Joe's Telex


NIM and intelligence

NIM and statistics

Job descriptions


Dysfunction of NIM

The role of Principal Analysts

Legal Status of NIM

What then must be done?

Joe's Telex



About this website

Every so often, I expand here on the themes of this website by commenting on events, articles, and general goings-on.

See here for Telex's in 2010

November 2012 - Analysts' reporting etiquette #6

When writing a report, the analyst will be aware of bits of information that must be mentioned, but which interrupt the flow of the report. Frankly, these can be a pain to weave in. The solution is to use footnotes. Examples of footnote use include:
To acknowledge an alternative interpretation to that presented in the main body of the report
To acknowledge a conflict in the information, or an exception to the rule; conversely, to cite further data or further examples that are corroborative
To provide references for information contained in the report
To refer to a previous report that is relevant to the current one

September 2012 - The intelligence analyst’s nightmare: the nondescript crime

Let us say a detective asks the intelligence analyst to investigate a domestic burglary. On reading the crime report, the analyst finds that it is the dullest crime ever: someone broke into a house and stole some cash. Even with a lack of researchable material, however, there are two queries that an analyst can make as a matter of course.

First, research the same address for any previous burglary, going back as far as records exist. Occasionally, burglars will return to a house and break in again, since they are familiar with it from their first visit. If that does not produce a matching crime, try adjoining houses. If a match is found, the historical crime may feature more information that can be used to kick-start investigation into the current crime.

Second, research similar crimes the same day, within what seems a relevant geographical limit, and see if there is anything to corroborate a link. This is best illustrated with an example: I was asked to look into a distraction burglary where two white males turned up to “fix a leak”, and stole cash. The victim was elderly and unable to provide any further information on either offender description or modus operandi. With such little information to go on, the offence was indistinguishable from scores of similar distractions.

As the pair (probably) had a vehicle (not seen), the entire force area was searched for other distraction burglaries that day. About seven miles away, on another division, two white males did a burglary while claiming to mend a washing machine. The crime occurred about two hours later, making it feasible that it was the same pair. There were good descriptions of them, enabling further research. And as we could see which direction they were heading, we were able to put in a request to the adjacent police force.

In both approaches (researching the same address/same day) the idea is to make a leap from a crime that cannot be researched to one that has prospects for research.

June 2012 - City of London Police's Hydra

The City of London Police is advertising for two Heads of Analysis and Research, one vacancy in its Counter Terrorism and Specialist Crime section, and the other in its National Fraud Intelligence Bureau.

Both positions provide "Strategic and Threat Assessments"; in other words, management information, and statistical analysis, as explained on page 2:

"Extensively research and prepare strategic analysis reports, such as the annual Force Strategic Assessment and the associated Strategic Review. Then presenting these reports to ACPO and the senior management to assist them in their decision-making and the setting of force operational targets and objectives in line with national priorities and local concerns".

This would not be a problem if the job titles described the roles accurately, such as Head of Statistical Analysis and Research, or Head of Management Planning.

But, of course, the job titles are so not clarified, because the City of London Police also wants to use the postholders for case crime and investigations, from page 2:

14 Provide crime and intelligence analysis in sensitive or high level/high priority cases and investigations.

And from page 4:

Prepare analytical evidence for submission to a court of law, including liaison with crown prosecution staff, barristers and court chambers staff and attending court as a witness, if required.

A subtle nuance that suggests that City of London Police realises all is not well is on page 3:

Actively embrace problem solving policing analysis to include hypothesis on causation and recommendations for resolution.

Actively embrace? Imagine a postman's job description that said, "Actively embrace the delivery of letters to householders". Something is not quite right with that expression - what is it?

One of the points made in a previous Telex (October 2010 - Jill Dando Institute gets it wrong, again) is that "analysis" is used to implement hobbyhorses; the result is that every latest fad is imposed on the analyst. Of course, to describe the analysis of crime causation as a fad is unjust; it is important role in its own right. But in the context of it being imposed on intelligence analysts doing their job, it becomes a "fad".

What's the solution?

City of London Police has produced virtually identical job descriptions for two Heads of Analysis and Research, to be employed in different departments, and both doing statistics and crime investigation. City of London Police is therefore making a cardinal error identified previously on this site; confusing what analysts are used for (i.e. counter terrorism and fraud intelligence) as opposed to what analysts are used as (statisticians or investigators).

What City of London Police ought to do is to employ one Head of Statistical Analysis and Research, and one Head of Intelligence Analysis and Research, each to cover both departments. It is as straightforward as that.

May 2012 - Analysts' reporting etiquette #5

Analysts, along with other staff, are sometimes told to use CAPITALS when typing people's names in reports, so that readers can locate them easily. That practice has existed throughout the twentieth century; capital letters were used for emphasis because that was how mechanical typewriters worked. Nowadays, word processors allow bold to be used as an alternative. But whether one uses capitals or bold, the important thing is that names, telephone numbers, car number plates, etc, are emphasized at least the first time they appear in a report, and/or at the beginning of subsequent paragraphs, where they feature prominently.

March 2012 - unForging the links

Her Majesty’s Inspectorate of Constabulary (HMIC) and Her Majesty's Crown Prosecution Service Inspectorate (HMCPSI) have produced a report: Forging the links: Rape investigation and prosecution (locally stored copy). The report examines intelligence gathering across twelve forces with particular regard to “serial and linked offences”, and makes numerous recommendations. The report loses its way, however, on the matter of analysis. The following passages are from page 28:

- the potential links between a number of sex attacks, including rape, which had repeatedly occurred in the same general location on the same day of the week, were identified through detectives talking to each other, rather than by careful analysis.

