Intelligence Writing - Why It Matters

2y ago
54 Views
2 Downloads
1.24 MB
22 Pages
Last View : 1d ago
Last Download : 2m ago
Upload by : Jerry Bolanos
Transcription

Intelligence Writing - Why It Matters17BTable of ContentsIntelligence Writing – Why It Matters . 2Why Intelligence Writing Matters . 3Intelligence Writing – Some Tips . 4Know your Audience . 6Intelligence Writing Is Not Academic Writing -1 . 7Intelligence Writing Is Not Academic Writing -2 . 8Bottom-Line-Up-Front (BLUF) . 10BLUF 1st Paragraph Tips . 11Key Judgements . 12Source Summary Statement . 13Intelligence Gaps . 15Threat and Strategic Analysis. 16Conclusion . 17Intelligence Writing Tips -1 . 19Intelligence Writing Tips -2 . 20Intelligence Writing Tips -3 . 21Notices . 22Page 1 of 22

Intelligence Writing – Why It Matters0BIntelligence Writing –Why It Matters39**039 Let's talk about intelligencewriting and why it matters.Page 2 of 22

Why Intelligence Writing Matters1BWhy Intelligence Writing Matters“If you are not able to clearly communicate the results of all the research, analysis, andother grunt work you have put in, then, from the reader’s viewpoint, none of thatmattered.” Writing and Briefing are fundamental to the intelligence profession.Major, James S. Communicating with Intelligence. Lanham, MD: Rowman & Littlefield, 2014.40**040 So even if you've done greatanalysis, yet you're unable tocommunicate your findings or yourassessments clearly and effectively,it's really not going to matter.Page 3 of 22

Intelligence Writing – Some Tips2BIntelligence Writing – Some Tips Focuses on the future Written for generalists facing real problems Act of meaningful Characterization Begins with bottom line then explores their implication Anything more than 5 pages on one particular topic or event, may not be read bymany people.James S. Major. Communicating with Intelligence.Second Edition. London. 2014. Rowman and Littlefield.41**041 Intelligence writing often, butnot always, focuses on the future,and many intelligence reports try tofocus on the future and judge whatmight happen or what will happen inthe future. For example, "We judgeRussia will launch more sophisticatedcyberattacks against Ukraine," or "Wejudge that ransomware will continueto be the tactic of choice for ABCOrganized Crime Group."When you're in a more operationallyfast-paced type environment, doingintelligence assessments on thefuture is a big challenging becauseyou're typically just trying to keep upand assess what is going on in anyparticular situation and makerecommendations and provide deeperinsight and context for operators inthe field. At the very least though,you should be trying to providePage 4 of 22

operators in the field with new insightand meaning.Intelligence writing tends to bewritten for generalists facing realproblems. So intel analysts, whenthey go and brief and write, they areusually doing that for people that aregeneralists, policymakers, decisionmakers, that do not have the samedepth of knowledge as the technicalfolks do. So the products should bewritten and briefed in a manner thatis comprehendible for a generalist,the idea of being able tocommunicate technical language intonontechnical language fornontechnical audiences at differentaltitudes within an organization is-and I think personally will be verymuch needed in the future for peoplegoing into this field.The notion of Act of MeaningfulCharacterization means that youshould go beyond just listing factsand attempting to draw conclusionsfrom facts. That's what the Act ofMeaningful Characterization means.It means don't just list facts, try toadd some context. It is basicallydoing analysis, correlations, usingmultiple sources of intelligence, usinganalytical methods. Again, don't justlist facts, because anyone can dothat. Your job is to make themmeaningful, relevant, and provideinsight that goes beyond just factlisting.Begin with the bottom line and themexplore their implication. Can't stressthat enough. Always start with thePage 5 of 22

bottom line, explore your implication,and then anything more than fivepages on one particular topic orevent may not be read by manypeople.Know your Audience3BKnow your Audience Who will be reading your product, or who will you be briefing to? How much does your audience already know about the subject? Why does your audience care? How will your audience use / or would you like for them use the information you givethem?42**042 Before you begin towrite, you must ask your thesequestions before you begin. Who willbe reading your product or who willyou be briefing to? How much doesyour audience already know aboutthe subject? Why does youraudience care? How will or howwould you like for them to use theinformation that you're going to givethem? You should be thinking aboutthese things before you write andwhile you are writing, and also don'tforget to figure out when the productis due.Page 6 of 22

