Intelligence Process & Types of Intelligence

[The SC]

• There are six basic intelligence sources, or collection disciplines:
  • Signals Intelligence (SIGINT)
  • Imagery Intelligence (IMINT)
  • Measurement and Signature Intelligence (MASINT)
  • Human-Source Intelligence (HUMINT)
  • Open-Source Intelligence (OSINT)
  • Geospatial Intelligence.
• When information has been reviewed and correlated with information available from other sources, it is called finished intelligence.
  
• Five categories of finished intelligence are available to the consumer.
  • Current intelligence addresses day-to-day events, seeking to apprise consumers of new developments and related background, to assess their significance, to warn of their near-term consequences, and to signal potential dangerous situations in the near future.
  • Estimative intelligence deals with what might be or what might happen. Its main role is to help policymakers navigate the gaps between available facts by suggesting alternative patterns into which those facts might fit and to provide informed assessments of the range and likelihood of possible outcomes.
  • Warning intelligence sounds an alarm or gives notice to policymakers. It includes identifying or forecasting events that could cause the engagement of US military forces, or those that would have a sudden and deleterious effect on US foreign policy concerns. Warning intelligence involves exploring alternative futures and low probability/high impact scenarios.
  • Research intelligence consists of in-depth studies. It underpins both current and estimative intelligence. It includes two subcategories of research. Basic intelligence consists primarily of the structured compilation of geographic, demographic, social, military, and political data on foreign countries. Intelligence for operational support incorporates all types of intelligence production and is tailored, focused, and rapidly produced for planners and operators.
  • Scientific and technical intelligence includes information on technical developments and characteristics, performance, and capabilities of foreign technologies. It covers the entire spectrum of sciences, technologies, weapon systems, and integrated operations.

Intelligence Cycle:
The intelligence cycle is the process of developing unrefined data into polished intelligence for the use of policymakers. The intelligence cycle consists of six steps, described below. The graphic below shows the circular nature of this process, although movement between the steps is fluid. Intelligence uncovered at one step may require going back to an earlier step before moving forward.

• Requirements
  • are identified information needs—what we must know to safeguard the nation. Intelligence requirements are established by the Director of National Intelligence according to guidance received from the president and the national and homeland security advisors. Requirements are developed based on critical information required to protect the United States from national security and criminal threats. The attorney general and the Director of the FBI participate in the formulation of national intelligence requirements.

• Planning and Direction
  • is management of the entire effort, from identifying the need for information to delivering an intelligence product to a consumer. It involves implementation plans to satisfy requirements levied on the FBI, as well as identifying specific collection requirements based on FBI needs. Planning and direction also is responsive to the end of the cycle, because current and finished intelligence, which supports decision-making, generates new requirements. The executive assistant director for the National Security Branch leads intelligence planning and direction for the FBI.

• Collection
  • is the gathering of raw information based on requirements. Activities such as interviews, technical and physical surveillances, human source operation, searches, and liaison relationships result in the collection of intelligence.

• Processing and Exploitation
  • involves converting the vast amount of information collected into a form usable by analysts. This is done through a variety of methods including decryption, language translations, and data reduction. Processing includes the entering of raw data into databases where it can be exploited for use in the analysis process.

• Analysis and Production
  • is the conversion of raw information into intelligence. It includes integrating, evaluating, and analyzing available data, and preparing intelligence products. The information’s reliability, validity, and relevance is evaluated and weighed. The information is logically integrated, put in context, and used to produce intelligence. This includes both "raw" and finished intelligence. Raw intelligence is often referred to as "the dots"—individual pieces of information disseminated individually. Finished intelligence reports "connect the dots" by putting information in context and drawing conclusions about its implications.

• Dissemination
  • —the last step—is the distribution of raw or finished intelligence to the consumers whose needs initiated the intelligence requirements. The FBI disseminates information in three standard formats: Intelligence Information Reports (IIRs), FBI Intelligence Bulletins, and FBI Intelligence Assessments. FBI intelligence products are provided daily to the attorney general, the president, and to customers throughout the FBI and in other agencies. These FBI intelligence customers make decisions—operational, strategic, and policy—based on the information. These decisions may lead to the levying of more requirements, thus continuing the FBI intelligence cycle.