- a long series of offences, which started with the inappropriate touching of women in the street progressed, with ever increasing severity, towards attempted rape. The offences were allocated to different officers for investigation and were only pulled together when a detective spotted the similarities.

The report is saying that links were made on the off-chance, rather than the analyst working in a “careful” way. To remedy this, the report goes on:

2.16 It is therefore vitally important that local intelligence systems capture the modus operandi in rape cases and sexual attacks. Victims, locations and offenders lie at the heart of intelligence gathering. Without these ingredients, intelligence-led investigation may falter or at best take longer, as police resources cannot be focused quickly enough.

2.17 The rape problem profile is an intelligence tool that, whilst prescriptive, provides a method of ensuring that intelligence relating to rape is drawn down from all available sources (including third parties and charitable organisations such as rape crisis centres), and becomes embedded in the force and local area tasking and coordinating process. Its usefulness, however, is dependent upon the quality and currency of the intelligence provided.

The report makes two recommendations:

Recommendation 1: We recommend that forces should initially consider every ‘stranger’ rape to be part of a pattern of serial offending, so that investigating officers consider the wider links to other crimes.

Recommendation 2: We recommend that forces ensure that their rape problem profiles are relevant and up to date.

An indication of difficulties in the report's understanding of investigative analysis lies in the first paragraph quoted; to repeat (my emphasis):


The report is saying that, since the attacks were in the same general location and on the same day of each week, the series should have been discovered by the analyst. This statement is based on an assumption that the analyst ought to be looking at attacks by area and day. This understanding, however, is at odds with the analyst’s actual starting point, which is the attack itself; working correctly, the analyst should be no more or less likely to identify a series whether it occurs in the same area, or on the same day each week, or not.

Let’s illustrate this with an example; let us say a stranger rapist slaps the victim several times. A potential starting point is to research the database for any sex attacks (non-domestic) with the word “slap” (or similar) in the free-text, over the past few years (at least). Anything fewer than a hundred matches and the analyst may as well skim-read the lot. More than a hundred matches and it may be necessary to refine the search to produce a more manageable list. Essentially, what the analyst is looking for is corroboration, something in the crime reports other than the slapping that also bears a similarity to the original offence; this could be the offender’s description, what the offender said, or something else the offender did. Where and when the offence occurred are also corroborators but, unless and until the analyst decides differently, they are no more or less important than any other aspect of the MO. For all the analyst knows, it may be the rapists' discoloured right thumbnail that identifies the series.

A second clue is in the third paragraph:


"Victims, locations and offenders" is a reference to the Problem Solving Triangle, which is a statistical and environmental approach to understanding crime; it is not an investigative approach to working out who did it.

The same paragraph yields a further clue: "... police resources cannot be focused quickly enough". This is the language of the statistician, who allocates patrols, cars, etc according to crime types and volumes. Now we begin to see why the report is preoccupied with looking at crimes by location and day of the week. But it is not the role of the intelligence or investigative analyst to focus resources, but rather focus attention on a specific offender.

Let’s consider the report’s two recommendations: the first, quite rightly, is that forces should always assume stranger rape to be potentially part of a series; the second is that forces produce “rape problem profiles”, defined on page 7 as (my emphasis):

More robust and detailed problem profiles (as are required under the National Intelligence Model) would allow for a more scientific interpretation of the rise in rape cases and a broader understanding of the nature of offending in communities – whether victims are targeted on a night out, in a domestic setting or trafficked across local or international boundaries.

This shows that rape problem profiles are statistical and sociological in nature, designed to understand sex offences as a whole. The report is therefore confusing statistical and investigative analysis from start to finish, leading it to the assumption that linking attacks involves compiling rape problem profiles and looking inside them for patterns, such as when and where crimes occur. The correct means of linking crimes, however, is the opposite: taking the attack/attacker as the point of reference and undertaking lines of research outwards.

This mistake is why police forces fail to link rapes in the first place, meaning that the report is setting in place the causes of the problem it is seeking to solve.

January 2012 - Starting intelligence development with case crime

It is sometimes suggested that intelligence development is ‘proactive’ when targeting known offenders, but ‘reactive’ when starting with the unsolved crime. This distinction is meaningless; starting with the target and working “forward” to the crime is no different from starting with the crime and working “backwards” to the offender; in both cases, the analyst is trying to link one to the other. Pro-activity is better understood as a state of mind rather than a method; if the analyst is engaged in research which he sees good reason for, then it is proactive. ‘Reactive’ is when research is conducted for no other reason than ticking a box.

