The Intelligence Cycle is a method of processing material in order that it can support and inform decision making. The Intelligence Cycle is a cyclical and sequential process that allows information to be developed into intelligence. The NIM uses this process in directing police resources from a prevention, intelligence and enforcement perspective. This process can also be applied when supporting SIOs in major incidents.
In the context of major incidents, the Intelligence Cycle elements can be defined as follows:
Direction The initial task or objective.
Collection Gathering of information from all material sources to support the task or objective.
Collation The organisation of material in a meaningful format.
Evaluation The consideration of relevant material; assigning of value to information; inclusion of material to support an initial task or objective.
Analysis The drawing of conclusions and inferences with recommendations and intelligence gaps highlighted.
Dissemination The method of communicating the results of the intelligence process.
Direction The change or continuation of a line of enquiry, strategy or similar, depending on the results of the intelligence process.
FIGURE 1 The Intelligence Cycle
Collection
Collation Analysis
Dissemination
Direction
Evaluation
35
THE INTELLIGENCE CYCLE
While this is a sequential process, some elements may occur out of sequence. For example, collection of material is likely to be an ongoing process and, therefore, may continually interrupt the cycle. A new piece of collected data may require immediate collation and evaluation. The order of subsequent intelligence cycle stages is not altered by this. The need to continually collect and collate emphasises the importance of the researcher role. Where the Researcher can support the Analyst through continual collection and collation, the Analyst can progress the evaluation and analysis stages, using timely information to inform their work.
Additionally, the evaluation stage may occur independently. The generation of hypotheses through brainstorming processes can be a catalyst for the start of a new cycle. The Analyst and Researcher can add value to the process of testing hypotheses against evidence.
Applying this intelligence-led process to major incidents will result in them being better focused and cost effective.
The following sections represent the elements of the intelligence cycle within a major inquiry and guidance is provided as to the detailed role of the Analyst and Researcher within each of these stages.
NOT PROTECTIVELY MARKED Major Incident Analysis Manual (Revised Edition) © ACPO Centrex 2006
NOT PROTECTIVELY MARKED Major Incident Analysis Manual (Revised Edition) © ACPO Centrex 2006 37
SECTION 6
Section 6
DIRECTION
T
his section describes the direction phase of the Intelligence Cycle. It specifically refers to the methods by which analysts and researchers should be tasked; the importance of clear, accurate and specific tasking that is aligned to the SIO’s objectives and, therefore, how analysis is generated.The issues surrounding the use of Terms of Reference and the SIO’s Policy File to ensure analysts are being used correctly, and the generation of further actions through analysis are also discussed.
CONTENTS
6.1 The Direction Phase . . . 38 6.2 Terms of Reference . . . 38 6.3 Actions and HOLMES 2 . . . 39 6.3.1 Tasking . . . 39 6.3.2 SIO’s Policy File . . . 39 6.3.3 Proactive Generation of Tasks through Analysis . . . 40
6.1 THE DIRECTION PHASE
The direction phase involves setting tasks and actions at both the strategic and tactical level. The effective tasking of analysts is a key factor in the success or otherwise of analytical products produced during a major incident. The lack of clarity and detail of tasking often means that the Analyst has a lack of understanding with regards to the objectives of the analysis. This can result in the production of analytical products that do not address the SIO’s requirements. The establishment of terms of reference for analyst work is, therefore, fundamental to the provision of effective analytical support.
6.2 TERMS OF REFERENCE
The Analyst should discuss the exact requirements and objectives of the analysis with the SIO and agree initial Terms of Reference. The Analyst Manager may be involved in this process.
When discussing Terms of Reference the SIO and the Analyst should consider each issue or line of enquiry and decide the best analytical product to address it. It is essential that the provision of analytical products is aligned to the SIO’s objectives.
Products should also be described in terms of the NIM analytical products.
The Analyst should also advise the SIO on issues such as viability and timescales and assist the SIO to prioritise the most productive analytical course of action. The SIO must balance the need for a rapid response with the need to consider the best product available.
Only the SIO (or Deputy SIO, Senior/Lead Analyst) should be authorised to task the Analyst. This will ensure that analytical work is properly focused to the objectives of the investigation.