Signals Intelligence (SIGINT)

• Signals intelligence is derived from signal intercepts comprising -- however transmitted -- either individually or in combination:
  • all communications intelligence (COMINT)
  • electronic intelligence (ELINT)
  • foreign instrumentation signals intelligence (FISINT)
• The NSA is responsible for collecting, processing, and reporting SIGINT. The National SIGINT Committee within NSA advises the Director, NSA, and the DCI on SIGINT policy issues and manages the SIGINT requirements system.

Imagery Intelligence (IMINT)

• • Imagery Intelligence includes representations of objects reproduced electronically or by optical means on film, electronic display devices, or other media. Imagery can be derived from visual photography, radar sensors, infrared sensors, lasers, and electro-optics. NGA is the manager for all imagery intelligence activities, both classified and unclassified, within the government, including requirements, collection, processing, exploitation, dissemination, archiving, and retrieval.

Measurement and Signature Intelligence (MASINT)

• • Measurement and Signature Intelligence is technically derived intelligence data other than imagery and SIGINT. The data results in intelligence that locates, identifies, or describes distinctive characteristics of targets. It employs a broad group of disciplines including nuclear, optical, radio frequency, acoustics, seismic, and materials sciences. Examples of this might be the distinctive radar signatures of specific aircraft systems or the chemical composition of air and water samples. The Central MASINT Organization, a component of DIA, is the focus for all national and DoD MASINT matters.
  • Scientific and technical intelligence information obtained by quantitative and qualitative analysis of data (metric, angle, spatial, wavelength, time dependence, modulation, plasma, and hydromagnetic) derived from specific technical sensors for the purpose of identifying any distinctive features associated with the source, emitter, or sender and to facilitate subsequent identification and/or measurement of the same. MASINT includes: Radar Intelligence (RADINT), Acoustic Intelligence (ACOUSTINT), Nuclear Intelligence (NUCINT), Radio Frequency/Electromagnetic Pulse Intelligence (RF/EMPINT), Electro-optical Intelligence (ELECTRO-OPTINT), Laser Intelligence (LASINT), Materials Intelligence, Unintentional Radiation Intelligence (RINT), Chemical and Biological Intelligence (CBINT), Directed Energy Weapons Intelligence (DEWINT), Effluent/Debris Collection, Spectroscopic Intelligence, and Infrared Intelligence (IRINT)

Human-Source Intelligence (HUMINT)

• Human intelligence is derived from human sources. To the public, HUMINT remains synonymous with espionage and clandestine activities, yet, in reality, most HUMINT collection is performed by overt collectors such as diplomats and military attaches. HUMINT is the oldest method for collecting information, and until the technical revolution of the mid to late twentieth century, it was the primary source of intelligence. HUMINT is used mainly by the CIA, the Department of State, the DoD, and the FBI . Collection includes clandestine acquisition of photography, documents, and other material; overt collection by personnel in diplomatic and consular posts; debriefing of foreign nationals and US citizens who travel abroad; and official contacts with foreign governments. The National HUMINT Requirements Tasking Center is responsible for providing guidance for HUMINT activities, which are reflected in the National HUMINT Collection Directive. As part of this national effort, all HUMINT collection within the DoD is managed by the Defense HUMINT Service, under the direction of DIA’s Directorate for Operations.

Open Source Intelligence (OSINT)

• Open Source Works was created in 2007 by the CIA's Director for Intelligence and charged with drawing on language-trained analysts to mine open-source information for new or alternative insights into intelligence issues. Open Source Works products are based only on unclassified information and do not represent the coordinated views of the Central Intelligence Agency. We have organized our information geographically and by sections that reflect research products underway; published products; and our knowledge base. Excluding already published products, the material on this Wiki constitutes unreviewed work in progress and therefore does not represent OSW's final judgment on the substance of any given issue.