Using the unsolved crime to start intelligence development can have six benefits:

(1) For law enforcement to apply, the law has to be broken. There is no point researching individuals if, at the end of the process, there is no crime to charge them with. A crime must be committed, so one might as well start with one.
(2) Crime provides choice: the analyst can come into work each morning and have the overnight and previous day’s crime to choose from; variety keeps the job stimulating, and widens the analyst’s experience.
(3) Results come faster; the analyst can choose the crimes with the best analysis potential, identify similar offences and any likely offenders, and have a report circulated by the end of the week.
(4) The analyst gets to know people in the job; a report linking, say, four offences, sent to the original case officer and copied to the other three, means the analyst is connecting with people who he might not otherwise know. Similarly, the officers are getting to know the analyst.
(5) Cohesion is brought to the organisation as a whole; this is important. One of the biggest moans in law enforcement is that people “do not talk to one another”. The problem is not that people do not want to talk to one another, but that they do not know what to talk about, or to whom. Police forces try to address this with monthly meetings at which people read out summaries of crime in their areas, hoping that somebody sat opposite will cry out in surprise, “We have that problem, too”, whereupon everyone congratulates each other that the “system is working”. In reality, these meetings do not work: a single crime may have ten details; given that hundreds of crimes occur every month, there are thousands of such details. Meetings offer only broad brush summaries, so the details that reveal links are rarely referred to; even if they are, there is no reason why anyone should recognize them. The benefit of analysts tackling crime head on is that they dig for these details, research them, and increase the chances of identifying crime series astronomically. This is what gets people “talking to one another”: analysts identifying matters of common interest and putting the relevant investigative staff in touch with one another. This is not only efficient, but it reduces the frustration and tension that arises when investigative staff are separated by area and unit boundaries.
(6) Putting the crime before the offender prevents pre-determination. Let us imagine we are researching recent thefts of tools from vans. We search the database and turn up five similar crimes from previous years where a suspect was named or an offender convicted. This means we have five suspects to implicate or eliminate; we are open as to which, if any, is the culprit. Let us now imagine we target a known tool thief and then search for crimes matching his modus operandi. Although we discover the recent spate of thefts, we have closed ourselves off to the possibility that there is more than one tool thief. The target is automatically the suspect, but not necessarily the right one.

None of the above should be taken to mean that it is wrong to target individuals from the outset; doing so has its own advantages, may work better for some analysts, or be more effective in some situations. I list the benefits of starting with unsolved crime only to offset the negative and inaccurate description of it as “reactive”.

December 2011 - One database, two accounts

When searching a crime database for similarities in reports, the intelligence analyst will frequently need to look at different crime reports simultaneously. Some databases, however, only allow one report to be displayed on-screen at a time, forcing the analyst to go in and out of reports. Intelligence analysts with such a set up should ask the IT department to arrange two accounts or usernames, so the database can be opened twice, and each version displayed on screen at the same time, and operated independently of the other.

November 2011 - area-based policing and detection do not mix

The U.S. Department of Justice website features an interview with Chief Superintendent Bilson of the Metropolitan Police, who explains the National Intelligence Model to an American audience. The interview can be found by going here, selecting "Perspectives in Law Enforcement" on the left hand side, and scrolling down the list of interviews. What Chief Superintendent Bilson describes is the use of statistical analysis: monitoring crime levels by type, area, time, etc and deploying patrols accordingly. The following excerpt is about 20 minutes in:

In the Model, there are three broad meetings that are recommended. The first is a strategic meeting…once a month, where we look for the latest crime information, trends, patterns, and we set the priorities. The second meeting that we hold every two weeks … we get into the detailed deployments of which areas, which times, which resources are we going to deploy … The third meeting … is the daily management meeting where we review overnight crimes, trends … did we make all those taskings and deployments, and what impact have we had.
So, putting all that to work in Hounslow … we’re focused on problems and deployments right across the range of policing businesses here; so, my patrol officers get tasked, we get to an extent now where we can start to get predictive around where crime might occur, and target our resources in to resolve that.
The emphasis on statistical analysis becomes more explicit in the example cited:
We noticed that, late on in the evenings and at the weekends, we were getting outbreaks of disorder, and we were getting street robbery. We tasked the analysts to get into the crime patterns and information that we had already, and come up with a profile so we understood what was going on. That analysis told us a very clear block of Friday and Saturday evening, midnight to one in the morning, was our hottest time for crime. We were able to deploy resources into the area. We stopped any of the crime by just being a visible presence on the streets and being proactive and stopping and searching people there.
Superintendent Bilson goes on:
A call came in later, from a witness who had seen a suspect in another part of the town; [a] patrol officer was able to get there and arrest him, and once she had got the suspect back to the station, the investigators were then able to reach into the intelligence model, and the analysts provided them with analysis of the linked series, and it resulted in that suspect being charged with a series of offences for street robbery …
A successful example of analysis – not

Let me explain what Supt Bilson is describing: the statistical analysts did their job of describing crime in the area - but then went beyond their competence by playing detective and linking crimes on the basis of similarity. In so doing, they failed, not because their choice of links was necessarily wrong, but because of what they did not link.

Investigative analysis is done by reading a crime report first, and then searching for linked crime reports. The analysts in the above example did the opposite; they collected crime reports by area and time, and then read what they had to assess which were linked.

Understanding this distinction is critical: intelligence analysts take individual crimes as the starting point, meaning their research of MO and suspect descriptions can be taken beyond the locale, and to crimes that occurred months or years previously; parameters are continually adjusted as new information is obtained. This is how crimes are linked and solved – not by looking in a pre-determined area and period, comparing crimes within and concluding that some are linked. They may well be, but such a conclusion can only ever be incomplete, and possibly misleading. If the analyst does not have the instinct to dig and dig, detectives will be left wondering: what else is out there, and how would that affect what we have?