Regular reviews should be carried out to ensure the work of the Analyst remains focussed and the Terms of Reference should be updated as the investigation proceeds and new analyst tasks are raised. Dependant on the length of the enquiry, it may be advisable for the Senior/Lead Analyst to establish a timely meeting structure with the SIO to conduct these reviews.
Examples: Appendix 1 – Terms of Reference 1
The Analyst Manager may wish to develop a more detailed strategy that will enable them to track work flows and ensure that material is delivered in an efficient and coherent manner.
39
DIRECTION
6.3 ACTIONS AND HOLMES 2
6.3.1 TASKING
The Analyst should receive a written action prior to commencing analytical work.
This will avoid duplication and prevent compromising other aspects of the investigation. Given the Analyst’s role within the management team, the SIO (or Deputy SIO in their absence) will often allocate actions directly to the Analyst.
The Researcher may have discrete research tasks which are defined through Actions, however, they may also have a supporting role to the Analyst and may then work on specific tasks to facilitate the analysis. In either case these Actions should be recorded.
All Actions should be recorded on HOLMES 2 so that they can be audited and reviewed at a later date. There may be occasions where operational necessity makes it impractical to issue a HOLMES 2 Action prior to starting analytical work. In this situation the analytical tasking should be recorded accurately and always followed up retrospectively with an action on HOLMES 2.
In the case that an investigation is not recorded on HOLMES 2, a paper tasking system should be maintained via the MIR, allowing for all actions and other material to be clearly audited.
The Analyst and Researcher should seek further clarification regarding Actions, where necessary, and must not be afraid to negotiate the task in order to ensure an appropriate product is produced. This should be done in consultation with the SIO and can take place prior to Actions being recorded on HOLMES 2.
6.3.2 SIO’S POLICY FILE
The SIO’s policy file should document the appointment of the Analyst and detail the Terms of Reference agreed between the SIO and the Analyst.
The policy file should indicate the main lines of enquiry or decisions that analysis has contributed towards. The Analyst’s recommendations and subsequent actions taken (or not) should be clearly recorded in the policy file. They should also be recorded in the Analyst’s notebook/rough book as well as the report detailing the analysis.
The policy file should be periodically reviewed to ensure that any changes are reflected in the analysis to maintain links to the lines of enquiry.
The policy file is a point of reference for the Analyst enabling them to see the SIO’s decisions and ensure that their analytical product reflects accurately the SIO’s strategy. It will also contain details of the intelligence and analytical strategy adopted, together with the SIO’s prioritisation of lines of enquiry.
NOT PROTECTIVELY MARKED Major Incident Analysis Manual (Revised Edition) © ACPO Centrex 2006
6.3.3 PROACTIVE GENERATION OF TASKS THROUGH ANALYSIS
In line with the Analyst’s and Researcher’s role profiles every postholder is expected to be able to apply innovative thought processes. The generation of new approaches to analysis and research will enhance the delivery of analytical support to the SIO.
The Analyst and Researcher should apply their initiative and negotiation skills when discussing the scope of their work with the SIO and throughout the inquiry.
All self-generated tasks should be discussed or negotiated with the SIO and recorded in the same manner as directed tasks.
NOT PROTECTIVELY MARKED Major Incident Analysis Manual (Revised Edition) © ACPO Centrex 2006 41
SECTION 7
Section 7
COLLECTION
T
he collection phase of the Intelligence Cycle is covered in this section of the manual. Explanations of open and closed data sources are provided along with extensive examples of other useful data sources within these categories. The importance of evaluating the reliability and validity of this information is discussed along with the need for effective document and information management. The issue of exhibit handling is also examined with emphasis given to the importance of adhering to strict rules when handling exhibits.CONTENTS
7.1 The Collection Phase . . . 42 7.2 Closed Data Sources . . . 42 7.2.1 HOLMES 2 . . . 42 7.2.2 Force Systems . . . 46 7.2.3 Police Departments . . . 49 7.2.4 Outside Contacts (National) . . . 50 7.2.5 Outside Contacts (Local) . . . 56 7.3 Open Data Sources . . . 57 7.3.1 Evaluating Open Data Sources . . . 60 7.4 Schedules . . . 60 7.5 Note Taking . . . 61 7.6 Storage and Document Management . . . 62 7.6.1 Physical Storage . . . 62 7.6.2 Electronic Storage . . . 62 7.7 Exhibit Handling . . . 63 7.8 Scene Visits . . . 64
7.1 THE COLLECTION PHASE
The Murder Investigation Manual stipulates that:
‘…analysts should be allowed unfettered access to investigative material’ and
‘…should enjoy the full confidence of the SIO.’
