HLS476:

Lesson 1: Course Introduction and the Intelligence Cycle

Lesson Overview (1 of 4)
Lesson Overview

Lesson Overview

This lesson will introduce/review the structure of the Department of Homeland Security, the intelligence function within homeland security, and the intelligence cycle. Current intelligence requirements will also be discussed.
 

Lesson Objectives:

At the conclusion of this lesson, you will be able to:

The post 9/11 shift in US intelligence was nothing less than monumental. It was a shift in organization, focus, processes, and culture. The latter is still an ongoing battle. The cultural behavior and practices slowly evolve as each new generation of intelligence professionals enters the workforce.  As the older generation exits the workforce, along with it goes decades of experience and firmly entrenched biases as to how the craft of intelligence should be conducted.

It is said that intelligence organizations shape themselves in the image of their enemy. Through the decades of the Cold War US Intelligence evolved as secretive, with hierarchical control and stove-piped communications.  This was, in fact, the image of the former Soviet Union. The problem facing the Intelligence Community was that this self-imposed prophecy proved ineffective in protecting the American people as the world began to change.

The DHS Intelligence Enterprise (DHS IE) is a part of the US Intelligence Community.  But there is some level of confusion of exactly which DHS elements are considered part of the IE. DHS intelligence activities are conducted by components including a minimum mix of Intelligence Officers (GS-0132 series), Criminal Investigators (GS-1811 series) and Air/Marine Interdiction (GS-1881 series).   The Congressional House Homeland Security Committee Majority Staff Report noted that many elements of DHS maintained different standards for categorizing personnel involved with intelligence activities leading to wide discrepancies in numbers of personnel and budgets between CBP, USCIS, TSA, ICE, etc.  The Congress recommended DHS Secretary define common standards for identifying intelligence personnel and activities.  

The DHS defines its IE elements as consisting of the Office of Intelligence and Analysis, the Homeland Infrastructure Threat and Risk Analysis Center, and the Intelligence Division of the Office of Operations Coordination and Planning (all located at the DHS headquarters), and the intelligence elements of six DHS operational components:

The DHS IE supports two departments within DHS as well as state, local, tribal and territorial  governments, and the private sector.  This is no minor feat encompassing tens of thousands of intelligence consumers and producers. This newly emerging intelligence enterprise dramatically altars the concept of intelligence collection and production as practiced by the US since the National Security Act of 1947.  

Intelligence activities within DHS are guided by a Homeland Security Intelligence Council. The Council is an advisory body that meets approximately once every two weeks. Its Chair is the The DHS Chief Intelligence Officer chairs the Council which also includes senior department officials.  Ideally, the HSIC provides guidance on “processes, standards, guidelines, procedures, strategies, budget guidance, and other implementing policy guidance.”

Objectives

At the conclusion of this lesson, you will be able to:


Please complete readings and assignments as listed on the course schedule.

 

Homeland Security Intelligence is not just an Enterprise - it's a Community (2 of 4)
Homeland Security Intelligence is not just an Enterprise - it's a Community

Homeland Security Intelligence is not just an Enterprise; it’s a Community

The HSIE is a subset of the National Intelligence Program (NIP),  HSIE supports customers within DHS, state and local law enforcement, and the President. The entire US Intelligence Community: 16 organizations (17 including the Office of the Director of National Intelligence), all play a critical role in ensuring the security of the United States and it citizens. These activities are categorized as follows:

Policy: The US Intelligence Community has a long history in supporting policymakers to include the President, the National Security Council, and the Congress. In this regard homeland security policy is no different. A multitude of agencies in the IC provide finished intelligence products to senior policymakers at all classifications to create the nation's homeland security policy. Support tailored to this level of decision making can be thought of as Strategic Intelligence.

Prevent: the idea of prevent functions is not to let terrorism or international criminal organizations conduct activities in the United States but to stop them as far away from the Nation as possible. Some operational missions of the US DoD, CIA, and Department of State support homeland security by dismantling and disrupting terrorist networks (and other threats) overseas.  These missions can include diverse activities ranging from military direct actions to securing international agreements for terrorist prosecution. Intelligence at these “operational levels” is more detailed than Strategic Intelligence and tailored to support these missions. Operational Intelligence is often produced by the same agencies executing the missions.

The FBI also has a significant role in Prevent functions executed through its Legal Attaches based in 60 (or so) US Embassies.  DEA, DHS, and the Department of Treasury have more modest capabilities. These roles include passing of intelligence and coordinating criminal investigations with foreign law enforcement agencies, and identifying and seizing terrorist finances abroad. They all fit into the the ‘prevent category’ but they are minor compared in size, budget, and impact to those of the big three: Defense, State, and CIA.