So, the “link analysis” described in Supt Bilson’s narrative is no such thing; the offender was not identified, except for a witness who saw him, quote, “in another part of town”. That point alone illustrates why an area-based perspective is no good for crime detection. The analysis described by Supt Bilson is successful only in its correct context; that of establishing frequency and type of crime in a place or period, in order to establish priorities, deploy resources, and advise on crime prevention measures.

October 2011 - Police Oracle

Police Oracle is a website that supports police and civilian personnel by providing news, law updates, equipment sources and recruitment. Here is their job vacancy search tool, relating to analysis:
The search tool shows only one function of "analyst"; it does not reflect the distinction between intelligence and investigative analysis, and analysis for statistics and planning.

I used the search tool to bring up the current list of analyst jobs; the first I came across was "Traffic Management Planner". The next two in the list were "Intelligence Analyst" and "Intelligence Officer".

Seriously, folks, how can the management of traffic be regarded as the same category as criminal intelligence and investigation? I have written to Police Oracle the following, and will update this entry with their reply:
"On using the job search tool, I discovered that Police Oracle has only one category for 'analyst'. This is incorrect, since there is no single job of 'analyst', but two: intelligence (or investigative) analysts, and analysts involved in management, planning and statistics. Consequently, when I tried the 'analyst' search option, it brought back matches of Traffic Management Planner and Intelligence Analyst, even though one is not comparable to the other. Please could Police Oracle consider two categories of 'analyst': intelligence/ investigative and statistical/planning, to avoid confusion".
September 2011 - Analysts' reporting etiquette #4

Given the practice of "tasking analysts", an intelligence analyst may wonder: if I am doing my own intelligence work, what reason do I give? How do I explain myself?

The answer is to start one's report along the following lines: "This report represents research into a burglary in Anytown on 14 August 2011, reference C1234/11".

That's it. An analyst does not justify their right of choosing a subject for analysis; they exercise it.

August 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 4 of 4

Last month's Telex concluded by asking: why does IACA feature intelligence analysis on its website; why does it want crime statistical analysis and crime intelligence analysis to come together? A clue to the answer is the sentence highlighted below, from the IACA article How does Crime Analysis differ from Intelligence Analysis (for the article in full, see my entry of May 2011):

In recent years, however, some members of both professions ... have begun to question whether the functions, skills, and processes of crime analysis and criminal intelligence analysis are really different enough to justify two distinct professions. There are analysts at one extreme who believe strongly that the professions are separate and should remain so, and there are those at the other end who think there should be no distinction at all.

The sentence is saying that the analyst community is divided in its views. Such a division would seem, on the face of it, inexplicable; how can a group of analysts, who are presumably all thinking people, have opposite conclusions on the same thing?

Before I offer an explanation, consider the following scenario:

A senior police manager decides to clarify the function of intelligence analysts, and so declares that their role is to look at offenders, not crime types. This instruction gets handed down to supervisors as "intelligence analysts look at offenders, not crime" which, in turn, gets passed to analysts as "Stop looking at crime reports, you should be looking at offenders".

This scenario, based on a real example, shows how misinterpretation of words can have the reverse effect to what is intended. The senior manager refers to crime types but, by the time his instructions reach the analysts, his words are assumed to mean crime cases; this is because, in an intelligence environment, where the instructions are being applied, this is the natural interpretation. Were analysts to comply with the instructions as relayed, they would spend all their time looking at personal offender details (where offenders live, who they associate with, what cars they own, etc), none of which would be actionable, since it does not include the crimes the offenders are supposed to be doing. Which, of course, is not what the senior manager meant.

Returning to the apparent divide between analysts who support, or oppose, the combining of statistical and intelligence analysis, I suggest that this is what is happening:

- To define and protect themselves, intelligence analysts emphasise that they look at offenders, not crime types.
- IACA and others hear this as "we look at offenders, not crime" and think, surely, to make meaning of the information, analysts must look at both.
- But IACA's assumption is based on a false premises; that, since statisticians exclude offenders from their analysis of crime, intelligence analysts must do the reverse; exclude crime from their intelligence work.
- But intelligence analysts do not exclude crime; the distinction between the two professions is that intelligence analysts use offenders as the frame of reference, whereas statisticians do not. It is a question of perspective, not subject matter.
- Therefore, any attempt to import crime (statistical) analysis into intelligence analysis is destructive to the latter.

This explains why there are analysts who believe that the professions are separate, and why there are those who think there should be no distinction at all. This is not a divide as such, but a monumental misunderstanding on the part of the latter. There is not, and never can be, a continental drift-like coming together of the intelligence and statistical analysis communities. Any perceived overlap will always, on close examination, be revealed to be square pegs in round holes, and vice-versa.

Fortunately, the means by which analysts can determine which of the two professions they belong to is very simple. If an analyst is looking at actual offenders, actual crimes, actual victims, actual vehicles, actual stolen property, and so forth, then it is intelligence work. If the analyst is looking at offenders, crimes, victims, vehicles, etc by category, then it is statistical. It is as easy as that.

July 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 3 of 4

IACA's feature What Crime Analysts Do (cache) lists five functions, three of which are statistical, one is intelligence, and one is split. This comment will focus on the two with an intelligence element.

The above is almost entirely statistical in content except for two words: "Series" (in the title) and "who", in the concluding paragraph. If these two words are omitted, the function would read just fine as an example of statistical analysis, referring, as it does, to trends and hotspots, etc. How then, does the identification of crimes series get included? Focus on the second sentence: "If a burglar starts targeting drugs stores in your jurisdiction, a crime analyst will let you know on the second incident".

