Home » Articole » News » Epistemology of Intelligence Analysis

Epistemology of Intelligence Analysis

posted in: News 0

Intelligence cycle

In intelligence, epistemology is the study of the threat awareness and the way the threat is understood in the field of intelligence analysis.

Most definitions of intelligence do not consider the fact that the epistemic normative status of the intelligence analysis is knowledge rather than a lower alternative. Counter-arguments to the epistemological status of intelligence are their purpose-oriented action, and their future-oriented content. (Rønn and Høffding 2013)

Following the attacks of September 11, a terrorism commission was set up to identify the failures and weaknesses of US intelligence agencies, to learn from security vulnerabilities and to avoid future attacks on national safety and security. The conclusion was that the US intelligence institutions lacked the imagination and ability to make relevant predictions – that is to connect the relevant “points” and reach relevant conclusions. (Anderson, Schum, and Twining 2009)

Sherman Kent, in Strategic Intelligence (1949), divides the field into three components: (Kent 1966) knowledge, organization, and activity. In the opinion of Michael Herman in Intelligence Services in the Information Age (2001), the field of intelligence can be divided into: activity, subjects, product, and function. (Herman 2001) Scott and Jackson in The Study of Intelligence in Theory and Practice, introductory article in Intelligence and National Security Journal no. 19 of 2010, (Scott and Jackson 2004) complements Kent and Herman’s divisions by providing an analysis of how to make significant distinctions in the field of intelligence.

The intelligence contrasts with information and knowledge and can be placed in a pyramidal continuum of data, information and knowledge. (Dean and Gottschalk 2007) Intelligence can be inserted into two different positions: either between information and knowledge, or at the top of the knowledge hierarchy. (Rønn and Høffding 2013)

In the first case, the intelligence is an epistemic step above the information: Geoff Dean and Petter Gottschalk consider that “intelligence is placed between information and knowledge on the continuum as ideally intelligence represents (…) a form of validated information.” (Dean and Gottschalk 2007) Normative understanding of intelligence can be seen as the most “plausible information.” Intelligence is often referred to as “prior knowledge” understood as information and evaluation of future activities. (Wheaton and Beerbower 2006) Specifically, the pre-scientific attribute of the intelligence is characterized as a warning about events and potentially harmful actions. The question then is whether it disqualifies intelligence as knowledge. (Rønn and Høffding 2013)

If the intelligence is placed above knowledge, it is more than mere knowledge. Jerry Ratcliffe justifies this ranking as follows:

“So why the extra step of adding intelligence to the continuum? It is due to the fact that intelligence products are inherently action products. In other words, knowledge products can generate understanding, but intelligence products are supposed to generate action.” (Ratcliffe 2008)

This means that intelligence generates “actionable knowledge”. But this interpretation, though claiming that intelligence is a type of knowledge, seems to confuse its epistemic status with its normative function, that of actions and decisions of orientation.

According to Simon Høffding, when we compare the epistemic status of intelligence according to the above positions, the relationship between information and knowledge in continuum is asymmetric due to the different level of plausibility and relevance. (Rønn and Høffding 2013) However, what matters is the agent’s propositional attitude towards the content of an information. In this sense, information and knowledge are interdependent, and both can thus be intelligence.

The main concept of intelligence is the threat. This is reflected in the seminar work of J. David Singer in 1958, Threat Perception and the Armament-Tension Dilemma, (Singer 1958) through a quasi-mathematical model:

Threat-Perception = Estimated Capability x Estimated Intent

Intent and capability parameters can be described as the dominant episteme used to understand the threat in the field of intelligence analysis. (Vandepeer 2011) Since only the threat actor is important from the ontological point of view, it means that for Singer only the intentions and abilities of the threat actor matter.

Samuel Huntington, in The Soldier and the State (1957), claims that military personnel are qualified to assess their capabilities, but not their intentions. (Huntington 1981) Despite the changes that include non-state actors’ assessments as a priority, the threat remains defined using only one model, focusing specifically on the threat actor. This assumes that analysts already know and understand the threat actor they are trying to assess. Threat evaluation is based on the knowledge and understanding of an actor. Identification is presumed.