• Additionally, the information that supports IO HF analysis can be derived largely from open sources. Open source information exploitation has been identified as severely deficient by various sources, including Commissions on Intelligence Reform, the 2005 Intelligence Reform Act, and the Defense Open Source Council. Development of a repeatable exploitation model in support of IO activities using open source can have immediate and far-reaching positive implications both to IO and other areas of Intelligence Community (IC) interest.

• Not only are open sources at times indistinguishable from secrets, but OSINT often surpasses classified information in value for following and analyzing intelligence issues. By value, I am thinking in terms of speed, quantity, quality, clarity, ease of use, and cost.
• Quantity: There are far more bloggers, journalists, pundits, television reporters, and think-tankers in the world than there are case officers. While two or three of the latter may, with good agents, beat the legions of open reporters by their access to secrets, the odds are good that the composite bits of information assembled from the many can often approach, match, or even surpass the classified reporting of the few.

• And why not tap the brainpower of the blogosphere as well? The intelligence community does a terrible job of looking outside itself for information. From journalists to academics and even educated amateurs - there are thousands of people who would be interested and willing to help. Imagine how much traffic an official CIA Iraq blog would attract. If intelligence organizations built a collaborative environment through blogs, they could quickly identify credible sources, develop a deep backfield of contributing analysts, and engage the world as a whole. How cool would it be to gain "trusted user" status on a CIA blog?

Geospatial Intelligence

• This is the analysis and visual representation of security related activities on the earth. It is produced through an integration of imagery, imagery intelligence, and geospatial information.

Medical Intelligence (MEDINT)

• medical intelligence - (DOD) That category of intelligence resulting from collection, evaluation, analysis, and interpretation of foreign medical, bio-scientific, and environmental information that is of interest to strategic planning and to military medical planning and operations for the conservation of the fighting strength of friendly forces and the formation of assessments of foreign medical capabilities in both military and civilian sectors. Also called MEDINT.
• medical surveillance - (DOD) The ongoing, systematic collection of health data essential to the evaluation, planning, and implementation of public health practice, closely integrated with the timely dissemination of data as required by higher authority. See also surveillance.

Environmental Intelligence

• The environment is an important part of the Intelligence Community agenda. Today I would like to explain what we mean by the term 'environmental intelligence,' why the Intelligence Community is involved in this work, and why our involvement is important for citizens of the United States and the world. I also want to demonstrate that environmental intelligence is not a new or expensive area of endeavor for the Intelligence Community.

Economic & Competitive Intelligence

• Competitive intelligence is not a new concept, it has been used by numerous high-profile
  corporations for decades. In order to survive, excel and outstrip rivals an organization
  must have an intricate knowledge of their own business, the industry and their
  competitors. The growth in awareness of competitive intelligence is evidenced by the
  growing number of publications describing how to establish a competitive intelligence
  department within an organization and how to carry out such a deparment’s functions.
  Competitive intelligence is undertaken in many different forms in both public and private
  organizations. Miller (2000) suggests that government agencies conduct intelligence
  focused more on threats than on opportunities, but in corporations this situation is
  reversed, with emphasis more on opportunities than threats. Shake and Gembicki (1999)
  suggest modern business executives are equipped with tools of combat with well
  appointed fortresses where information warfare in a business context involves achieving
  and maintaining an information advantage over competitors.
• Competitive intelligence is seen as an essential part of the modern organization just as
  Sun-Tsu considered it an essential part of warfare strategy in 400BC. It incorporates both
  intelligence (analyzing gathered data about rivals) and counterintelligence (protecting
  ones own information sources). Intelligence is not confined to the military domain, and
  Kanaher (1996) suggests it is imperative to corporate organizations due to the rapid pace
  of business, information overload, increased global competition from new competitors,
  more aggressive competition, rapid technological change and forceful global changes in
  international trade agreements. The race to survive in a cut-throat global marketplace is
  on. Jones recommends every morning you ask ‘what can I do to beat Company Z today’
  as neither your competition nor technology will wait for you (Jones et al., 2002).
  Competitive intelligence is as important as a good marketing department and has
  emerged as a ‘must-have tactical tool’ in the corporate world (Thomas, 1998).
  The heightened awareness of competitive intelligence has been spirited by increased
  global competitiveness characterized by increased industry consolidation and
  fragmentation (Fleisher & Blenkhorn, 2001). The Internet provides both the data and
  tools for competitive intelligence, offering a wealth of information and search bots for
  those wishing to gather information about corporations and individuals.
  Although competitive intelligence is not a recent phenomenon in the business community
  and awareness of the benefits of competitive intelligence to organisations is evident, the
  tertiary education industry has been chided for lack of response to this need. Fleisher and
  Blenkhorn (2001) state that competitive intelligence is rarely included in MBA programs,
  and Shaker and Gembicki (1999) believe competitive intelligence is an essential
  ingredient to effective management and state a manager’s knowledge is derived from
  both formal and information education. They go on to suggest that the IT culture at large
  and education programs, at the Masters level in particular, neglect the area of competitive intelligence.