Intelligence Writing Is Not Academic Writing -14BIntelligence Writing Is Not Academic Writing -1 Academic Writing – Logical flow is usually researcher’s evidence in increasingorder of significance and builds to a closing conclusion.IntroductionHistorical backgroundBody of the PaperConclusionCritical Thinking for Intelligence. Katherine Hibbs Pherson,Randolph H. Pherson. Sage Publications 2013.43**043 Intelligence writing is notacademic writing. Academic writingwas what I was taught when I was inhigh school or college. Academicwriting usually goes like this: Firstyou have an introduction. In theintroduction you talk about what thepaper is going to be about, whyyou're writing about this particulartopic, how the paper is organized.So, "The first part of the paper willtalk about this, the second part willtalk about that, the third part,"etcetera, etcetera. You also have theresearch methodology, how you wentabout doing your research, and thetimeframe for the research. The nextsection typically goes into somehistorical background where youhave the history of a priorassessment on the research topic.Then you're going to get into thebody of the paper, where you'rePage 7 of 22

diving into details, and then you haveyour conclusion where you wrap upeverything in a nice summary. Sothat is actually the opposite way ofhow you should do intelligencewriting. Don't do that when you'rewriting intelligence as a cyberintelligence analyst.Intelligence Writing Is Not Academic Writing -25BIntelligence Writing Is Not Academic Writing -2Intelligence Writing starts with the most important concept and has reasoning andanalysis that follows.Order Typically Follows:Bottom Line Up FrontKey JudgementsSource SummaryTechnical AnalysisStrategic AnalysisConclusionCritical Thinking for Intelligence. Katherine Hibbs Pherson,Randolph H. Pherson. Sage Publications 2013.44**044 What you want to do issomething like this. This is generallythe conceptual order or frameworkfor intelligence writing. Intelligencewriting is the opposite way fromacademic writing largely becausedecision-makers do not have time toread your entire paper to get to yourconclusions. They want to knowright up front what they need toknow. So certain intelligentorganizations, bosses, companies oragencies, they may differ in the exactorder or even naming convention onPage 8 of 22

this slide and these sections that I'mabout to talk about, but all of themare going to tell you to keep theBottom Line Up Front, followed byKey Judgments. So let's talk aboutthese more in-depth.So you have your Bottom Line UpFront, and sometimes that's called aBLUF. This is your main point orrecommendation or idea that youwant to get across to a decisionmaker. Next is your Key Judgmentsabout your topic. These are typicallystatements that begin with thewords, "We judge" or "We assess" or"We estimate with low or moderateconfidence that ABC country willlaunch a cyberattack against XYZcountry."Next is your Source Summary, andthat is a summary about the sourcesyou have used to support you andwhere you get your information, andthen the next could be TechnicalThreat Analysis, followed by yourStrategic Analysis, depending on theissue you're working on. This is themore technical aspect, and then thestrategic is where you're focusing onthe broader impact to yourorganization or industry. And thenthe conclusion is the last section, andwhile this is more or less just arestatement of your Bottom Line UpFront, it should always have morecontext than your Bottom Line UpFront, and I'll talk about that in thenext few minutes. But let's godeeper into these sections.Page 9 of 22

Bottom-Line-Up-Front (BLUF)6B**045 So Bottom Line Up Front.Don't start a paper by defining themethodology in which you did youranalysis or the purpose of yourpaper. In other words, here's anexample of what not to do. Don't dosomething that says, "This paper willlook at key influential and risinghackers. First this study will attemptto show the possible reasons why thesehackers are gaining influence. Followingthat the paper is going to talk about theskills and the capabilities of thehackers, and finally the paper willconclude about which particularhackers will become senior leaders."Don't do that. What you really want todo is get right to the point with yourBottom Line Up Front. You want to answerthe main question that leadership has,because leadership-- they don't have thetime to know all the methods that youused. They want to know what thePage 10 of 22

bottom line is. If they haveadditional questions about yourBottom Line Up Front, they canalways ask you and you can givethem the information that they need.So you want to get right to the point;answer the question that your readerwants to know in the first paragraph.BLUF 1st Paragraph Tips7BBLUF 1st Paragraph Tips Do not exceed five sentences. State your assessment using estimative language. Make it a summary of the key points made throughout the analytical product. Briefly answer who, what, where, when, why, and how. Then, expand on the information in the analysis sections. Provide recommendations. Write it last in BLUF.46**046 So for your BLUF, thattypically should be one paragraph. Itshould not exceed five sentences.You should state your assessmentusing estimative language. It shouldbe a summary of the key points youmade throughout your analyticalproduct, and if you can-- and this isnot saying you have to do this; theseare things you should attempt to do ifpossible when you're writing yourBLUF-- you should try to answer who,what, when, where, and why andhow the particular issue you'rePage 11 of 22

