Dysfunction of NIM
NIM and intelligence
NIM and statistics
Job descriptions
Training
Dysfunction of NIM
The role of Principal Analysts
Legal Status of NIM
What then must be done?
Joe's Telex
Links
Copyright notice: text from this website may be reproduced freely, so long as IntelligenceAnalysis.net is quoted as the source
About this website
National Intelligence Model's failure to distinguish between statistics and investigation enables managers to misuse intelligence analysts for management information purposes. Even where intelligence analysts are used for investigation and intelligence, NIM sidelines the role to one of providing "products for clients". Harassment aside, there is enormous dysfunction that results. This page provides a few examples.
HotspotsCrime statisticians use hotspots for two purposes: to allocate police resources, and to understand why crime is committed in a particular environment to aid crime prevention. The numerical and mapping skills used to define and identify hotspots do not, however, assist investigating officers for two reasons: first, the officers work in the same organisational unit as the statistician and already know in broad terms what the statistician is going to tell them. Second, that a number of crimes occur in an area is no more a reason to assume that they are linked, than crimes in different areas can be assumed not to link. Until the crime report is read and researched with reference to the actions of who committed it, the investigating officer is not aided.
Consequently, when an intelligence analyst is used to identify hotspots, such as reporting that the town centre is a 'theft from shop' hotspot, particularly between 9am and 5pm, though not so much on Sundays, detectives and other intelligence staff are left wondering: why is the intelligence analyst stating the obvious, and how is this supposed to help?
Left to their own devices, intelligence analysts will work out after a year or two why defining hotspots does not yield actionable intelligence, for investigation starts from reading a crime report and working outwards, not by drawing a circle on a map and looking inwards. But this self-education is retarded by NIM training that specifically teaches hotspots are related to investigations. Having no reason to believe that they are being lied to, many intelligence analysts respond by working harder at hotspots, breaking information down into more detailed lists of types of location, products, crime, etc. All this does is to produce more statistics and coloured maps; it does nothing to bring the analyst any nearer to linking crime to crime, crime to offender, or offender to offender.
Not only does this not help investigators, it also fails to help managers, for managers are looking for answers that only a statistician can answer, i.e. what is the meaning of the statistics? Intelligence analysts, having the perspective of a detective, will say the statistics has no meaning, for it does not refer to individual offenders. The net result is that nobody gets what they want and the intelligence analyst is blamed.
The Intelligence Cycle
ACPO's 2007 guide to intelligence-led policing says in its chapter on NIM that analysts work to the 'intelligence cycle'. The components of the cycle are, "Direction, Collection, Collation, Evaluation, Analysis, Dissemination and back to Direction".
The first of these components - Direction - is incorrect; intelligence cycles start with Collection, not Direction. This is because if there was no crime, there would be no police; therefore, a crime has to be committed before any process can begin, and the first stage must be the collection of information. ACPO's purpose in placing Direction at the beginning is to control staff; it has nothing to do with how intelligence is developed.
ACPO is also wrong when referring to Collation. Collation happened in the 1970s when information was stored on paper. Information would be replicated and placed on different index cards, which could then be cross-referenced so that people could find information from any perspective. Computer storage changed all that with the result that information need only be stored once (i.e. inputted). Information is grouped subsequently on retrieval, so the need for collation disappears.
ACPO is again in error over Evaluation, and this has the most relevance to intelligence analysis. ACPO's definition of evaluation refers to gradings given to informant information by handlers using the 5x5x5 system. Evaluation in the analyst's sense, however, comes after Analysis. Combined with the above observations, the intelligence cycle should look like this:
Collection, Grading, Analysis, Evaluation, Dissemination, Direction, back to CollectionHowever, rather than presenting 5x5x5 reports as information which is then turned into intelligence by analysts, ACPO presents it as intelligence before it reaches analysts. This is an interpretation that training agencies dutifully follow; for example, according to the RISC "Intelligence Analysis" training manual (page 74), information becomes intelligence when (my emphasis):
"… a change has occurred to the raw information which means that it now has a different value, and can be deemed intelligence. The change has been to grade the source of the information, and the validity of the information, by some scoring mechanism … a more complete answer would continue to explain that the grading is necessary in order to validate any hypotheses that are generated at a later stage".