To understand why this understanding of linking crimes is wrong, consider how crimes are linked in practice. First, crimes occur. The intelligence analyst reads the reports, selects one that is researchable, and researches the MO, suspect description, etc against existing information. The analyst selects previous crimes that are believed to link and, in so doing, identifies a possible linked series and offender (the latter if not by name, then by method). The analyst is thus linking crimes from the past to those in the present. The analyst is then able to identify future crimes in the series, because he knows what he is looking for.

Now, consider again IACA's version of how to identify a crime series: "If a burglar starts targeting drugs stores in your jurisdiction, a crime analyst will let you know on the second incident".

What is happening is this: IACA, run by statisticians, is looking at crime in terms of categories (burglary, drugs stores, jurisdiction) into which new offences can slot. Thus, the selection of crimes is automatic and self-fulfilling. Grouping crimes in this way is suited to statistical analysis because it is how analysts identify "problems and trends"; in this case, an increase in burglaries at drug stores in a particular jurisdiction. From this, police management can launch counter-measures, such as targeted patrols and crime prevention initiatives. But this is not how crimes are investigated or crime series identified. Crime investigation starts in one way only, and that is by reading the crime report; from that instant, all pre-determined categories cease to have relevance, because the individual crime, and thus the offender, becomes the category.

Here is IACA's second function pertaining to intelligence:

IACA commences, "Intelligence is special information that..." Stop right there. The reference to "special information" places IACA's definition of "intelligence" in the cloak-and-dagger realm of source information, surveillance, and so on.

The problem is this: if IACA regards "intelligence" as the collection of information, special or otherwise, then where does that leave actual intelligence, that is, the integrated picture formed by the links that join the information? IACA does not know, because it does not acknowledge the relevance of investigation.

Intelligence is formed by linking, and linking is driven by investigation. No investigation, no linking; no linking, no intelligence. Investigation is the element that is absent from IACA's thinking, and this is brought into focus in the final paragraph:

This is not what charting is about. The purpose of link charting is to enable analysts to understand progress arising from investigations that they are conducting, alongside the investigating officer. Doing a link chart to show known relationships misses the point; the analyst should be discovering relationships as they explore the information. It is the discovery of new relationships that is the analyst's objective, not displaying old ones. Ditto, IACA's suggestion of producing charts for court presentations; while it is important that intelligence is available to counsel and jury in the form of charts, this is a presentational matter that is addressed when the analysis is finished.

And let's read once more the sentence cited earlier: "If a burglar starts targeting drugs stores in your jurisdiction, a crime analyst will let you know on the second incident". So, IACA does not understand the relevance of investigation to identifying crime series, either.

Blindness to the investigative element compromises IACA's ability to understand intelligence analysis, and explains why it presents intelligence analysis as "special information" and/or an extension of statistical analysis. Neither definition is correct, nor is each compatible with the other.

How to undo this? The means is to extract the references to "crime series" and "who" from the function on "crime series, trends, etc" and place them in the "intelligence" function. Once that happens, the two components will integrate, and reveal intelligence to be the examination of both individuals' actions and associations, formed by linking crime to crime, crime to person, person to person, and all the many permeations, such as person to car, car to address, to bank account, to mobile phone, and from specific phones call back to one or more crimes. This new understanding will inevitably mean that IACA's notion that intelligence is related to statistics will have to be dropped.

It will also force the question: why does IACA feature intelligence analysis on its website at all, given that its original remit was to represent crime statisticians. Is it launching some sort of land grab? An explanation will be offered next month.

June 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 2 of 4

The previous entry argued that IACA's attempt to reconcile crime analysis and intelligence analysis was flawed. This entry will explore this further with reference to its feature "What is Crime Analysis?" (cache).

There is a potential problem with the question "What is Crime Analysis?" or, to be more precise, the term "crime analysis" itself. Crime analysis can be taken to refer to two different things: categories of crime (statistical analysis) or actual or individual crime (intelligence analysis). Confusion can be avoided so long as everyone knows which of the two meanings is being used, and sticks to it; in the USA, crime analysis has historically meant statistical analysis. Unfortunately, IACA has forgotten.

When we look at IACA's above list of analytical tasks, the first we see is solve crimes; this is not statistical, because it relates to an actual or individual crime. The third task on the list is find and apprehend offenders, which is another way of saying solving crime, and so is the fourth task, prosecute and convict offenders. So, tasks one, three and four are intelligence analysis.

In contrast, six of the eight remaining tasks involve planning, resource allocation and crime prevention, and so fall into the statistical camp of analysis. To take each in turn:

- Strategies and tactics to prevent future crimes; an analyst concerned with preventing crime per se does not seek out individual offenders, but looks at the environment to establish why criminals collectively might target it, and then proposes preventative measures.
- Improve safety and quality of life; in terms of perspective and skills, this is similar to crime prevention.
- Optimise internal operations; this is a management/planning function and depends on analysing crime and other demands by quantity.
- Prioritise patrol and investigation; prioritising patrols is a derivative of "optimising internal operations", while prioritising investigation is political, and depends on what sort of crime is perceived as important; that depends on assessing attitudes, which is again statistical.
- Detect and solve community problems; this is strangely worded. The task is not described as "detect and solve community crime", which would be intelligence analysis, but "problems", and so is aligned with crime prevention and optimising operations.
- Plan for future resource needs; again, part of optimising operations.