looking at, and I would alwaysrecommend writing the BLUF lastwhen you're doing your assessment.Key Judgements8BKey Judgements Must convey accurately and succinctly the analytical findings of the paper Exclude source information used in the paper, persons consulted during preparation,or analytical methodologies Generally should not exceed 10% of your paper Are in bullet format, listed in order of importance Example“We judge with high confidence that in fall 2003, Tehran halted its nuclear weapons program;we also assess with moderate-to-high confidence that Tehran at a minimum is keeping openthe option to develop nuclear weapons.”James S. Major. Communicating with Intelligence. Second Edition. London. 2014. Rowman and Littlefield.November 2007 National Intelligence Estimate, “Iran: Nuclear Intentions and Capabilities48**048 Key Judgments are usuallyread by leadership. They mustconvey accurately and succinctly theanalytical findings of the paper. KeyJudgments should not include sourceof information that you use, personsconsulted during preparation, or whoyou coordinated with, or analyticalmethodologies employed. KeyJudgments convey what the analystwould say or should say to a highlevel decision-maker if given only twominutes in which to convey thefindings.So here's an example of a KeyJudgment from a November 2007National Intelligence Estimate aboutIran's nuclear intentions andPage 12 of 22

capabilities as classified and releasedby the Office of Director of NationalIntelligence. The example is, "Wejudge with high confidence that inthe fall of 2003 Tehran halted itsnuclear weapons program. We alsoassess with moderate to highconfidence that Iran at a minimum iskeeping open the option to developnuclear weapons." So that's anexample of a Key Judgment.Source Summary Statement9BSource Summary Statement 1 - 2 paragraphs – (Preferably one) Paras should not exceed five - six sentences. Focus on types of sources, credibility, reliability, date of information, and relevance tothe intelligence provided. Example“Analytical findings are based on multi-source intelligence reporting over the last two years.SIGINT detailing XYZ threat actor capabilities was corroborated with two long-time HUMINTsources assessed to be reliable and whose reporting on past and different cyber threatactors has been corroborated. OSINT (pastebin / IRC, dark web chats) often corroboratedclassified reporting yet we are unable to fully determine the reliability and credibility of thoseOSINT sources on such platforms.”49**049 So your Source Summarystatement should be one or twoparagraphs, preferably one.Paragraphs should, again, not try toexceed five or six sentences. Andthis section is where you try to speakto the types of sources you used, thecredibility, reliability and relevance ofthe intelligence provided.Additionally, you should havefootnotes or endnotes, depending onPage 13 of 22

your particular employer'spreference. I think it would also be agood idea to place or note whereyour intel gaps are, although I'veseen some reports where intelligencegaps are at the end of theassessment, and here's an exampleof a Source Summary statement thatI just made up. "Analytical findingsare based on multi-sourceintelligence reporting over the lasttwo years. SIGINT dealing with XYZthreat actors was corroborated withtwo long-time HUMINT sourcesassessed to be reliable and whosereporting on past and different cyberthreat actors has been corroborated.OSINT often corroborated classifiedreporting yet we are unable to fullydetermine the reliability andcredibility of those OSINT sources onthe platform."Page 14 of 22

Intelligence Gaps10B**050 In terms of intelligence gaps,write them as statements, notquestions. In the statements identifythe specific intelligence gap, why it isa gap per your assessment, what isneeded to fill the gap. An examplecould be, "This assessment lacksinsight into phone and encryptedchat communication. We considerthis a gap in our assessment becauseunderstanding actorcommunications could provide uswith clarity regarding TTPmodifications and possible nexttargets. Recommend focusingSIGINT collection patterns for thispurpose." So that's an example ofstating intelligence gaps.Page 15 of 22

