top of page

Intel 101: In depth, Intelligence

Updated: Apr 30, 2022

To have usable intel we need; to know what intel actually is, how to conduct “intelligence” as a process and produce useful intel products.

Welcome to Intel 101, the first official part of my Intel series. I’m Intel Andy and if you haven’t read Intel 100, I recommend you read that first before you come here. Forewarning, this article will be heavier than the last in content and complexity. I may use some words interchangeably or refer to you as an analyst. Know that this is applicable/useful to anyone who has a hand in developing plans or decision making for a mission or operation.


For a moment, I’m going to move away from the situation outlined in Intel 100 and instead look at intelligence holistically. I’m going to expand upon the definition of what intelligence is and give you the book definition to help you understand its scope.


1. The product resulting from the collection, processing, integration, evaluation, analysis, and interpretation of available information concerning foreign nations, hostile or potentially hostile forces or elements, or areas of actual or potential operations.

2. The activities that result in (intel) product(s).

3. The organizations engaged in (intel) activities.

To add to this definition, intelligence is knowledge of the unobserved truth. It is unobserved in the respect that it is not directly sensed, otherwise it would be information. It must be created and is a conclusion from inferences. It is based on indirect information such as effects, impacts, and calculations; incorporating relevant factors and variables established through scientific observation. The synthesis of all these types of information help the analyst arrive at conclusions about the past, present, and future.

These conclusions are intelligence.

Intelligence can be derived from a variety of sources, to quickly go over them here are the commonly recognized disciplines of intelligence:

Counterintelligence; preventing or disrupting other entities from gaining information or intelligence from/on friendlies; to include use of “baited intelligence”, “anti-intelligence”, counter surveillance equipment/techniques, vetting personnel, vetting useful “outsiders”, and/or false intel. Also used as force protection.

Geospatial intelligence; locations, maps, and any images from above (satellite, drone or airplane).

Human intelligence; extracting information from people. Whether through normal conversation with locals about the current rumors/ongoings, or interrogation of captured individuals.

Measurement and signature intelligence; anything that measures a unit of measurement or is a sensor that provides useful intelligence. (Barometer, seismograph, yard stick, IR sensor, etc.)

Open-source intelligence; any information you can find that is publicly available through open platforms. (Social media, a library, the news, online information index or wiki, etc.)

Signals intelligence; any collection/interception of data or signals from the electro-magnetic frequency (EMF) spectrum. (i.e. Radios.)

Technical intelligence; anything outside the scope of the others but usually refers to equipment metrics and/or specifications.

Along with some lesser known but relevant secondary disciplines:

Biometrics-enabled intelligence; any data that can identify a person’s identity. (Iris, fingerprints, body markings, height/weight, hair color, etc.)

Cyber-enabled intelligence; similar to signals but you are doing it over the internet. (i.e. Hacking)

Document and media exploitation; taking any form of media and exploiting it for intel. (i.e. Analyzing a video to find the location of where it took place.)

Forensics-enabled intelligence; anything that is left at a “site” which can be used to identify useful information. (i.e. Shell casings left at a building being used to identify what caliber and/or weapon was used to assault an objective.)

Intel Life Cycle

The intel life cycle provides the basis for common intelligence terminology and procedures. It consists of six interrelated categories of intelligence operations characterized by broad activities conducted for the purpose of providing leaders with relevant and timely intelligence.

The six categories of intelligence operations are:

Planning and direction; a need for intelligence production is identified. It is either to help support decisions associated with planning, confirm or deny an intelligence expectation, or provide some type of threat warning; this includes the generation of intelligence requirements (IRs).

Collection; data is derived from all possible sources. There are two types of data that are collected during this phase: information and intelligence information. Information and data are synonymous. Information is transferable bits of awareness derived from the sensing of a thing, activity, or abstraction. The quality of the information can vary based on closeness to the subject of focus. Information can help determine the existence of a thing. Information is collected. Sensors and senses are the collectors of information. The other type of data is intelligence information. It is intelligence that has been created by another person; you treat it in the same manner as you would information. Intelligence information is acquired.

