Applying the Intelligence Cycle in our New Days of Rage

Planning and direction

First, identify what your organization needs to protect — people, assets, reputation, and property. A baseline threat assessment is critical because it helps you understand shifts in your organization’s unique threat landscape. Political risks can alter this landscape because of geography or industry. For example, in the context of political violence, organizations with downtown offices might see risks associated with nearby protests or potentially dangerous events. Organizations, executives, and board members involved with controversial public figures or industries could face another set of risks. You have to be specific about how political violence might manifest itself and the risks it poses to your organization. If your executives have inserted themselves into the culture war via social media, you need to identify how this might pose a threat to the executive and the company and develop a way to collect information about these threats.

Collection

Identify the resources at your disposal to monitor for risk. Data and information-gathering processes are crucial. Technology can help security teams sift through large volumes of information from social media. One misstep I see many companies make is that their data collection focuses exclusively on themselves. It is important to identify industry-specific threats. One way to do this is to monitor risks to competitors and whether there is increasing chatter about them online, and whether the industry practices are being cast in a political light. But information gathering isn’t exclusively digital. Does your organization have a way to identify planned demonstrations near your building that may impact travel to and from the office?

Processing and exploitation

We often talk about finding signals in noise, but this stage of the intelligence cycle might best be described as making signals from noise. In other words, raw information must be converted into a digestible, analyzable format. It needs to be aligned with the organization’s priorities. For instance, if your company has ties to controversial political figures or industries, you might gather data to see if there is an increase in negative social media chatter. But rather than turn over raw social media posts, you might document the number of threats or categorize the threats that it can identify as carrying a higher risk than others.

Analysis and production

You’ve monitored social media for potential threats. What’s the trend line? Analysis is the heart of the intelligence cycle. It requires us to examine data for actionable insight. Think of an event from the recent news cycle: the plot by Islamic State – Khorasan (IS-K) to attack a Taylor Swift concert in Vienna. From the singer’s perspective, canceling more than one show in the city was prudent, given the unknowns of the situation. However, that data point may also have been important to other performers. Is there a risk of public attacks on other large events? We don’t really know. It’s hard to understand the impact of one-off events, but it’s the security professional’s job to package intelligence in a way that lets others make decisions.

Dissemination

The final stage of the intelligence cycle is about ensuring that the right people receive the right information at the right time. Effective companies often have cross-functional working groups to handle this process, ensuring that information is not only getting into the right hands but balanced with other concerns. Imagine, for example, that an investigation into threats made on social media aimed at a high-profile CEO turns out to be the work of an employee frustrated with the CEO’s political stances. Investigators may need to get information to human resources, but the legal team, the executive protection team, and the others. The working group should have a plan for who gets informed of what types of threats.