The final two tasks on IACA's list (enacting policies and educating the public) are auxiliary or supporting skills, which are not analytical in nature. These two aside, therefore, all the tasks on IACA's list can be categorised as either statistical or intelligence. In fact, there are no analytical tasks that cannot be categorized as one or the other. If IACA understood this, it would have two lists, not one.

This mixing of two professions does not appear to be unintentional on IACA's part for, elsewhere on its website, it gives prominence to the following statement:

The quote says that the responsibilities of intelligence analysts and planning/management analysts "similar" and that they are different titles for one profession of crime analysis.

The statement is extracted from the report Enhancing the Problem-Solving Capacity of Crime Analysis Units, which can be downloaded here. What is apparent on reading the report is that it has no relevance to investigative or intelligence analysis; indeed, its introduction explains:


So, despite acknowledging its non-relevance to intelligence work, the report states, in a manner that could be construed as cavalier, that intelligence analysis is just a different job title for management and planning analysis. The report thereby exemplifies a problem that is seen elsewhere: that discourse on intelligence analysis is frequently commandeered by people who don't actually do it, who don't know what it is, yet who freely lay claim to it as an extension of statistics. The result is the drawing up of "shopping lists" of analytical tasks and skills, such as that on the IACA website, that make no distinction between the two professions and, worse, present the two as one.

I will go more into the mechanics of this, next month, with reference to IACA's feature on "What Crime Analysts Do".

May 2011 - International Association of Crime Analysts - not seeing the wood through the trees - Part 1 of 4

One of the main themes of is how the distinction between intelligence and statistical analysis is confused because of language; for example, in the UK, statistical analysis is referred to as strategic analysis, which confusing because strategic is a level of analysis, not a type.

The United States has a similar problem: statistical analysis is referred to as crime analysis, which is potentially confusing because it could also be taken to mean intelligence analysis, that is, investigation of an actual crime.

The U.S. based International Association of Crime Analysts (IACA) recently tried to undo this confusion with the article copied below. Readers should read it all the way through and come to their own conclusions, before reading my own comments, underneath.

NB: shortly before I was due to upload this entry, the IACA page was removed, so it may not now be representative of IACA's views.

How does Crime Analysis differ from Intelligence Analysis?

In the United States, crime analysis and criminal intelligence analysis have for most of their histories been considered distinct professions. Criminal intelligence analysis traces its history to military intelligence techniques and their application to domestic "enemies" such as drug cartels, extremist groups, and organized crime. Crime analysis is more rooted in the concerns of local law enforcement, crime reporting, problem-oriented policing, and community policing. Though they have always shared some common ground, they developed on separate tracks. The literature of each discipline rarely mentions the other, and both have their own international professional association: the International Association of Crime Analysts (IACA) and the International Association of Law Enforcement Intelligence Analysts (IALEIA).

In recent years, however, some members of both professions - and both associations - have begun to question whether the functions, skills, and processes of crime analysis and criminal intelligence analysis are really different enough to justify two distinct professions. There are analysts at one extreme who believe strongly that the professions are separate and should remain so, and there are those at the other end who think there should be no distinction at all.

Most analysts working for medium or small police agencies will likely perform all types of analysis, no matter what their titles. For such analysts, the perception is naturally strong that crime analysis and criminal intelligence analysis are part of the same profession.

To the IACA's perception, the difference between a crime analyst and a criminal intelligence analyst (and, to some extent, the difference between the IACA and the IALEIA) lies primarily within the missions of the agencies that employ them. Most criminal intelligence analysts seem to work for state, national, international, or special-purpose agencies in which the mission is the investigation, apprehension, and prosecution of offenders. There are also a number of intelligence analysts working in investigative units of large police agencies, in which the unit's mission is also apprehension and prosecution. Criminal intelligence analysis is thus primarily an investigative process.

Most crime analysts, on the other hand, work for local police agencies, where the mission is not so much to capture and convict offenders as it is to reduce crime and disorder through multiple strategies (of which apprehension is one). Crime analysis is primarily a problem-solving process.

It makes sense, then, that in countries other than the United States, where most police agencies are fairly large and the distinctions between different governmental "levels" are less severe, analysis units perform all types of analytical work. This likely accounts for the position of non-U.S. analysts that there is little or no distinction between the two.

The IACA's position is that crime analysts and criminal intelligence analysts share common tools, techniques, and skills, but different audiences, products, and goals. Thus, the traditional model makes sense to us: crime analysis and criminal intelligence analysis are related-but not identical-disciplines, existing side-by-side under a common banner.


Note the attempt to define intelligence analysis and crime analysis:


Seeking to clarify definitions by referring to historical experience is flawed; consider the above paragraph in a different context:

Circles trace their history in wheels and mills, and their application to modern machines and motors. Squares are more rooted in furniture and buildings, such as tables and chairs, and windows, doors and rooms.

Such a statement can be true, but one does not define a shape by reference to what it is used for, but by reference to what it is. Circles are round, and squares have four sides. In the context of data, there are two types of analysis; that which concerns actual people, places and events, and that which concerns categories of people, places and events. These two disciplines do not need to be justified; they just are.

Instead of assuming these definitions as self-evident, IACA seeks to discover them by looking at (in the first paragraph) what analysts are used for, (in the fourth and fifth paragraphs) the locations at which they work, and (in the penultimate paragraph) the levels at which they are used. All this is unnecessary and distracting.