ACPO (2000) Murder Investigation Manual
The collection of all material is essential to an investigation and the Analyst and Researcher should actively seek further data sources ensuring SIO awareness. While the Analyst will predominately handle material that has been collected by others and is going through the HOLMES 2 system, there may be data sources that are generated through analytical work and research. Such material should be immediately directed to the MIR and logged accordingly.
Where an analyst is directly involved in purely covert intelligence analysis, the sterile corridor should be maintained and the Analyst should not be party to the raw collected product.
The collection process will involve both open and closed data sources:
• Closed source data is that which is not readily available. This is often contained within specific databases or systems within the law enforcement and multi-agency environments;
• Open source data is that which is available to any member of the public. This can be in both paper and electronic format.
7.2 CLOSED DATA SOURCES
Within a major investigation, closed source data will often represent the primary material used by analysts and researchers. Key systems, for example HOLMES 2, will contain the material supporting the investigation. Additionally, such systems may also highlight other data sources that are held elsewhere, for example exhibits, CCTV footage and documents.
It should be noted that not all major inquiries are recorded and managed on HOLMES 2. Paper systems will sometimes be used, depending on the nature and scale of the inquiry. In this situation, the HOLMES 2 naming conventions will still apply.
7.2.1 HOLMES 2
The HOLMES 2 system links each of its data source elements thereby allowing the Analyst and Researcher to link to other records while in one data source. It is important that the Analyst and Researcher receive sufficient training on the HOLMES 2 system. The most common Closed Data Sources are in Table 4.
NOT PROTECTIVELY MARKED Major Incident Analysis Manual (Revised Edition) © ACPO Centrex 2006
HOLMES 2
Data Source Features
43
COLLECTION
Actions Denoted as A1, A2, A3, etc
An Action is a written instruction to carry out a task. They are generated from information gathered during the investigation. Actions are raised once authorised by any of the following:
• SIO;
• Deputy SIO;
• Office Manager;
• Receiver;
• Document Reader.
Actions will detail the specific course of action, who it has been allocated to and its provenance.
These may help to identify previous courses of action and, therefore, inform the Analyst’s recommendations as to future courses of action.
Category Index This index is used to record a wide range of information which will not fit into any of the other indexes. Creating category records requires a structured approach in order to assist the retrieval of material.
Sub-indexes are also used to deal with information regarding scene(s), victim(s) and suspect(s).
Documents Denoted as D1, D2, D3, etc.
Documents may be items such as copies of exhibits, letters, police rough books.
They may be held in HOLMES 2 in full or referenced as a description.
Electronic Transmission Denoted as T1, T2, T3, etc.
Electronic transmissions, such as faxes and emails, can be registered to any index.
Exhibits Denoted as X1, X2, X3, etc.
It is also possible to search on HOLMES 2 via the Witness Reference field.
This contains the initials of the person producing the exhibit and a sequential number based on how many exhibits they have produced, eg, KFS/2.
In most circumstances, exhibits will be held in a secure store managed by an appointed officer.
HOLMES 2 will contain a description of the exhibit.
Regulation around handling of exhibits should be adhered to.
House-to-House (HtoH) HtoH questionnaires are given a number by the HtoH coordinator and Questionnaires are not automatically numbered by the HOLMES 2 system.
The HtoH questionnaire is registered to the nominal record of the person interviewed.
TABLE 4 HOLMES 2 Closed Data Sources
HOLMES 2
Data Source Features
Interviews Denoted as Y1, Y2, Y3, etc.
Letters after the number, Y1a, will indicate further interviews by the same nominal.
Interviews are a record of an interview with a person, either a suspect, victim or witness. They can be:
• Audio taped;
• Video taped;
• Written contemporaneous notes.
They are registered to the person interviewed and always registered to the nominal index.
The original tapes or videos will be held as exhibits.
Location Index This index contains records of locations that come to notice during the investigation. A location can be a property, street, postcode or any other specified location. This can include:
• Addresses of persons in the nominal index;
• Streets in which enquiries have been made or will be made;
• Reference to any location referred to in documentation.
Unknown streets can also be recorded.
Messages Denoted as M1, M2, M3, etc.