Protect: The FBI and National Counterterrorism Center (NCTC) are lead organizations for the domestic investigation and prosecution of terrorist activities.

However, homeland security intelligence goes far beyond just the issue of terrorism. Homeland security intelligence activities also are used to support the prosecution of international criminal organizations, cybercrime, and to support support cyber security. In an objective world, these activities should probably even be considered a greater threat to the United States than terrorism.

Response and Recovery:  Homeland security intelligence is aggressively used to support first responders to an incident and in the immediate aftermath. There is very little intelligence used in the recovery phase of homeland security operations.  However homeland security intelligence is provided by federal agencies and local law enforcement, through state fusion centers during incidents such as the Boston Marathon bombing or June 2016 Orlando  nightclub shooting.

 

The Intelligence Cycle (3 of 4)
The Intelligence Cycle

The Intelligence Cycle

The United States Intelligence Community has a process for supporting its consumers. That process is called the Intelligence Cycle. Law enforcement intelligence has a similar intelligence cycle with the notable difference of a final step called evaluation. While cycle is prevented presented here, it is done so with a cautionary note. The Intelligence Cycle is a Concept of Operation. The processes for planning collecting, analysis and dissemination of intelligence do not function in practice as neatly as they are presented in this text. More often the process is subverted by organizational processes in the real world reality of collecting and processing information.

1. PLANNING AND DIRECTION

This portion of the cycle includes a process known as collection management.  In the IC, Collection Managers are specially trained to know the capabilities and tasking processes for all collection disciplines.  Collection managers work with analysts to develop Collection Plans. These plans establish collection priorities, identify information gaps, and task (ask, not task) specific collectors to fill those gaps. 

It is here in the Planning and Direction phase that the complexities and disconnects within the Intelligence Community begin to surface.  For example, FBI analysts may need information on organized crime elements in the Middle East.  They can ask the CIA to collect that information, but they cannot task them to do so. It will only be done if the CIA already has access to the information or can quickly do so.  Organized crime might be a high priority for the FBI but not for the CIA. More often, the CIA will want to focus on its own priorities in supporting the policy apparatus.  Generally, in such cases, the consumer has a requirement for a specific product.

The National HUMINT Requirements Tasking Center (NHRTC) is congressionally mandated to integrate all HUMINT collection and reporting capabilities within the U.S. Government. The NHRTC is staffed by senior officers from the Department of State, Defense Intelligence Agency, FBI, DHS, and CIA. The NRTC produces National HUMINT Collection Directives and Collection Support Briefs.  Despite being congressionally mandated, the NHRTC has little if any authority to direct collection managers or field collectors.  Almost always, HUMINT collectors for agencies and departments will chose to support the interests of their level parent organizations first.

2. COLLECTION

Collectors secure raw data required to produce the finished product. Data collection is performed through five basic intelligence sources:  Geospatial Intelligence (GEOINT),  Human Intelligence (HUMINT),  Measurement and Signature Intelligence (MASINT),  Open-Source Intelligence (OSINT), and Signals Intelligence (SIGINT).  It should be noted that in recent years biometrics and forensics have been critical collection capabilities in the fight against global terrorism.  These disciplines are technically MASINT, and often collected through HUMINT, but in any case, defy IC categorization in either discipline. 

Raw data in collection routinely includes, HUMINT reports, news articles, airborne and satellite imagery, communications and electronic emanations. In law enforcement operations, more collection emphasis is placed on government and public documents. Once again in the collection phase reality differs from that which is displayed on the graphic. In truth most federal law enforcement and almost all state and local law enforcement know little if anything about IC technical collection capabilities. This lack of knowledge makes it extraordinary difficult to request collection.  In addition, with little physical presence at the national level state and local law enforcement are poorly positioned the advocate for their intelligence requirements.

3. PROCESSING AND EXPLOITATION

Once raw data is collected, much of it must go through additional steps of exploitation and processing to turn the raw data into understandable information.   The processing and exploitation step can be difficult and expensive. It typically involves technically trained personnel, and specialized software, and equipment. There are additional complications for the law enforcement community which carry the additional burden of evidentiary and in particular disclosure rules.  For example, the law enforcement and intelligence communities may be able to defeat  Iphone encryption but not willing to release that fact in evidentiary rules.  Voice translations, data decryption, signal and materiel identification, and imagery processing and interpretation are just a few ways raw data is processed into useable information for analysts.

4. ANALYSIS AND PRODUCTION

Intelligence community it's actually quite well organized for its role in analysis and production.  This phase turns “raw information” into “finished intelligence products”. The products are tailored in content and format for policymakers , government operations, and even tactical environments.