Describing information as 'intelligence' creates opportunities for abuse, such as prior to the Iraq War when the government used the word 'intelligence' to refer to bits of information suggesting there were weapons of mass destruction in Iraq. In contrast, actual intelligence (placing said bits of information in the context of all information) did not support the notion that there were weapons of mass destruction. The misuse of the word 'intelligence' was critical for the case for war, and was achieved by cutting intelligence analysts out of the intelligence process by NIM-style culture and processes.
Consider again the above RISC statement: "… grading is necessary in order to validate any hypotheses that are generated at a later stage".
In case the implication of that statement is not clear, I am going to spell it out: developed intelligence can be over-ridden by a single piece of information, because of a bureaucratic grade assigned to the latter at an earlier point. The fact that the grade is necessarily rendered redundant by subsequent developed intelligence has passed completely over the heads of policy makers.
Failure to distinguish between information and intelligence occurs routinely in police work whereby the word 'intelligence' gets bandied about and police react in a half-cocked manner without consulting the intelligence analyst. 5x5x5 grades only refer to informant handlers' assessment of information at the time it was received, which is of no relevance to the analyst who is trying to get beyond that point. To do their job, the analyst needs to know not a selection of numbers and letters, but: the precise words of the informant; the date the information was provided; the date to which it refers; and an indication of the informant's identity, if not their name, then a unique identifier so the analyst can distinguish between one informant and another.
Moreover, informant information is only a tiny proportion of total information that the analyst will rely on; most information is known traditionally as 'A1': crime reports, telephone records, surveillance, forensic, etc. Until the analyst has considered the informant information in context of all this information, it is not intelligence and cannot be evaluated in any meaningful sense. The term CHIS (covert human intelligence source) is inaccurate; it should stand for covert human information source, because information does not constitute intelligence until after it has been through the intelligence analyst.
The Three Levels of NIM
NIM is designed to operate at three levels, which it defines as follows:
| Level 1 - | "Local issues … affecting a basic command unit [i.e. a division] … wide ranging from low value thefts to great seriousness such as murder … volume crime will be a particular issue…" |
| Level 2 - | "Cross Border issues … affecting more than one basic command unit" |
| Level 3 - | "Serious and Organised Crime … operating on a national and international scale" |
NIM goes on to explain, "… criminals clearly operate at two levels, firstly crimes that directly impact upon a community as described in Level 1; secondly those operating at a serious and organised crime [Level 3] … Level 2 - Cross Border issues - is included in the model because not all criminality and related issues can be successfully tackled by law enforcement activity in Levels 1 and 3".
Note NIM's choice of phrasing: criminals "clearly" operate within divisions and nationally, but since "not all" criminality can be tackled at these levels, cross border is "included" as well. This wording suggests cross border crime is regarded as a non-conformity; it does not fit streamline NIM. Level 2 therefore supplements Levels 1 and 3. Contrast this with the experience of most police officers, which is that crime that crosses borders is the norm; it is criminals who do not cross borders that are exceptions. From this perspective, it is NIM that does not fit.
The schism between NIM and reality widens when applied to intelligence analysis. Consider Staffordshire Police's job description for Divisional Analysts:
 |
The job description says that the analyst will provide intelligence for "level 1 criminality", which begs the question: how does the analyst know which vehicle thefts, burglaries and violence are level 1 in order to select them for analysis in the first place? Until the intelligence analysis has been undertaken, nobody knows. That is why organisations employ intelligence analysts; to find out. Therefore, to decree that an analyst looks at "level 1 criminality" is a contradiction in terms.