The Singer model was later extended by adding new parameters, of which the most common are vulnerability and opportunity. The vulnerability parameter focuses rather on the threat reference, resulting in vulnerability being defined as the susceptibility of a reviewer to an attack. Richard Pilch uses the following formula: (Howard and Sawyer 2003)

Threat = Vulnerability x Capability x Intent

One of the issues of the vulnerability parameter is that the more generic the target (referent) potential, the less correct will be the threat assessment.

The opportunity parameter also appears as a complement to the conventional model:

Threat = Intent x Capability x Opportunity

Opportunity incorporates an understanding of both the threat actor and the referent and can be defined as a favorable time or opportunity for a threat actor in relation to a reviewer. (Vandepeer 2011)

Despite efforts to incorporate additional parameters, the primary assumption is that the dominant episteme, with a primary focus on the threat actor, remains essential to assessing the threat.

Investigation theory addresses different ways in which each type of investigation achieves its purpose. Bennets (Holsapple 2004) distinguishes between data, information and knowledge, stating that:

data is discrete, objective facts about events which include numbers, letters and images without context, while information is data with some level of meaning as it describes a situation or condition. Knowledge is built on data and information, and is created within the individual. This knowledge represents understanding of the context, insights into the relationships within a system and the ability to identify leverage points and weaknesses and to understand the future implications of actions taken to resolve problems.”

In order to produce objective intelligence, the analyst must use a process tailored to the nature of the problem, using one of the fundamental ways of reasoning: (Krizan 1999) induction (causality search, discovery of the relationships between the studied phenomena), deduction (general application, from general to specific), trained intuition (applying a spontaneous perspective, validated with available facts and tools), scientific method (hypothesis falsification and fictitious scenario testing).

Induction: When analysts make a generalization or discover relationships between phenomena based on observations or other evidence.

“Induction consists in establishing syllogistically a relation between one extreme and the middle by means of the other extreme, e.g. if B is the middle term between A and C, it consists in proving through C that A belongs to B. For this is the manner in which we make inductions.” (Aristotle 1989, chap. 2.23)

Stephen Marrin expands the inductive approach, indicating that analysts have an analytical approach in two stages. (Marrin 2012) They use intuitive “pattern and trend analysis” – identifying repetitive behavior over time, then relying on ad hoc rules or mental models derived from the study of relevant theory – for example, economics, political science or psychology – to determine the meaning of the model. (Duvenage 2010) Michael Collier argues that the inductive method leaves too much room for conjecture, superstition and opinion.

Deduction: Judgment starting from general rules to specific cases, if the hypothesis is tested, contrary to the inductive reasoning where the hypothesis is created.

”Whenever three terms are so related to one another that the last is contained in the middle as in a whole, and the middle is either contained in, or excluded from, the first as in or from a whole, the extremes must be related by a perfect syllogism. I call that term middle which is itself contained in another and contains another in itself: in position also this comes in the middle. By extremes I mean both that term which is itself contained in another and that in which another is contained. If A is predicated of all B, and B of all C, A must be predicated of all C: we have already explained what we mean by ‘predicated of all’. Similarly also, if A is predicated of no B, and B of all C, it is necessary that no C will be A.” (Aristotle 1989, chap. 1.4)

Krizan quotes Clauser and Weir (Krizan 1999) who warn that deductive reasoning should be used with care in the intelligence analysis, as there are rarely closed systems, thus premises based on another set of facts, applied to a new problem and supposed to be true may be false and lead to incorrect conclusions.

Unlike deductive arguments, in inductive reasoning there is the possibility that the conclusion is false, even if all the premises are true. Instead of being valid or invalid, inductive arguments are strong or weak, which shows how likely it is that the conclusion is true.

Abduction: The unofficial or pragmatic way of reasoning to describe how we “justify the best explanation” in everyday life.

”We have Reduction (1) when it is obvious that the first term applies to the middle, but that the middle applies to the last term is not obvious, yet nevertheless is more probable [credible] or not less probable [credible] than the conclusion; or (2) if there are not many intermediate terms between the last and the middle; for in all such cases the effect is to bring us nearer to knowledge.” (Aristotle 1989, chap. 2.25)

Waltz asserts that abduction is, in intelligence, a practical description of an interactive analysis and synthesis set to arrive at a solution or explanation, creating and evaluating more hypotheses. (Waltz 2003, 173) In abduction, the analyst creatively generates a set of hypotheses and sets out to examine whether the available evidence is unequivocally supported by each other. The final step, namely testing the evidence, is a deductive inference. Abduction can be likened to the intuition of the analyst. This reasoning is erroneous because it is subject to cognitive errors but has the ability to extend the understanding of the intelligence matter beyond the original premises.