Happily, the article reaches the correct position in its fourth and fifth paragraphs:

Criminal intelligence analysis is thus primarily an investigative process ... Crime analysis is primarily a problem-solving process.

Correct. There are analysts employed as investigators (usually called intelligence or investigative analysts) and there are analysts are employed as statistical analysts (also called problem-solvers, crime analysts or strategic analysts; take your pick). What is the relationship between the two? None, there isn't one, and IACA makes no case that there is; but instead of leaving it there, IACA adds:


Sounds like a fudge. IACA acknowledges that the two functions have "different audiences, products, and goals" (correct) but that they share "common tools, techniques and skills", which is incorrect (since when did statisticians and investigators share tools, techniques and skills?). It says crime analysis and criminal intelligence exist "side-by-side under a common banner"; no, they don't: crime analysis exists alongside crime prevention, management planning, resource allocation and partnership; intelligence analysis exists alongside detection, forensics, informant handling, surveillance and prosecution.

Given that the text has been removed from the IACA website, it may no longer represent the Association's standpoint, but there is much more on the IACA website of a similar nature. The next few entries of this Blog will examine examples, and then try to work backwards to explain why IACA should attempt the above explanation of the difference between crime analysis and intelligence analysis.

1 April 2011 - about Tasking

i) Where tasking fails

Imagine an intelligence analyst’s job as a sheet of paper. Analysts are free to explore what is on that paper. A tasking is when someone puts an item on that paper, and says, “Investigate this”. Although the analyst undertakes the tasking, it is not their underlying job. The tasking is in addition to the analyst’s function of exploring and self-tasking. Even if the tasking is a year-long investigation, covering 99% of that sheet of paper, the relationship between the base job and the tasking does not change.

Where tasking fails is where it is assumed to be the job itself; i.e. the underlying sheet of paper is thrown away, allowing the analyst to undertake only what is left. Suddenly, the analyst is no longer able to explore and develop intelligence freely; they are restricted and this conflicts with the investigative outlook and initiative that analysts are expected to possess. Although tasking is said to make analysts more effective, analysts who do only taskings will do those taskings less effectively than those who are free to do self-tasked work alongside, since only the latter are able to think and operate fully like analysts.

Supervisors who do not understand this hover round the analyst’s desk, asking, “Why are you doing work for which you have not been tasked?” So long as the analyst’s work on formal taskings is proceeding satisfactorily, it is no-one else’s business why the analyst is doing additional work. Intelligence analysts are employed for a reason, which is to develop actionable intelligence; the analyst does not need permission to do this. This goes double for when a newly appointed manager says: “No more analysis until we have decided our new priorities”. Such pronouncements have no basis, and can be ignored.

ii) Why self-tasking succeeds

If an intelligence analyst is confronted with ten overnight crimes, it will be clear which one is most suited for intelligence analysis. This is the one with the most researchable data. The analyst can get straight to work. With experience, the analyst can get a feel for what will be achieved by the research before he or she has even started.

If the analyst is tasked by others to look at one of those ten crimes, the selection will be for reasons other than analytical suitability; for example, a crime which is of a type prioritised by the force. No matter how laudable these reasons are, they are political, and bear no relation to the analysis potential. Consequently, there is a ten-to-one chance that the crime chosen will be the one most likely to get a result.

Analysts need to understand that taskings reflect needs of other people in the organisation. But people raising taskings also need to understand the effect on the analyst’s productivity. There is no quicker way to reduce the output of analysis than through endless taskings. Self-tasking is invariably more successful, because the analyst instinctively gears it to getting a result.

1 March 2011 - “Lateral thinking”

I want to add to my posting of 4 January 2011 on training and recruitment (below). I once investigated distraction offences where males offered to do work on the outside of buildings; they made reference to “putting up scaffolding”. While researching, I came across another distraction involving females offering to do “wallpapering”. Since offender description and modus operandi were different, I saw no reason to link them; in fact, I saw reason not to link them: women are not men, and wallpapering is not scaffolding. Period.

However, the officer in the case pointed out to me that women would not be expected to work on scaffolding; they would instead do the female equivalent, such as work on the inside of the building. Suddenly, the idea of women offering wallpapering being linked to men offering scaffolding seemed very plausible.

Looking at something from a different perspective, and coming to an alternative conclusion, is what is referred to by "lateral thinking". The two crimes did not match when compared in the usual way, that is, directly. But the conflict in the MO and descriptions was resolved when the relationship between the two groups was considered.

The difficulty with lateral thinking as a concept is that there is no button inside one’s head that can be pressed to activate it. One does not say, “Okay, I can’t find the answer, so I’m now switching to lateral thinking”.

The reason why the detective saw the connection that I missed was experience. Experience is how investigators and analysts acquire the ability to make links that are not immediately obvious: undertaking investigative research, skim-reading a lot of crime reports, thinking like a detective.

Training courses that seek to train analysts in “lateral thinking” are therefore missing the point; they need to train the intelligence analyst to think like an investigator, and the lateral thinking will follow naturally.

15 February 2011 - Analysts' reporting etiquette #3

Intelligence analysts discover things; the pieces of information they rely on may be old, but what they discover - linked information, i.e. intelligence - is news. After the analyst has reported to the case officer, he or she will probably report to a regular management meeting. The case officer will not usually be at that meeting, but his area sergeant or supervisor will be.