Messages can contain a variety of information such as initial reports from the public and witnesses that enter the MIR via telephone, verbally or officer’s information.
Messages can be registered to any of the indexes on HOLMES 2.
Nominal Index Denoted as N1, N2, N3, etc.
Anyone who comes to notice during the investigation will be recorded on the Nominal Index. They will be either:
• The author of a document;
• Have been referred to in a document.
This means that nominals can be:
• Identified – where surname/family name is known;
• Unknown – where only forename or nickname is known;
• Unidentified – where only a description is known.
Where known, full descriptive factors will be detailed.
This may help when carrying out, for example, subject profile analysis, network analysis.
Organisation Index This index is structured in an identical manner to the category index.
This index may be used to record the structures of organisations and may be particularly useful, for example, during fraud investigations.
TABLE 4 HOLMES 2 Closed Data Sources (continued)
HOLMES 2
Data Source Features
TABLE 4 HOLMES 2 Closed Data Sources (continued)
45
COLLECTION
NOT PROTECTIVELY MARKED Major Incident Analysis Manual (Revised Edition) © ACPO Centrex 2006 The PDF is given a unique reference number, the next consecutive number, prefixed by the letter P, eg, P3.
Letters after the number, P3a, will indicate further PDFs relating to the nominal.
The PDF is designed to record personal details. This includes the description of an individual, details of vehicles owned or used and types of convictions recorded where appropriate.
The PDF is always registered to the person to whom it refers and is registered to the nominal index.
Questionnaires Questionnaires are used for a variety of purposes such as stop checks or reconstructions. They will be registered to the person subject to the questionnaire and always registered to the nominal index.
The unique reference number will be the next consecutive number prefixed by the letter Q and a code for that particular type of questionnaire, eg, a stop check questionnaire may be preceded by the code STOP and so the number would be QSTOP1.
Reports Denoted as R1, R2, R3, etc.
Letters after the number, R1a, will indicate further reports by the same nominal.
Reports detail information from police officers or police staff that is not contained within a statement, for example, an officer’s notes regarding specific aspects of the inquiry.
It is normally registered to the author and therefore registered to the nominal index.
Sequence of Events This index allows the recording of pertinent events in chronological order, enabling events to be grouped into themes or timelines.
Statements Denoted as S1, S2, S3, etc.
Letters after the number, S1a, will indicate further statements by the same nominal.
Statements are registered to the person who provides the statement and always registered to the nominal index.
Telephone Index This index contains records of telephone numbers and extensions that come to notice during the investigation. They may be landline, mobile, telephone kiosks or pagers. The index can also detail complete, part or unidentified numbers.
Telephone numbers can be searched, using both partial and full details.
This will highlight, for example, documents, nominals and addresses that the number is linked to.
Personal Descriptive Form (PDF)
7.2.2 FORCE SYSTEMS
A number of systems exist which all forces have access to providing closed source data on a variety of topics including nominals, vehicles, addresses, forensic information and property. Table 5 details some of the most common closed data sources available within forces. This list is not exhaustive.
The following systems relate to UK policing.
HOLMES 2
Data Source Features
TABLE 4 HOLMES 2 Closed Data Sources (continued)
Vehicle Index This index contains records of vehicles that have come to notice during the inquiry. They will be vehicles either owned or used by a nominal or referred to in documentation.
Vehicle records may be a complete Vehicle Registration Mark (VRM), part VRM or identified only by description. Where only partial or no details of a VRM are known, the vehicle is given a ‘Unident No’. Both this and partial index numbers can be searched on. The index can also include details of farm or plant machinery.
Full descriptive factors will often be detailed including VRM, make, model, body type, description, colour and engine and VIN number where known.
Data Source Features
TABLE 5 Force Systems Closed Data Sources
ANPR technology records vehicle registration details that are captured when vehicles pass by ANPR cameras. These can be fixed or mobile units, and can be deployed as a result of a major incident to specific locations.
ANPR have a live link to PNC and a variety of databases feeding in.
The majority of forces store ANPR data for a period of time, therefore, this information can be explored.
These are often held separately because of the sensitive nature of the material. Separate databases or paper systems may be used by forces.
Details recorded may include a history of offences against children, suspect and offender details, home addresses.
Communications Data Communications data may include telephone and/or internet usage by
Communications Data Communications data may include telephone and/or internet usage by