Processing and exploitation; the use of tools and methods to process and exploit the information. This includes testing the quality of the information and ensuring that irrelevant data is identified and appropriate measures are taken to exclude it. Conversely, this will be used to determine that information is relevant and usable. Processing collected information converts it into something usable for the type of intelligence product it is. During exploitation, an analyst will use available information and tools/methods to derive value from collected information. A simple example would be to look at overhead imagery of helicopter pad and use a measurement tool to determine the length and width. Different analyst disciplines use different tools such as specific computer programs, manual techniques, processes, and other means of calculations.

Analysis and production; where information is further analyzed, synthesized, and intelligence is produced. A simple example would be if you take attack details and convert them to color-coded dots which you place on a map in order to look for patterns based on the geospatial relationship. Another example would be to place the same events on a timeline to determine Modus Operandi for a specific organization. From the synthesis of information, factors, and relevant variables; conclusions can be made. These conclusions are intelligence, and when they are made into a palatable form it is called an intelligence product.

Dissemination and integration; intelligence product(s) are given to the consumer. The product must be given to the consumer in time for the appropriate plans to be made. It must be usable to be considered an intelligence product. To put it another way, if it is not utilized, it has not fulfilled its purpose. Products must be designed in a way that is easily understood by the consumer.

Evaluation and feedback; helps the analyst understand the consumer and what works for their perspective. Internal notes should be kept on consumer feedback for further evaluation on capabilities of analysts and systems.

Defining Analysis and Synthesis

Simply put, analysis is the breaking down of a subject into simple components. When we analyze a subject we identify what it is by what it is made of. We also look at the purpose of each component.

For instance, if we analyze a pencil; we look at what it is made of: a lead core, a wood casing, a rubber eraser, an aluminum eraser connector, and paint (black and yellow). This helps us

understand the subject of focus. We also try to understand the relationship and purpose of each component. The wood casing protects the lead, the aluminum connector protects and connects the eraser to the wood casing. The paint provides a finish that prevents the wood from disintegrating in a user’s hands.

The purpose of the analysis is to understand the pencil better. The analysis we have done is only one level deep. We can go a second level deeper by analyzing the chemicals in the paint. Now that we understand the pencil, we can understand what it is capable of when we synthesize it with contextual information. Specifically, how it can be handled and the pressures it can endure in the real world.

Complex analysis is when the key components are on multiple separate levels. An example would be if we are analyzing an insurgent cell; we would look at:

• Number of members (level 1)

• Member biographies (level 2)

• Roles in the cell (level 1)

• Individual member equipment (level 2)

• The effectiveness of the equipment (level 3)

The key to understanding which level the component belongs to is based on the relationship with the subject of focus. In this case the subject of focus is the insurgent cell as an entity. Synthesis is the combining of components together. The synthesis of information or components are the seeds of predictive intelligence. When you combine information together, they can have an effect on each other.

For example, if an insurgent group acquires night vision optics, it could lead to an increase in effective complex ambushes on friendly patrols in the evening. An analyst can then determine the likelihood of the prediction based on further reporting or calculating the equipment capabilities in the reality of future situations.

With analysis we are disintegrating components. In other words, we break down a subject of focus into components. With synthesis we are integrating components together. In other words, we add together subjects and components to create a new understanding.

Investigation vs. Prediction

The words investigation and prediction are easily defined. For the purpose of our situation, we are going to further define them in a way that serves our needs. These two words will be used by us to characterize the nature of our actions while creating intelligence and collecting information.

Investigation is when you analyze entities, places, or events that are already in existence; or have existed. Typically, this means we are trying to build a complete understanding of all the components that make up entities, places, or events. The goal is to develop an understanding of all the information about the subject/situation. The purpose is to understand what took place, or is taking place. Sometimes information is missing, but we can produce intelligence that fills the gaps if we can prove it to be accurate. This often means connecting information together, much like a jigsaw puzzle, to get a complete picture. Sometimes pieces are missing, but we can make solid assumptions of what is missing based on the surroundings (context).