But do level 1 criminals even exist? This is a map of Staffordshire Police; to give an idea of scale, the force is 30 miles across:
 |
Level 1 policing works on the basis that criminals move within one division only. If this is true, a North Staffs Division criminal going from Newcastle to Leek, as indeed he might, for both towns are of the same division, would navigate around Stoke-on-Trent Division to remain NIM-compliant. To test how widely this view of criminal movement is held in law enforcement circles, visitors to this website are invited to participate in the following survey:
|
|
For argument's sake, let's accept that NIM is right, and that there are significant numbers of criminals who have never travelled more than a few miles. On the map is placed a purple square; imagine a circle, about the size of a penny, around that point. The area covered by that circle represents a five mile radius, yet extends into all four of Staffordshire's divisions. Within this zone, even criminals who travel only a few miles, and seemingly level 1, can still be expected to cross borders, thereby rendering their classification as 'Level 1' meaningless. The same applies to level 1 offenders near any other boundary; in Staffordshire's case this could include: Burton, Uttoxeter, Tamworth, Newcastle and Rugeley, Trent Valley Division north of Uttoxter, Chase Division south of Cannock, the western side of North Staffs and all of Stoke-on-Trent Division. The only areas where 'level 1' offenders could exist are Stafford, Leek, possibly Cannock and Lichfield and some areas of countryside.
The are two bad ways in which police forces implement 'level 1':a) By telling analysts on division not to look at data beyond their own boundaries. In such forces, justification for NIM area policing is circular and self-perpetuating: if analysts are not allowed to research crime reports beyond their boundaries, they cannot establish whether criminals cross those boundaries, meaning there can never be any evidence to show that 'level 1' criminals are not, in fact, level 2. Therefore, their level 1 status is preserved regardless of reality. This writer has heard supervisors in three forces make categorical statements to analysts that researching other divisions is not necessary because "our criminals do not commit crimes in other divisions". This mindset sums up the psyche of NIM in a nutshell.
b) Other police forces tell analysts on division that they may look elsewhere but, on finding a cross border link, they must refer the matter to a level 2 analyst. The practical effect is that divisional analysts lose any incentive to work since, as soon as they pick up on something of value, they have to stop; they are destined never to complete a piece of work. Meanwhile, force analysts receive half-completed pieces of work and, having no familiarity with it, have to start over, thereby duplicating work already done. Staff on divisions subsequently deal mainly with force analysts, since their own intelligence analysts have ceased to be part of the divisional intelligence loop.
Quarterly strategic reports
The above is taken from a job description for a Senior Criminal Intelligence Analyst at Avon and Somerset Police. The highlighted line refers to maintaining "network charts" for "quarterly strategic reports". Since a "network" chart refers to individual criminals, the word strategic cannot mean statistical in this context so, presumably, it is just a quarterly report.
Developing intelligence on criminal networks does not, alas, fit into neat three-month periods, since actionable intelligence can be uncovered in weeks, days, even minutes. The intelligence analyst is working towards catching the target, not towards producing a report for a quarterly meeting. The two do not go together. The result is that the intelligence is not actionable; it is reduced to another bureaucratic exercise. This is another example of dysfunction arising from confusing statistical analysis, which can be presented at periodic intervals (i.e. being able to control the question), and intelligence analysis, which cannot.
Area Policing
The following is part of a Met Police intelligence analyst profile which may be read in its entirety here:
| I start each day with a morning meeting to discuss what offences have occurred overnight. Throughout the day I carry out various tasks using analytical techniques and methods of obtaining further information on criminal activity within the borough. I work with Field Intelligence Officers, other Analysts and Crime Researchers as a team to analyse the crime data and to look for links in order to predict future activity or methods of criminal activity … I recently created a 20-page document about the borough in which I work. It helped throw some light on a few problem issues … Every fortnight, I work with my fellow Analyst to compile presentations to assist in the detection of crime. Today, I am compiling one of our presentations for which the deadline is tomorrow. These reports help us to set our targets and detail how the borough has performed throughout the previous two weeks … Working here has allowed me to gain an insight on the geographical makeup of the area and how criminals operate within it. |
Detectives do their nut over this sort of thing. To explain: imagine someone who has never seen a fridge, and asking them: "Is the fridge light on?" They open the fridge and say, "yes, the light is on", and close the door. Then imagine asking: "But is the light always on?" At this point, there are two types of people: the first is the [real] intelligence analyst who will say "well, I do not know when the door is shut". The second is the NIM analyst, who opens the door several more times to check and says: "oh yes, the light is always on". This latter reasoning is false; we all know the fridge light goes off when the door is closed. Thus, information we cannot see can contradict assumptions based on what we can see.