Typically, plans for analytical production or laid out months or even years in advance with all the elements having standard production responsibilities just support their parent organizations.  These plans are integrated between national level agencies to reduce redundancy, ensure integration and coordination, and increase the level of quality in production. Of course mid and long-term production plans are generally subject to the stresses of near-term events.  In the homeland security community this process should ideally result in national policy formulation,   preventing and protecting against terrorist attacks, or defeating criminal activities. 

5. DISSEMINATION

Dissemination is the process by which finished intelligence products are delivered to consumers.  It is almost impossible to identify all the different types of analytical products created by the intelligence and law-enforcement communities. Products, their delivery schedules, and their content are specifically tailored towards the consumer’s needs. Senior policy officials most often receive briefings and hard copy reports.  State and local consumers usually receive electronic reports. After the finished intelligence product is disseminated, consumers may have questions

6. EVALUATION

Evaluations and feedback are used to refine each individual step in the Intelligence Cycle.  However, evaluation is most often seen as a distinct separate process in the military services and in some of  the law enforcement intelligence community.  In recent years some Office of the Director of National Intelligence documents have also included the evaluation component of the Intelligence Cycle.  The evaluation process is used to assess intelligence reporting and analytical products and ideally influence the Intelligence Cycle. In practice, there are many problems with this construct.

Human and technical intelligence collectors request feedback from analysts on virtually every raw intelligence report.  Evaluation rates are generally less than 50%.  This evaluation system presents a human induced problem, as collectors tend to be more responsive to analysts providing evaluations regardless of the priority of the intelligence requirement.  It is therefore, quite common for intelligence collectors (particularly HUMINT) to put far more effort into satisfying intelligence requirements that may only be of interest to a single analyst or small group of analysts simply because those analysts are providing high evaluation grades.  In reality, these intelligence reports may only address niche issues and may have little bearing on national and homeland security.  The HUMINT collection apparatus also has a longstanding practice of making their raw Intelligence Information Reports (IIRs) available directly to the policy community.  This practice is done to quantify success in raw intelligence production. It does, however, completely violate the standing Intelligence Cycle.  

A similar problem exists in the tasking and evaluation of signals intelligence (SIGINT). For example, analysts at the CIA may have a desperate need for communications intercepts from some small and obscure area of the world.  Estimates suggest that near 90 percent of NSA's massive daily intake ends up “on the cutting room floor,” the organization lacking the resources or the need to translate it.  NSA may very well have the raw data and the capability to translate it.  But the CIA analysts would be competing with a thousand other ‘top priorities” to have their information collected, processed, and translated.  More often than not, NSA would ask for money for additional translators. There are just so many tier One Intelligence Requirements other priorities are often not satisfied.  

All source analysts (CIA and DIA) also face a problem in evaluating intelligence products but this happens most often only at the policy level.  The analytical products can be accepted or resisted depending on the receptiveness of the decision makers. The IC complains policy makers are altering their facts for political purposes. In response, policy makers claim IC assessments are often not correct and are so usually negative that nothing could get done if they took the IC at face value. 

Ironically, the result of this very human process is to circumvent the NHRTC and the Intelligence Cycle.

 

 

Summary (4 of 4)
Summary

Summary

This lesson introduced the structure of the Department of Homeland Security intelligence, the intelligence function within homeland security, and the intelligence cycle.

The post 9/11 shift in US intelligence was nothing less than monumental. It was a shift in organization, focus, processes, and culture.

The DHS Intelligence Enterprise (DHS IE) is a part of the US Intelligence Community.  The DHS IE consists of Office of Intelligence and Analysis, the Homeland Infrastructure Threat and Risk Analysis Center, and the Intelligence Division of the Office of Operations Coordination and Planning, and the intelligence elements of six DHS operational components:  The DHS IE supports two departments within DHS as well as state, local, tribal and territorial  governments, and the private sector.  This new intelligence enterprise construct dramatically altars the concept of intelligence collection and production as practiced by the US since the National Security Act of 1947.  

Intelligence activities within DHS are guided by a Homeland Security Intelligence Council. The HSIC provides guidance on “processes, standards, guidelines, procedures, strategies, budget guidance, and other implementing policy guidance.”

The HSIE is a subset of the National Intelligence Program. HSIE supports customers in DHS, state and local law enforcement, and the President. The entire US Intelligence Community: 16 organizations (17 including the Office of the Director of National Intelligence).  All play a critical role in ensuring the security of the homeland by providing intelligence to support all-of-government prevent, protect, prevent, policy, and response efforts

The United States Intelligence Community has a process for supporting its consumers. That process is called the Intelligence Cycle. It is a Concept of Operation. The processes for planning collecting, analysis, and dissemination of intelligence do not function in practice as neatly as they are presented in the lesson. More often the process is subverted by organizational processes in the actual reality of collecting and processing information.

 


Top of page