Threat and Strategic Analysis11BThreat and Strategic Analysis Circa 1 to 2 paragraphs for Threat and Strategic Analysis Each Employ the decreasing importance style; avoid increasing Start with the most recent info, then work your way back in time Inform about what, if any, analytical methodologies used during your analysis thataided in forming your judgments Threat Analysis (Technical) – What, How, When, Where Strategic Analysis (Holistic) – Rooted in Threat Analysis yet focuses on Who andWhy (threats) / or other topics geopolitics, emerging technology51**051 Threat and Strategic Analysis.So obviously if you're a politicalintelligence analyst orcounterintelligence analyst or denialor deception analyst, you may nothave a technical portion or yourtechnical portion may be differentthan a cyber intelligence analyst, andthat is totally fine; you got to dowhat makes sense. However, for ourpurposes, as a cyber intelligenceanalyst, you should have a TechnicalThreat and Strategic Analysis section.Each section should be one to twoparagraphs long. However, there isreally no hard and fast rule aboutthat. I am a big fan of brevity, sothe shorter the better in my opinion.Your analysis should also employdecreasing importance of style,meaning start with the mostimportant parts of your analysis andPage 16 of 22

work back in decreasing order ofimportance. Think of your TechnicalAnalysis section as your ThreatAnalysis section, which shouldaddress the what, how, where, andwhen questions of your cyber issue.Think of your Strategic Assessmentas addressing the who and the whywhen it comes to particular threatactors, or a deep analysis on trendsin the industry about a particulartopic or technology. In thesesections, you should also informabout what analytical methods, ifany, were employed to assist youranalysis that help with yourjudgments.Conclusion12BConclusion Make sure the reader walks away with what they need. Unique – Flows organically from everything that came before it Substantive – Has meaning, gives the reader something to consider, morecontext than BLUF Proportional – Length of conclusion depends on length and complexity of paper Consistent – Should convey the same overall message in the BLUF; consistent intone and attitude of rest of paper Not a copy and paste of BLUF Do not leave any cliffhangers.James S. Major and Dianan Raschke. Communicating withIntelligence. Second Edition. London. 2014. Rowman and Littlefield.52**052 Whether you write aconclusion is honestly a judgment callbased on your company,organization, and you, your role,responsibilities, and how much timePage 17 of 22

you actually have. In some cases, ifyou only have a page or a page anda half of text, you probably do notneed to write a conclusion. If you dohave a conclusion, you want to makesure the reader walks away withwhat they need to know. So think ofyour conclusion as your last chanceto convey your meaning to theaudience or the reader, and becauseof that, you really want a strongconclusion. Since the consumer ofyour product has already reached theconclusion, meaning that they'veread through the entire paper, feelfree to synthesize your analysis a bitmore with more detail or in a waythat best captures your meaning andwhat you want your reader toremember and act on at the end. Solike the BLUF, the conclusion bringsall the pieces together, but in theconclusion you have more flexibilityto allude to people, places, concepts,attacks covered earlier in the paper.Here's some tips for your conclusion.Try to make it unique, meaning itshould flow organically fromeverything that came before it.Substantive-- it should have meaningand gives a reader something toconsider. It should be proportional,meaning that the length of theconclusion depends on the lengthand complexity of your paper. Yourconclusion should not be threeparagraphs if your paper is twoparagraphs long. It should also beconsistent, meaning that it shouldconvey the same overall message inthe BLUF, consistent in tone andattitude with the rest of the paper.Page 18 of 22

There should be no mixed messages,and the conclusion should not just bea copy-and-paste of your BLUF.Intelligence Writing Tips -113BIntelligence Writing Tips -1 Align Threat / Strategic analytical paragraphs with this format. Topic sentence: Convey the most important idea/information. Use 2-3 detailed sentences to expand/provide more context on the topic sentence. Last sentence: Reemphasize the paragraph’s main point and/or transition to nextparagraph or section. Paragraphs should be 4-5 sentences. Never longer than six sentences. Revise, revise, revise. Use active, not passive voice. Subject – verb – object If not, we’ll be asking a lot of “whodunit” questions.54**054 Here's some overallintelligence writing tips. First, youwant to align the Threat andStrategic analytical paragraphs withthis format. You should have a topicsentence, which conveys the mostimportant idea or information for theparagraph. Then you should havetwo to three detailed sentences toexpand or provide more contextabout that particular topic sentence,and then you wrap it up with the lastsentence, which reemphasizes theparagraph's main point, or you'retransitioning to your next paragraphor section. Again, paragraphs shouldbe four to five sentences long, notlonger than six sentences. You alsowant to try to use active voice. So,Page 19 of 22