Law Enforcement Intelligence

• The information sharing resource for the justice and public safety communities
• Its purpose "is to gather, record, and exchange confidential information not available through regular police channels, concerning organized crime and terrorism"

Social Intelligence, or Cultural Intelligence

• As had been the case for 200 years, today's Marines may be called upon to fight in any corner of the globe. In many of these conflicts, particularly those classified as "small wars," the key factor in determining who wins and who loses will often be knowledge of the local culture. Culture is far more than language, folklore, food, or art. It is the lens through which people see, and make sense of, their world. Culture determines what is admired and what is despised, what makes life worth living, and what things are worth dying for. This is particularly true in times of great stress, to include natural disasters and war.
• One of the more important techniques for preparing Marines to deal with a particular culture is the cultural intelligence seminar. This is an exercise that allows persons with first hand, detailed knowledge of a particular culture to make that knowledge available to Marines.
• The U.S. intelligence community is without peer in providing high-quality, detailed technical intelligence. Due to the intelligence community’s efforts, the USG has a thorough understanding of its adversaries’ activities. What we propose is to develop a means by which that same intelligence community can use cultural factors to answer the question “Why?”

• Earley and Ang define cultural intelligence as “a person’s capability to adapt to new cultural contexts” (59). Their key objective is to address the problem of why people fail to adjust to and understand new cultures. Behavioral, cognitive, and motivational aspects are central to their cultural intelligence framework. By integrating multi-disciplinary perspectives, research data, and practical applications, the authors add significantly to organizational behavior literature.
• Intelligence Community course developers, in particular, will benefit from Earley and Ang’s ideas to improve seminars and training sessions that involve examining cross-cultural factors in national security missions. Training programs and publications must be constantly updated and revised to reflect changing socio-cultural, political, and economic landscapes. Programs that are ineffective in addressing cultural adaptation can be costly to organizations.
• The process aspects of cultural intelligence involve analysis at three levels of increasing specificity. The top-down analytical approach begins with the universal level, which refers to people’s innate knowledge (86). Below that, the culture level draws on specific aspects of culture to mediate between the universal level and the final level, the setting level. The setting level requires knowledge that allows one to respond to specific context, people, and event timing.

• If the current modus operandi of insurgents in Iraq is an indicator of the total disregard that future adversaries will have toward global societal norms, the joint force will, in many respects, be operating with one hand tied behind its back. The U.S. military can ill afford to have the other hand bound through the development of comprehensive campaign plans not grounded in solid cultural understanding of countries and regions within which it will likely operate. To do so risks adding yet another footnote to history highlighting an intelligence gap between combat and stability and support operations.

• The United States has experienced a significant amount of difficulty of late with two factors: a) how to fight against a networked enemy, and b) the need for more cultural intelligence. This thesis will describe a structure to assist with both those needs. The premise is that an expanded and improved network of US Military Groups is the weapon of choice for the war on terror, and beyond.

