime environment

false

12 – 18 months

Is a type of inference, a theory or a tentative assumption

is a type of inference, a forecast,  a statement of declaring an event in advance

true

1.  organized criminality (organized crime)

2. CDS (controlled dangerous substances) (1. manufactured, 2. distributional)

3.  gangs ( juvenile, adult, international)

4.  terrorism (foreign, domestic)

5.  corruption ( political, official)

6.  money–laundering

true

• 1.  data is often fragmented
• 2.  data is not readily available
• 3.  data is not stated in exact terms
• 4.  there may be information gaps

false

this type of analysis involves the compilation, review and analysis of activities which occurred around particular events to develop a model of occurrences, to predict the presence of the criminal activity or potential event

true

false

true

true

• 1.(Noun) basis or cause, as for some belief,
• action, fact or event.

• 2.A statement present in justification or
• explanation of a belief or action

3.sound judgment; good sense.

4.Logic. The presence of an argument

• 5.(verb) to form conclusions, judgments, or
• inferences from facts, premises

• taking raw data or information collected and
• placing it into a context that goes beyond the face value of the collected
• information

1.Facts

2.Opinions

3.Arguments

4.Premises

• An inference is a statement or series of statements, paragraphs, that go beyond and the facts, opinions, arguments and premises by
• i.g. data, designed to develop specific and accurate knowledge is concentrating
• on the past, present, future.

1.Hypothesis

2.Conclusion

3.Prediction

4.Estimate

• It is a theory, or tentative assumption. A
• hypothesis has to be tested related to what is being true or false.

• This is the result of two or more facts or
• propositions

• This is a forecast; a statement clearing an
• event in advance.

• This is an appraisal; a tentative judgment or an
• approximate value, worth or significance

Inductively and deductively

• This is taking specific information and making a
• general statement (making a mountain out of a mole hill)

Taking general information and arriving at a specific statement (identify the perpetrator of a crime)

• example: all FDLE officers where 9 mm Sig Sauers
• while on duty. John Smith wears a 9 mm Sig Sauer went on duty

Inductive

• 1.Inferences that go beyond the raw data hence
• there is opportunity for discovery and production.

• 2.Risk: if the data are true, the inference may or
• may not be true.

3.Requires a probability statement.

4.Specific to a general statement.

5.Support criminal intelligence development.

Deductive

• 1.Inference that does not go beyond the raw data
• and cannot arrive at something new

• 2.risk: if the raw data are true, the inference
• must be true.

3.Does not require a probability assessment.

4.General to specific statement.

• 5.Supports criminal investigations (proof beyond a
• reasonable doubt)

1.Use applicable and relevant information.

• 2.Describe, categorize and integrate fragmented
• information.

• 3.Evaluate the information for accuracy and
• timeliness (goes to the issue of relevancy).

4.Developed premises (statements of meaning)

• 5.Formulate (alternative) inference(s) -
• hypothesis, conclusion, production, estimate.

6.Use a probability statement.

• 7.Avoid logical fallacies.  Remember, when analyst is involved in
• practical or strategic intelligence analysis, s/he uses inductive reasoning for
• the most part. On other hand, for operational analysis, the analyst may start
• thinking inductively, but think more deductively as investigation progresses.

Who, what, where, when, why and how

• A probability assessment implies a degree of
• certainty in that an event occurred, is occurring (or that conditions exist), or will occur.  It also implies confidence in the information relative to the hypothesis, conclusion, production or the estimate that is being presented

1.Relative frequency of past events

2.theoretical estimation

3.subjective estimation

• This type of data is represented by team sports win – loss
• records, batting averages, pass completions, surveillance data, toll data, and
• financial data.  For example how many
• times was a “bad actor” observed at specific locations, by date, time of day
• and duration? We are interested in the patterns of behavior. This facilitates
• pattern analysis assists in recognizing trends and is used as a basis in making
• predictions (once is happenstance; twice is coincidence; thrice is the
• beginning of a trend.)

• This is akin to a rolling the dice and hoping
• for a specific outcome; card counting; producing burglaries, robberies and
• rapes for example based upon the potential targets in a given area, employee
• temporal data, joint and conditional probability. This is useful in criminal
• analysis.

• First, important understand, this does not involve patterns,
• event frequency data or mathematical formula. Subjective estimation is based on
• facts, experience and knowledge (expertise, knowing actors, the environment,
• criminal activity and enterprise structure). 
• It boils down to integrating information making a sound, rational,
• mature subject to judgment. Yet, remember you must still think rationally, i.e.
• inductively or deductively. Being able to employ a subjective judgment
• confidently implies that one has acquired a body of knowledge about a subject
• or issue being examined.

• This is all about sticking your reputation;
• sticking your neck out; demonstrating your knowledge about the subject or issue
• being examined. Assigning a probability (assessment) to statement (hypothesis,
• conclusion, prediction, estimate, the informed judgment, the single fact or the
• best guess), what is indicating the level of likelihood that a situation
• exists, with a situation/event occurred/existed, or will occur/exist in the
• future. There is risk involved here.

