Introduction to secret affairs lesson 2

RFI

A broad policy concern must therefore become a specific request for information

• Broad concern: “What is happening in Country X?”

• Useful RFI: “Is Country X preparing to test a nuclear weapon within the next month?”

The requirement directs collection; collection supplies analysis; analysis supports the decision.

The aim is not informational superiority for its own sake.

The aim is decision advantage: giving a decision-maker relevant understanding before an opponent or before the opportunity disappears.

What does Decision advantage depend on?

• relevance;

• reliability;

• speed;

• interpretation;

• appropriate communication.

More data can actually reduce decision advantage if it overwhelms analysts or hides the important signal in noise.

Why are there so Manny INTs

Each collection discipline reveals different features of reality. None provides the complete picture alone.

HUMINT

Human intelligence (HUMINT) obtains information from human sources. Sources may include:

• recruited insiders;

• diplomats;

• prisoners;

• refugees;

• witnesses;

• defectors;

• people approached openly or clandestinely.

HUMINT Main strength

HUMINT can reveal intentions. A satellite may show military forces moving, but a well-placed source might explain whether leaders intend an exercise, coercive signalling or an invasion.

This is why countries with strong human access near the Kremlin may have understood Russian intentions before the invasion of Ukraine more clearly than countries relying mainly on technical indicators.

Elicitation (HUMINT)

Elicitation means drawing out information without asking an obvious direct question. A collector might state something slightly incorrect so that the other person supplies the correction.

HUMINT main weakness

• Developing access can take years.

• Sources may lie, misunderstand or exaggerate.

• Officers and sources face serious personal risk.

• Digital surveillance creates traces of meetings, travel and communication.

• A source’s access does not guarantee accuracy.

IMINT

Imagery intelligence (IMINT) uses photographs and images from sources such as:

• satellites;

• aircraft;

• drones;

• balloons;

• ground-based sensors.

What does IMINT do?

It can reveal troop concentrations, construction, equipment and physical changes over time.

Its history predates satellites. Armies used balloons for observation in the nineteenth century, and aerial photography expanded during the world wars. The Chinese balloon shot down by the United States in 2023 shows that collection does not always require the most advanced platform.

GEOINT

Geospatial intelligence (GEOINT) combines imagery with geographic information such as:

• coordinates;

• terrain;

• roads;

• buildings;

• weather;

• movement patterns.

IMINT may show vehicles. GEOINT helps explain where they are, how they could move and why the location matters.

Limitation IMINT & GEOINT

Images do not explain themselves. Analysts must distinguish observation from inference.

• Observation: “Twenty vehicles are visible near the base.”

• Inference: “The unit may be preparing to deploy.”

The inference needs context and support from other sources.

SIGINT

Signals intelligence (SIGINT) collects electronic transmissions, including:

• telephone calls;

• messages;

• radio traffic;

• radar emissions;

• satellite transmissions;

• other electronic signals.

COMINT, the interception of communications between parties, is one form of SIGINT.

Content and pattern SIGINT

The content of a message may be valuable, but communication patterns can also reveal activity.

For example:

• a sudden increase in radio traffic may indicate mobilisation;

• unexpected silence may indicate a security measure;

• repeated contact between two devices may reveal a network.

Main limitation SIGINT

Interception is not interpretation. Encryption may block access, and even readable messages can lack context or contain deception.

MASINT

Measurement and signatures intelligence (MASINT) identifies measurable physical features left by objects and activities.

It can examine:

• heat;

• sound;

• radiation;

• seismic movement;

• chemical particles;

• acoustic signatures;

• electronic or weapons telemetry.

MASINT Main strength

An opponent may conceal a statement or encrypt a message, but physical activity often leaves a detectable trace.

OSINT

Open-source intelligence (OSINT) uses publicly available material such as:

• news;

• social media;

• government documents;

• academic research;

• speeches;

• public databases;

• commercial satellite images;

• weather and sensor data.

OSINT is not new. Open material supported intelligence during the American Civil War and preparations for D-Day. What has changed is its scale, speed and accessibility.

Miller’s central question

Bowman H. Miller asks whether “open-source intelligence” is an oxymoron. Intelligence is usually associated with secrecy, while open sources are public.

His answer is nuanced:

Public information is not automatically intelligence. It becomes intelligence when it is selected, verified, analysed and used to answer a specific intelligence need.

A social-media photograph is information. It becomes intelligence when an analyst:

1. finds the relevant image;

2. verifies when and where it was taken;

3. compares it with other evidence;

4. assesses what it means;

5. connects it to a decision-maker’s question.

(Relevant + verified + analysed + purpose = intelligence)

Miller’s challenge to OSINT as a separate INT

HUMINT and SIGINT describe specialised methods for obtaining information. OSINT often involves finding and processing information that someone else already produced.

Miller therefore suggests that OSINF may be the more accurate term for raw open-source material. It becomes OSINTthrough purpose and analysis.