• This kind of intel is key to sorting out friend from foe on a battlefield without lines or uniforms. Combat troops are becoming intelligence operatives to support stabilization and counterinsurgency operations in Iraq, and the phenomenon will become more common as the U.S. military adapts its forces to fight terrorist organizations and other nonstate actors.

• While overwhelming military power will remain the pillar of national defense, officials are reaching the conclusion that the United States needs to place significantly more emphasis on ways to consolidate its victories, which now seem almost assured given the unmatched superiority of American land, air, and sea forces.
• The Pentagon report says a major element of success is the mastery of "social intelligence" by soldiers, diplomats, and aid workers schooled in the process of stabilizing chaotic societies, and possessing a working knowledge of local culture and customs.
• "We must be able to look and operate deeply within societies," the paper says. Also described as critical are close relationships between the United States and international civilian and military authorities who will ultimately be responsible for securing the peace.

• "Understanding culture may help to answer important military and civil questions such as the will of the enemy to fight, the determination of resistance groups to persevere, or the willingness of the populace to support insurgents or warlords. Culture, comprised of all that is vague and intangible, is not generally integrated into strategic planning except at the most superficial level. It appears increasingly in scholarly work, however, on problems associated with emerging nations."

Strategic Intelligence

• Provides strategic intelligence on global business, economic, security and geopolitical affairs

Steganography - hiding in plain sight


Modern steganography entered the world in 1985 with the advent of personal computers being applied to classical steganography problems. Development following that was very slow, but has since taken off, going by the large number of steganography software available:

• Concealing messages within the lowest bits of noisy images or sound files.
• Concealing data within encrypted data or within random data. The message to conceal is encrypted, then used to overwrite part of a much larger block of encrypted data or a block of random data (an unbreakable cipher like the one-time pad generates ciphertexts that look perfectly random without the private key).
• Chaffing and winnowing.
• Mimic functions convert one file to have the statistical profile of another. This can thwart statistical methods that help brute-force attacks identify the right solution in a ciphertext-only attack.
• Concealed messages in tampered executable files, exploiting redundancy in the targeted instruction set.
• Pictures embedded in video material (optionally played at slower or faster speed).
• Injecting imperceptible delays to packets sent over the network from the keyboard. Delays in keypresses in some applications (telnet or remote desktop software) can mean a delay in packets, and the delays in the packets can be used to encode data.
• Changing the order of elements in a set.
• Content-Aware Steganography hides information in the semantics a human user assigns to a datagram. These systems offer security against a nonhuman adversary/warden.
• Blog-Steganography. Messages are fractionalized and the (encrypted) pieces are added as comments of orphaned web-logs (or pin boards on social network platforms). In this case the selection of blogs is the symmetric key that sender and recipient are using; the carrier of the hidden message is the whole blogosphere.
• Modifying the echo of a sound file (Echo Steganography).
• Steganography for audio signals.
• Image bit-plane complexity segmentation steganography
• Including data in ignored sections of a file, such as after the logical end of the carrier file.

Digital text

• • Making text the same color as the background in word processor documents, e-mails, and forum posts.
  • Using Unicode characters that look like the standard ASCII character set. On most systems, there is no visual difference from ordinary text. Some systems may display the fonts differently, and the extra information would then be easily spotted, of course.
  • Using hidden (control) characters, and redundant use of markup (e.g., empty bold, underline or italics) to embed information within HTML, which is visible by examining the document source. HTML pages can contain code for extra blank spaces and tabs at the end of lines, and colours, fonts and sizes, which are not visible when displayed.
  • Using non-printing Unicode characters Zero-Width Joiner (ZWJ) and Zero-Width Non-Joiner (ZWNJ). These characters are used for joining and disjoining letters in Arabic and Persian, but can be used in Roman alphabets for hiding information because they have no meaning in Roman alphabets: because they are "zero-width" they are not displayed. ZWJ and ZWNJ can represent "1" and "0".

https://en.wikipedia.org/wiki/Steganography


Sources from:
http://www.au.af.mil/au/awc/awcgate/awc-ntel.htm#types

 

[The SC]

cyber intelligence

There is a general lack of information on what cyber intelligence is and how to appropriately use it. There are a few resources out there but cyber intelligence is more often thrown around as a buzz word for company statements and contracts than it is actually defined and used.