Predictions typically detail a future which hasn’t happened yet. This is why forward looking intelligence is called predictive intelligence. It requires a good understanding of the subject, context and factors. Synthesis plays a huge role in sparking the creativity required for prediction. Calculations and critical analysis of the prediction will increase its accuracy during creation. Both investigations and predictions are necessary in the job of intelligence analysis. Although every discipline has the ability to conduct investigations and predictions, all-source analysts must be the masters of them both. Analysts will sit at the final hub to evaluate the strength of accuracy.

Intelligence Design

Intelligence Design allows analysts to create intelligence and analyze it by evaluating the components; it is the analysis of the components of intelligence.

Intelligence can be about entities, places, or events. Intelligence can be analyzed by its components. Components can be information, intelligence information, and variables. We have already identified intelligence, information, and intelligence information.

We need to understand the term variable.

A variable is a placeholder for a type of information. In mathematics, a variable is a quantity which during a calculation is assumed to vary or be capable of varying in value. Although it can vary, it usually identifies a type of data. We can use variables for assumptions. In other words, if we expect a type of data to be included in the components we can use a variable representative in its place. Variables can also become the focus or information collections. This is the purpose of a variable.

An easy way to understand the concept is to treat intelligence as an equation, for example:

Intelligence = component + component * factor + variable + component

The intelligence when analyzed is made of components that are values we have information for and variables; it is also affected by factors. Everything to the right of the = is what the intelligence is derived from, except it is broken down to components (a.k.a. analyzed).

By understanding this concept, we can:

• Synthesize components of any future expected situations.

• Be critical of the components.

• Design new intelligence products by the information we choose to synthesize.

• You can compare it to “models” of similar subjects (i.e. historical ambush data, previous planning meetings, etc.)

Keep in mind a comparison helps create assumptions (variables); which are necessary sometimes.

This concept also applies to Intelligence Preparation of the Battlefield (IPB) from Intel 100. If you recall the steps taken to conduct IPB, here is an equation example:

Enemy Course of Actions (Step 4) = Area of Operations (Step 1) + Area of Interest (Step 1) + Area of Influence (Step 1) + Significant Characteristics (Step 1/2) + Weather (Step 2) + Terrain (Step 2) + Civil Considerations (Step 2) + Threat Characteristics (Step 3) + Threat Models (Step 3) + Threat Capabilities (Step 3) + Friendly Plans (Step 4)

I know that the above equation may use terms or concepts that are new, but for now treat it as an example for what is in store. I encourage you to play around with the meanings and concepts behind this, to see how it can be applied to your operations. Keep in mind, that is only surface level analysis. If we were doing a complex analysis, we would focus on the threat specifically and in great detail about its components.

Intelligence Design can be a powerful tool that allows analysts to increase accuracy in intelligence production. It also serves as a conceptual structure that allows analysts to design new intelligence.

Production Design Process

The purpose of the Production Design Process (PDP) is to help an analyst design a complete product. The reason for this is to ensure that products will provide all the information and intelligence necessary to the consumer.

Product(s) are any method or form of relaying/presenting intelligence or information. It can be a picture, an oral presentation or a slideshow that incorporates all three. There is no limit to what it can be as long it achieves what the consumer requires.

Though, the consumer of the products does not always convey an accurate description of what they need. This could be due to a lack of understanding of our full capabilities, expectations based on previous products received, or not caring to give a full description.

It is important for intelligence producers to pay attention to detail and ask questions. The slippery slope is that you create something that wasn’t asked for and doesn’t fit the need. The requestor or situation should not be disregarded, the provided key information will begin the process.

Step 1: Listen or fully read the request.

Step 2: Identify the real question(s) and ask for clarification.

Step 3: Determine purpose of product(s). What will it be used for?

Step 3: Determine what information (type, quality, and quantity) will be required to answer the request. Derive this from the verbiage used and the real question(s) being asked.