• 1.0 or 100% - event/situation will occur/does not exist (total certainty) 
• .90 or 90% 
• .80 or 80% 
• .70 or 70% - more likely to occur than not 
• .60 or 60% 
• .50 or 50% -event/situation may/may not occur/exist 
• .40 or 40% 
• .30 or 30% -less likely to occur then occur/exist 
• .20 or 20% 
• .10 or 10% 
• 0.00 or 0% - event/situation will occur/does not exist (total certainty)

Network analysis is a methodology that allows for the development of associations, linkages, organizations and infrastructure.

 It facilitates data description and data integration; it develops visual inferences.

A network is an inter–connected or inter-related chain, group or system.

 Two entities do not constitute a network. It requires three entities minimally.

Planning

researching

collecting

requesting

evaluating

collating

examining

deriving meaning

reporting/briefing

recommending

• 1.Entity
• 2.Relationships
• 3. direction
• 4. strength

relationships are structured behavioral properties of the network based upon psychology, politics, human behavior, communication's and organizational behavior.

direction: root; Winer course on which something moves or received to move, or along which something is pointing or facing; a channel; course of action; trend. One way, mutual or multiple.

strength: a subjective estimate regarding to the quality or state of relationship; is it enduring? Are there witnesses? Stability versus instability. These estimates range from 0 to 100, yet it is categorized as strong, moderate, weak. Strong (80-100), moderate (50-79), weak (0-49)

interstate highway systems, US postal system, telephone systems, Internet, television affiliates,

organizations, e.g.  terrorists, Boy Scouts, AMA, criminals,  

personal/social, e.g.  family ( nuclear and extended), professional, colleagues, friends, criminal.

 Electrical utilities.

1. Manage information

2. develop intelligent information

3. facilitates decision-making

4. development  networks (models)

5. targeting

6. recognizing information gaps

7. facilitate case preparation and presentation

8. post a valuation

1.Strategic: supports policy and planning

2.  tactical: supports responses to immediate objectives, events and circumstances.

Collect data/information

•  building blocks of meaning
•  
•  visual inferences

• 1. hypothesis
• 2. conclusion
• 3.  prediction
• 4. estimate

collect and use only up applicable and relevant information

 described, categorize and integrate fragmented information

•  evaluate information for accuracy and timeliness
•  
• formulate alternative inferences – hypothesis, conclusions, predictions, and estimates

 use a probability assessment (p. %)

Deductive reasoning – from the general to specific

 inductive reasoning – from specific to the general

subjective estimation

 relative frequency

 theoretical estimation

 probability scale

• who?
•  What?
•  When?
•  Why?
•  How?

personal/criminal

organizational

communications

flow (commodities and money)

activity/event (time series)

• 1. Collect and use relevant information from all sources
• 2. manage information – manually or computerize
• 3. develop an association matrix or Association database
• 4. symbology 
• 5. development works as data is collected and evaluated; identify directionality
• 6. record meetings ( hypotheses, and conclusions, predictions, estimates)
• 7. continue to develop notes until finalized
• 8. finalize report/briefing

• 1. date/time data
• 2. event data
• 3. entities
• 4. location data
• 5. directionality

– collect relevant event – related information from all sources in attempt to place into a temporal context at the very least

 – manage information – manually or computerize

- symbiology

- developed time series chart as soon as enough data is collected

 – record inferences ( hypotheses, conclusions, productions, estimates)

 – continue to develop analysis until finalized

 - finalize reporting/briefing

this technique seeks to identify and link entities, establish relationships, and identify communication patterns with pattern deviations. This approach also develops hereto for unknown or suspected networks, may confirm networks and may refute suspected networks.

– Identify the subscriber of the facility or principal operator

 – the subject at issue have access to additional facilities?

 – ascertain work/lifestyle, in the context of 24/7, of all entities

 – does the entity at issue have access to telephone credit cards?

• – Collect all relevant telephone/credit card/cell phone  billing data
•  
• – manage information – manually or computerize

– symbology

– be concerned with the following elements – date of the call, time of the call, the number called, location of the number called, time of call, duration of the call, and it collect or third-party call, number and location the call was made from

 – first review all billing data for collect, third-party and other uncharacteristic calls

 – compare dates and times of calls to subjects workday/ lifestyle

 - identify calls outside normal work hours, lunch, and break times (workday)

–know who has access to faculty(ies) 24/7 ( lifestyle)

 – identify obvious patterns,e.g. number called, time of day, they week, duration of the call.  Are there sequenced calls?

 – using frequency charts, by number called, by day, by time, by duration, by collect and third-party calls

 – identify  primary numbers ( criteria: all collect and third-party calls or primary numbers. Why?)

 – Develop network and/or time series chart(s)  as soon as enough data is collected

 – record meeting(s) ( hypotheses, conclusions, productions, estimates)

 – continue to develop analysis until finalized

 finalized report/briefing