The first step to understanding cyber intelligence is to realize that intelligence tactics, techniques, and procedures (TTPs) as well as various types of operations existed long before cyberspace was conceived. Intelligence is most often seen as offensive in nature when viewed from the lens of spying and collection operations but its ultimate purpose is also equally rooted in defense.

In a military context commanders want to know the intent of the adversary to either make better strategic choices on the battlefield (offense) or to more aptly prepare for an attack (defense). The definitions and tradecraft used by various government and military organizations serve as the best foundation for understanding cyber intelligence.

The first is the definition of intelligence:

1. The product resulting from the collection, processing, integration, evaluation, analysis, and interpretation of available information concerning foreign nations, hostile or potentially hostile forces or elements, or areas of actual or potential operations.
2. The activities that result in the product.
3. The organizations engaged in such activities.
   
   The key here is making sure the data meets some goal or purpose and is not just “intelligence for intelligence’s sake” (dragnet type intelligence operations actually hinder analysts and negatively impacts security
   
   This definition is applicable to cyber intelligence and we can simply apply the sources and efforts of the collection, processing, analyzing, and using of the intelligence to cyberspace related topics.
   
   

From the above we gather a great start into understanding cyber intelligence and moving to a point where we can use it appropriately. We also see the theme that intelligence is highly dependent on analysts and their interpretation of data.

In this way, a great analyst can use a small data set and get more out of it than an untrained analyst could from “big data” sets.


For example, a cyber intelligence analyst who does not understand routing protocols and infrastructure cannot give proper analysis on what it means when an adversary communicates with their servers by sending malformed and manipulated TCP packets.

Likewise, if the cyber intelligence analyst does not have enough understanding of exploits to identify the difference between a 0day that is ineffective and a 0day that can severely hamper core operations then their analysis will be of little use for actionable recommendations to defense.

In this way, good cyber intelligence analysts are those who have a strong understanding of their organization, know the intelligence needs, and are technical experts. These skills are developed with time, but can be quickly sharpened through practice and reading the security books, blogs, and threat feeds of others in the field. There is no substitution for hard work in this field but the wheel does not have to be reinvented each time.

Additionally, a good cyber intelligence analyst should be able to identify and call out “experts” giving bad analysis. It is sometimes even more important to be able to identify bad intelligence than it is to generate good intelligence products.

The second way to really sharpen analysis skills is to practice thinking critically. Instead of just thinking about what the answer is, or what answer another analyst arrived at, a good cyber intelligence analyst will think about what processes and questions they should ask themselves to arrive to the answer.


If an adversary is extracting documents off of your network. it’s important to think like the attacker and ask questions such as. “what would my next move be if I were the attacker.” or piece together the pieces of information to view the bigger picture. Maybe the attacker is going after a specific type of document. and you can determine where they might strike next.

The answer isn’t that they are going after a certain document but maybe how they are doing so, why, what they want to obtain, how the intrusion was discovered, how the next one can be discovered even when change is introduced, etc.

Truly, there is no single source of great information but instead an analyst needs to be able to combine multiple data sources seamlessly. Cyber intelligence fits into many fields and can aid every good analyst.


Some of the more prevalent sub-disciplines of cyber intelligence are:

• Intelligence Collection Operations
• Cyber Counterintelligence
• Threat Intelligence

https://www.tripwire.com/state-of-s...developing-cyber-intelligence-analyst-skills/
https://www.tripwire.com/state-of-s...developing-cyber-intelligence-analyst-skills/

 

[Asoka]

i got a hunch that Pakistan Defense Forum (PDF) and Sinodefence Forum and many others are run by CIA's Open Source Intelligence Group. I have never seen those forum solicit donations from members or run ads. I am very curious as where the money came from, and who actually created them and runs. Can anyone comment on this?