Step 4: Identify if any current products/product types will answer the question.

Step 4a: If a product does not exist, determine how the information will be synthesized. Conduct Intelligence Design.

Step 5: Determine how the information will be disseminated (digital file, hardcopy, email, etc.).

Production Frameworks/Analytical Techniques


A basic structuring technique for grouping information to develop insight to facilitate analysis.

Sorting is effective when information elements can be broken out into categories or subcategories for comparison using an automated computer program, such as a spreadsheet. This technique is most useful for reviewing massive data stores that pertain to an intelligence challenge. Sorting also aids in the review of multiple categories of information that when broken down into components can present possible trends, similarities, differences, or other insights not readily identifiable. Sorting can be used at any stage and is particularly effective during initial data gathering and hypothesis generation.

Timeline or Chronology

A chronology is a list placing events or actions into the order in which they occurred; a timeline is a graphic depiction of those events put in context of the time of the events and the time between events. Both are used to identify trends or relationships between the events or actions and, in the case of a timeline, between the events and actions as well as other events or actions in the context of the overarching intelligence problem.

Chronologies and timelines aid in organizing events or actions. Whenever it is important to understand the timing and sequence of relevant events as well as to identify key events and gaps, these techniques can be used. These events may have a cause-and-effect relationship, or they may not.

Matrix (or Matrices)

A grid (or table like an excel spreadsheet) with as many cells as required to sort data and gain Insight.

Matrices are useful whenever there are more options or more intricate data than can be conceptualized at one time without a visual representation. Whenever information can be reduced to a matrix, it provides analytic insights.

Blackhatting (or Adversary Intentions)

A technique to efficiently provide insight from an adversary’s point of view on the most important criteria used to determine the impact and implications of likely options under consideration.

The adversary intent matrix should be used when the most likely and reasonable alternatives under consideration by the adversary are known. It is necessary for the person using the technique to have knowledge of the motivation, goals, and objectives of the adversary making the decision and to assess the criteria in the matrix from the adversary’s point of view. This technique also provides a quick method to determine indicators of change to use to generate collection requirements.

Link Charts

A method to gain analytic insight by visualizing social, business, and activities-related connections among people and groups as well as infrastructure, logistics, and production chains.

Analysts should use a link chart whenever individuals, groups, group activities, or process networks are being reviewed for insight. The need for link charts for analysis increases with the increase in data and network complexity.

Event Trees

Graphic depiction of a potential temporal sequence of events, including potential junctures within the event sequence.

Use an event tree to clarify alternative event sequences with potential future or at least unknown outcomes related to an intelligence problem. Event trees work best when there are multiple, mutually exclusive options that cover the spectrum of reasonable alternatives available.

Event Mapping

A mind-mapping diagram representing the scenarios in hypotheses linked around a central word or short phrase representing the issue or problem to be analyzed.

Use this technique when a nonlinear method is desired to generate, visualize, structure, and delineate the events in a scenario or hypotheses related to the intelligence issue or problem. The addition of colors can represent key players in each scenario, such as economics, military, opposition groups, science, culture, as well as internal and external political pressures. It is also easy to annotate indicators of change to use in the formation of collection plans.

Educated Probability (Subjective)

A quantitative expression of someone's degree of belief in the truth of a statement relative to others from among a complete set of alternative possibilities.

Subjective probabilities are used to quantitatively express an overall degree of belief in the truth of a statement or hypothesis where the total belief held by an officer is allocated among the possibilities (non-overlapping hypotheses) in proportion to how likely each answer or event is correct. Subjective probability analysis is useful in comparing the perceived likelihood of hypotheses, supporting event tree or matrix analysis by providing quantitative estimates for each event, and quantitatively evaluating the value of additional information in shaping the conclusions of an analysis.

Weighted Ranking (Subjective)

A technique used by an individual or group to gain confidence in the assessment of available alternatives by weighting criteria in importance from the decision maker’s point of view.