In a police context, staff who produce information on "criminal activity within the borough" and the "geographical makeup of the area and how criminals operate within it" are not capable of "looking for links", or "assisting in the detection of crime", for the practice of looking within an area conflicts with the practice of tracking the criminal. Real statisicians know this and do not attempt to link crimes; they leave that to intelligence analysts. Reciprocating, real intelligence analysts do not acknowledge criminality as defined as "within the borough"; they leave that to crime statisicians.
As with hotspots, analysts will work this out. But this is against the background of NIM brainwashing that teaches precisely the opposite. The position is so chronic in some forces that intelligence analysis has all but ceased; yet, dozens of people mill about, armed with powerpoints, all claiming to be intelligence analysts. In forces like this, analysts have become part of the problem - but more of that later.
'Researchers'
Under NIM doctrine, intelligence analysts are supplemented by researchers. In reality, intelligence analysts already have researchers; they are called computers. The intelligence analyst states his or her desired information via a keyboard and the computer retrieves it; the intelligence analyst then selects the information they are interested in. Gone are the days when researchers were required to research paper records on behalf of analysts.
 |
If we return once again to the intelligence analysis diagram, we see that there is only one job, that being the intelligence analyst, drawing information out of the databases on the left and reassembling it into intelligence on the right. Creating the separate post of researcher suggests that the boxes on the left and right represent locations of jobs; thus, the boxes on the left need to be researched, so a researcher is employed over them; and the boxes on the right need analysis, so an intelligence analyst is employed on the right. This is a complete misconception of what actually happens.
The effect of creating a division between research and analysis is that the researcher carries out the intelligence work of linking crime to crime, crime to offender, offender to offender - and then passes this to the intelligence analyst who is expected to "analyse the intelligence", which is a meaningless instruction since it is information that is analysed, and the researcher has already done this. If the series is ongoing, the intelligence analyst is not best placed to carry it forward, since he or she did not undertake the investigative work that identified the series, and so does not have the researcher's degree of familiarity.
Thus, the researcher carries out intelligence and investigative work but is not regarded as part of the investigation, whereas the intelligence analyst is nominally part of the investigation but is not permitted to participate. Intelligence analysts are told to stop looking at crime reports because: "the researcher can do that for you" or "you do not have time". The intelligence analyst is instead expected to do supposedly "deeper" analysis such as telephone billing association, but in practice is unable to develop intelligence or make it actionable because he is barred from researching the criminals' activity (e.g. crime reports) in tandem.
The failure to understand that analysis and research have become the same thing has led to an employment fiasco that matches in scale the failure to split intelligence and statistics. The Metropolitan Police alone employs 580 intelligence analysts and 450 researchers (2008 figures), meaning over a thousand employees in jobs without meaningful definitions. What the Metropolitan Police should have done was to employ 500 (real) intelligence analysts and 500 (real) statistical analysts. Instead, they, like every other police force, will have to dismantle what they have done and start all over again.
Summary
This section is entitled "Dysfunction of NIM"; but this title assumes that NIM's effects are unintentional. If NIM is regarded as a National Harassment Model, then NIM is functioning as intended. In each of the above examples, managers get what they want; products to present to each other at meetings. The fact that the products might be inaccurate, incomplete or misleading is not a concern because no actual intelligence work is permitted to show otherwise.Trapped in this charade is the intelligence analyst who receives a steam of contradictory instructions; for instance, being told one day to develop actionable intelligence, then being told the next not to look at information more than three months old. If an analyst overcomes this nonsense and successfully identifies a criminal, they risk encountering resentment. An intelligence analyst who is new or inexperienced, and not familiar with the dynamics that this website seeks to lay out, must find it strange indeed to find themselves regarded as some sort of "enemy within" for trying to catch criminals. Surely, should not law enforcement managers be pleased at such work?
This question will be examined further in the next section.