If the analyst's report is specific and actionable, the analyst should inform the sergeant of its findings before the meeting. This is because the sergeant will want to be seen to be aware of what is happening on his patch in front of others, particularly if the meeting's chairman, perhaps his superior, is likely to fire a question at him, such as: "What are you doing about the analyst's discovery?" The sergeant will not want to be on the back foot.

So, while updating meetings is part of a formal process, give a thought to who might like to know, beforehand.

1 February 2011 - when statistics is not statistics

Before Christmas I met an intelligence analyst who said that statistics was a very useful tool in investigation and intelligence. I asked for an example. He explained that in credit card fraud prevention, software programs use algorithms to measure frequency, volume, etc, thereby flagging up potentially suspicious uses of credit cards. For instance, the program would recognize payments on a credit card – normally averaging £50 a day and on spent local purchases – rising to £5,000 a day and sent to a foreign bank account; this would trigger an alarm.

My analyst friend is mistaken; this is not statistics, because the computer program is not monitoring transactions en bloc, but transactions per card. Calculations therefore regard actual transactions compared against the card’s own history, and/or against (the average of) actual transactions on other actual cards. In other words, transactions are not swimming around, unassociated, in a database, but are linked to cards and/or people from the outset.

Software programs that monitor mobile phones operate on the same principle: every one of billions of phone calls is linked to a handset or sim card via the billing or telecommunication process. The mathematics employed in these algorithms is wholly different to crime statistics such as hotspots where crime and disorder is unlinked and consequently grouped under other criterion not related to a person. So, the two uses of mathematics are not comparable.

4 January 2011 - the other problem with intelligence analysis training and recruitment

This site has pointed out the chief flaw in recruitment and training for intelligence analysis, which is the attempt to mix two unrelated fields, intelligence and statistics. But there is another flaw, relating solely to perception of intelligence.

Intelligence analysis is commonly said to be about the following:

- inference development
- cognitive reasoning
- deriving meaning
- logical thinking
- lateral thinking
- critical thinking
- creative thinking
- hypothesis generation
- “analysis”
While none of these descriptions is strictly wrong, they are associated with disciplines such as science and computation, even philosophy, and give the impression that analysts are doing something clever, brainy or academic. Job advertisements often insist on the need for academic ability by limiting applicants to those with degree level qualifications.

I am going to explain, in one paragraph, why intelligence analysts need be no smarter than anyone else. An analyst does not look at a piece of information, A, and derive more meaning than the next person. What the analyst does is to search a database in relation to A, finds B, and then looks at A and B together. Greater understanding develops as a result. An analyst’s insight does not flow from intellectual ability, but from asking a series of questions and piecing together the answers.

Expressions like “cognitive reasoning” are misplaced because they portray the analytical process as a mental one rather than a merely mundane one; they place analysts under an expectation to exhibit super-intellectual abilities, which can cause analysts to ask in exasperation: "…but what do I actually do?”

Training courses veer from teaching nebulous intellectual concepts at one end to narrow mechanical tasks at the other: commodity flow charting, financial profiling, association chart construction. The result is that analysts produce charts which, while technically perfect, have a stale air about them. Something is missing from the analyst’s approach. Training courses recognize this and try to provide the missing element by combining the chart with the intellectualism, encouraging analysts to ask the following type of questions:

- What is the hierarchy of the organisation?
- Are the links changing in strength or centrality?
- Are certain entities connected to other entities to the exclusion of the others?
- Who forms a bridge or liaison between distinct organisations?
- What sequences of interaction can be seen?

This approach does not work, because such questions are designed to see “depth” in linked information. The fault is this: analysts will know the significance of linked information because they were the ones asking the questions that led to it. The issue for trainers is therefore: how to get trainees to ask questions that seek out linked information in the first place.

[The previous paragraph is important; please re-read it until it sinks in]

The only way to ensure that trainee intelligence analysts ask the right questions is for trainers to regard them as investigators from the outset; to say to trainees: you are detectives, so think like detectives, find out what happened, and who is responsible. This recognition is critical, because it provides words like ‘hypothesis’ and ‘inference’ with a context, and therefore meaning. Without this context, training courses are rudderless, and so are their trainees.

Contrast training courses in intelligence analysis to those which need not feature the word ‘analysis’ in the course title, such as telecoms, financial and internet investigation courses. These courses represent the most complex investigations that analysts are likely to undertake, yet are devoid of references to “cognitive thinking”. These courses do not try to teach trainees how to think (thinking being an assumed ability) but instead limit their attention to teaching practical skills on how to link A to B.

So, there are two steps that need to be taken to correct intelligence analysis training. The first, as explained elsewhere on this website, is to de-mix it from statistical analysis, and to get terms such as “patterns and trends” out of intelligence analysts’ heads.

The second is to eliminate the emphasis on intellectualism. The success of telecoms, internet and financial courses suggests that training courses in intelligence analysis would be more effective if trainers stopped trying to think of “analysis”, and more in terms of “investigation skills for the computer-based detective”. A ten-day course on the typical questions and lines of enquiry that analysts need when investigating the common crime types - linking crime to crime, crime to person, person to person, and all the permeations - would be infinitely more useful than modules on “problem-solving triangles”, and the like. Analysts would return to their forces, armed with a set of practical skills, and know exactly what to do.

See here for Telex's in 2010
eXTReMe Tracker