Weighted ranking should be used anytime the topic is important enough to warrant the investment of time and there is a need for transparency in the reasoning used to derive the assessment. In intelligence analysis, each criterion used in the technique must be selected and given a weighted importance from the adversary decision maker’s point of view. The insight gained on how each criterion will affect the final outcome allows for a clear, persuasive presentation and argumentation of the assessment. Weighted ranking helps mitigate bias and mindset when the officer using it faithfully follows the method and treats each step as equally important to the outcome. The technique can be used by a group working together as long as a group facilitator keeps the process on track. The validity of the weighting of the criteria can be enhanced by the group through discussions sharing insight into the adversary decision maker’s purpose and point of view.

Military Decision-Making Process (MDMP)

Of course, I can’t go over intelligence without touching on operations. Now many of you should be familiar with Five Paragraph Operation Order, if not go read that article first. Available here on the website.

The military decision making process is an iterative planning methodology to understand the situation and mission, develop a course of action, and produce an operation plan or order. The military decision making process (MDMP) helps leaders apply thoroughness, clarity, sound judgment, logic, and professional knowledge to understand situations, develop options to solve problems, and reach decisions. This process helps commanders, staff, and others think critically and creatively while planning.

Without further ado, the MDMP Process:

Step 1: Receipt of Mission

Mission received from higher or deduced by the commander and staff. Involves setting out a commander’s initial guidance (what to expect) and a WARNO or Warning Order (a hasty 5P "OPORD" with bare minimum information to get things moving).

Step 2: Mission Analysis

More information is received, staff has made estimates and the initial outline of the plan is complete. WARNO is reissued/updated to; state the end goal, provide intelligence requirements, estimates (logistics and baseline enemy assessment), start IPB, start collection, start movement.

Step 3: COA Development

Initial IPB (Steps 1-3) is complete and courses of actions are developed for the enemy, in order to inform the commander of possible threats to the mission.

Step 4: COA Analysis (Wargame)

Taking previously developed enemy courses of actions and wargaming them against friendly plans. Friendly plans are refined and updated.

Step 5: COA Comparison

Results of wargaming are ranked against each other to determine most likely and most dangerous.

Step 6: COA Approval

Best enemy courses of actions are reviewed and approved by the commander. Plans are refined further in response, High Value Targets are identified and a new warning order is issued.

Step 7: Orders Production

Further refinement and review, issue fully fledged Operation Order.

Mission planning and development is quite the process and deserves an article of its own, but It is important to at least touch on. As intelligence plays a crucial role in it and it is the backbone behind operation orders. Which, you may not have the time to make it through this whole process, depending on the circumstances. So any intelligence accomplished (especially well in advance), could make a huge difference in supporting a hastily made mission.

Throughout these steps, intel has a hand in every aspect of this process. Starting from the first step to the last, intelligence will be:

  1. Answering requests for information. (RFI)

  2. Assigning people or assets to collect information.

  3. Manage and process all information gathered.

  4. Conduct IPB (produce intelligence).

  5. Identify intelligence requirements.

  6. Identify high value targets.

  7. Keep an ongoing updated board of the most current intelligence.

Not necessarily in that order.


I hope that wasn’t too much of an info dump, but here are some questions to consider and assist with your application of this lesson.

1. Give yourself a small scenario (5P OPORD or MDMP), how would you go about preparing the battlefield with intelligence?

2. Think of a common occurrence on a battlefield (ambush, raid, assault, etc.) and think about the all the things needed for that event to occur, for example;

Possible future event = component + variable * factor

3. Referring back to the IPB equation, how would you answer intelligence requirements related to each component of that equation?

4. What are examples of “intelligence” products you have seen? (Military, Law Enforcement or Civilian?)

5. What are some systems or tools you could use toproduce intelligence? (Both digital and analog)

I am sincere in saying please feel free to ask questions below. I’m pretty understanding if any concepts need to be further explained or simplified. If you have any feedback, I would appreciate that as well.

Intel Andy

514 views0 comments

Recent Posts

See All