Three connected functions of OSINT

1. Direct evidence: Public material may answer part of the intelligence question.

2. Context: It helps analysts understand language, institutions, culture and politics.

3. Cueing and validation: It directs other collectors and checks their findings.

Main problem OSINT

Traditional collection often faces scarcity. OSINT often creates overload.

The challenge is to find useful signals among:

• irrelevant content;

• duplication;

• propaganda;

• manipulated media;

• rapidly changing reports;

• deliberate disinformation.

Public does not mean harmless

Large-scale collection of personal information may be legal or technically possible but still intrusive. OSINT can threaten privacy when separate public details are combined into a detailed picture of a person’s life.

Why the INTs must work together

Different methods answer different questions:

• HUMINT may reveal what a leader intends.

• IMINT may show what forces exist.

• GEOINT may show where they can move.

• SIGINT may reveal how units communicate.

• MASINT may confirm what physical activity occurred.

• OSINT may provide context, warning and corroboration.

Katz: AI at the collection edge

Brian Katz argues that intelligence services already collect more data than humans can process. The main challenge is to adaptively select, filter, authenticate and interpret what matters.

AI can help at four connected points:

AI function	What it does	Why it matters
Tasking	Chooses or schedules suitable collection assets	Directs scarce resources toward priorities
Detection	Learns normal patterns and flags anomalies	Finds possible warning indicators
Validation	Compares material with other evidence	Tests identity and authenticity
Triage	Sorts and ranks large information flows	Sends the most relevant items to analysts first

Tip and cue (KATZ)

AI can connect collectors through a tip-and-cue process:

1. One sensor detects an unusual pattern.

2. It tips the system that something may be happening.

3. Another collector is cued to investigate.

4. A human analyst assesses the combined results.

This links Katz directly to the all-source principle: technology helps the INTs interact instead of operating as isolated channels.

What is “the collection edge”?

The edge is the point near where information is collected—such as a sensor, aircraft, device or operational team.

Traditional (collection) model

Collect → Send to headquarters → Process → Analyse → Return the result

Edge (collection) model

Collect → Process locally → Flag the important result → Send an alert

Edge computing reduces delay by processing data close to its source.

For example, a drone could identify an unusual vehicle locally and transmit the alert and relevant image rather than sending every second of raw footage.

Why edge collection matters

• Faster warning;

• less pressure on communication systems;

• quicker operational decisions;

• less irrelevant data sent to analysts;

• better use of expensive collection platforms.

AI supports humans; it does not remove judgment

AI is strong at:

• processing volume;

• recognising repeated patterns;

• transcribing and translating;

• labelling images;

• extracting names and relationships;

• prioritising material;

• detecting anomalies.

Humans remain essential for:

• understanding context;

• evaluating credibility;

• recognising political meaning;

• considering alternatives;

• communicating uncertainty;

• making ethical judgments;

• accepting responsibility.

AI may make an intelligence process faster without making it more accurate. If training data is biased or manipulated, the system can repeat an error at enormous speed and scale.

The four adversarial Ds

Katz stresses that opponents can use the same technologies.

1. Detection: Biometrics, cameras and data analytics expose officers, sources and secret meetings.

2. Denial: Encryption and secure systems prevent access.

3. Disruption: Cyberattacks damage collectors, communications or data.

4. Deception: Deepfakes and fabricated data mislead systems and analysts.

Data poisoning

An opponent can insert manipulated examples into training data so that an AI system learns the wrong pattern. The output may look scientific while resting on corrupted evidence.

Deepfakes and authenticity

Analysts traditionally asked, “Is this information accurate?” They must increasingly ask an earlier question:

Is this image, voice, message or source authentic at all?

Explainability, trust and accountability

Decision-makers need to know:

• what data an algorithm used;

• why it flagged a target;

• where bias might exist;

• how confident the result is;

• where human judgment entered the process.

A system may be accurate on average but unsuitable for a high-stakes decision if no one can explain a particular conclusion.

Organisational barriers matter as much as algorithms

Katz argues that adopting AI requires more than buying software.

• Data architecture

• Workforce

• Acquisition and culture

• Adaptability

Data architecture

Information is often divided by:

• agency;

• classification level;

• incompatible systems;

• inconsistent labels;

• access restrictions;

• outdated infrastructure.

AI cannot integrate information it cannot access or understand.

Workforce

Future intelligence teams need mixed skills:

• collectors who understand digital risks;

• analysts who understand AI limitations;

• engineers who understand intelligence requirements;

• leaders who can manage experimentation and accountability.

Acquisition and culture

Slow procurement can make technology obsolete before deployment. Agencies need faster experimentation and partnerships with companies and allies, while still protecting sensitive information.

Adaptability

This is Katz’s deepest principle. Requirements, threats and technologies change rapidly. Collection systems must adjust rather than follow a rigid plan after circumstances have changed.