for example, "The cyberattackdestroyed the server," is the activevoice. The passive voice would be,"The server was destroyed by thecyberattack." You want to use theactive voice.Intelligence Writing Tips -214BIntelligence Writing Tips -2 Be clear – One person’s ‘simple’ is another person’s ‘huh?’ Use footnotes to explain concepts, terms, methods, etc. Be concise – Use as few words as possible. Be precise – Say exactly what you mean. Use strong verbs. Print the product and read it out loud. Spend time prewriting. There is no magic formula for being a good writer – have grit!55**055 Some more intelligencewriting tips. Be clear. Simple wordsare always better. There's no needto try to use fancy GRE words orjargon. Those words are typicallyviewed as anathema to yourcolleagues in general. There's someirony there. But footnotes are greatalso, especially in the cyber domain,and always remember that wordsmean different things to differentpeople, such as the words "potential"or "possible" or "likely". And thenalways try to be concise. Less isgenerally more.Page 20 of 22

Intelligence Writing Tips -315BIntelligence Writing Tips -3 Wikipedia’s Neutral Point of View Avoid stating opinions as facts. Avoid stating seriously contested assertions as facts. Avoiding stating facts as opinions. Indicate the relative prominence of opposing al point of view56**056 Here's some additional tips.Avoid stating opinions as facts. Avoidstating seriously contested assertionsas facts. Avoid stating facts asopinions. And indicate the relativeprominence of opposing views.Page 21 of 22

Notices16BNoticesCopyright 2020 Carnegie Mellon University.This material is based upon work funded and supported by the Department of Homeland Security under Contract No. FA8702-15-D0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research anddevelopment center sponsored by the United States Department of Defense.The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an officialGovernment position, policy, or decision, unless designated by other documentation.NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL ISFURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHEREXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FORPURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIEMELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT,TRADEMARK, OR COPYRIGHT INFRINGEMENT.[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please seeCopyright notice for non-US Government use and distribution.CERT is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University.DM20-0262Page 22 of 22

Intelligence Writing Is Not Academic Writing -1 Critical Thinking for Intelligence. Katherine Hibbs Pherson, Randolph H. Pherson. Sage Publications 2013. Introduction Historical background Body of the Paper Conclusion 43 **043 Intelligence writing is not . academic writing. Academic writing .

Related Documents:

A guide for health care professionals 1 Introduction6 1.1 What is Mouth Care Matters in hospitals? 7 1.2he Mouth Care Matters training programme T 8 1.3 Who is Mouth Care Matters training for? 8 1.4 Mouth Care Matters team 8 2 Why do we need Mouth Care Matters training? 10 2.1 What is the impact of hospitalisation on oral health? 11 2.2 We are a changing population 11 2.3 Our mouths are .

unmatched to the Time Matters code. Add option to match Contact and Matter codes for Timeslips and Time Matters. 3096329 When synchronizing Contacts and Matters from Timeslips to Time Matters, the records are not being properly marked as billable. When a text field in Time Matters

MONEY MATTERS 6 Money Matters 1: Setting a Budget How can budgeting now help me make a big purchase later? Money Matters 2: Take it to the Bank! Why should I have a bank account and how do I use one? Money Matters 3: Keeping Track of Your Money How can I keep track of the money in my checking account?

Emotional Intelligence 2.0 Travis Bradberry and Jean Greaves Thesis-1: Emotional intelligence is a key factor in people’s success. Thesis-2: There is no known connection between cognitive intelligence and emotional intelligence. Thesis-3: People can increase their emotional intelligence even though cognitive intelligence is set.

SAP Business Intelligence. 4. Select . SAP Business Objects Web Intelligence. The Web Intelligence Home Page is displayed: Login to Web Intelligence (Connecting to the Server) 1. Open the . Web Intelligence. menu in the upper left corner of the screen. Note: When you start Web Intelligence from the desktop, you will not be connected to the server.

Emotional Intelligence and Leadership Emotional Intelligence and Management Emotional Intelligence and Perception Emotional Intelligence and Communication Conclusion Definition of Emotional Intelligence (EI) Emotional Intelligence- capacity to be Aware, Express & Control your Emotions, and handle interpersonal relationships Caringly and .

college writing works—why it exists, how it has evolved, why they are in writing classes, and why college writing seems so different from other writing, students will have a better understanding of and more control over their written communication, particularly as it occurs in college. Students using Writing Your Way Through College

The publication of the ISO 14001 standard for environmental management systems (EMS) has proved to be very successful, as it is now implemented in more than 159 countries and has provided organizations with a powerful management tool to improve their environmental performance. More than 324 000 organizations have been certified worldwide against ISO 14001 at the end of 2014, which is an .