Scientific method: It uses induction to develop the hypothesis, and deduction is used to be tested. If testing does not validate the hypothesis, a new hypothesis should be formulated, and new experiments designed to validate this hypothesis. (Marrin 2012) In the analysis of information there are no direct experiments and observations of the subject, but the analyst can develop hypotheses or explanations from information obtained from different sources. Hypotheses can then be examined for plausibility and iteratively tested against new information. (Duvenage 2010)

Structural analysis: It represents additional tools for traditional and intuitive analysis methods and are not just alternatives. Using structural analysis methods could not only improve the quality of intelligence analysis but also enhance the credibility of the analysis that is often prone to criticism of actual or perceived politicization and other organizational pressures. Heuer and Pherson (Heuer and Pherson 2010) classifies 50 structural analytical methods in eight categories that correlate with common cognitive traps and indicates the functions that analysts have to meet to overcome these traps. Some of these methods are:

  • Decomposition and view: to exceed the limits of the working memory
  • Idea generation techniques: stimulating the analyst’s mind with new possibilities to investigate and visualize an intelligence problem from different angles
  • Scenarios, indicators, bookmarks: identifying those who could change a situation and outlining the various possible scenarios
  • Generating and testing hypotheses: analysts, in the subconscious, hypothesize each information and validate them intuitively; structured analytical tools help to examine a wider range of alternative hypotheses, possibilities and explanations
  • Analysis of causes and effects: analysts should be cautious in unsafe assumptions and conclusions regarding the cause and effect of certain events or indicators
  • Reframing techniques: helps analysts to change their reference/mentality frameworks to an analytical problem by changing questions or perspectives
  • Challenge analysis techniques: helps deliver the best possible product to customers where there are major differences in views, highlighting minority views
  • Analysis of decision support: allows analysts to see the issue from the perspective of decision-makers.

Biases: Biases can distort the correct application of inductive argumentation, thus preventing the formation of the most logical conclusion based on clues. Examples of such prejudices include availability heuristics, confirmation biases, and prediction biases.


  • Anderson, Terence, David Schum, and William Twining. 2009. Analysis of Evidence. 2 edition. Cambridge; New York: Cambridge University Press.
  • Aristotle. 1989. Prior Analytics. Hackett Publishing.
  • Dean, Geoff, and Petter Gottschalk. 2007. Knowledge Management in Policing and Law Enforcement: Foundations, Structures and Applications. Oxford, New York: Oxford University Press.
  • Duvenage, Magdalena Adriana. 2010. “Intelligence Analysis in the Knowledge Age : An Analysis of the Challenges Facing the Practice of Intelligence Analysis.” Thesis, Stellenbosch : University of Stellenbosch. https://scholar.sun.ac.za:443/handle/10019.1/3087.
  • Herman, Michael. 2001. Intelligence Services in the Information Age: Theory and Practice. Taylor & Francis.
  • Heuer, Richards J., and Randolph H. Pherson. 2010. Structured Analytic Techniques for Intelligence Analysis. CQ Press.
  • Holsapple, Clyde, ed. 2004. Handbook on Knowledge Management 1: Knowledge Matters. International Handbooks on Information Systems. Berlin Heidelberg: Springer-Verlag. //www.springer.com/gp/book/9783540435273.
  • Howard, Russell, and Reid Sawyer. 2003. Terrorism and Counterterrorism: Understanding the New Security Environment, Readings and Interpretations, Revised & Updated 2004. 1 edition. Guilford, Conn.: McGraw-Hill/Dushkin.
  • Huntington, Samuel P. 1981. The Soldier and the State: The Theory and Politics of Civil–Military Relations. Revised edition. Cambridge, Mass: Belknap Press: An Imprint of Harvard University Press.
  • Kent, SHERMAN. 1966. Strategic Intelligence for American World Policy. Princeton University Press. https://www.jstor.org/stable/j.ctt183q0qt.
  • Krizan, Lisa. 1999. “Intelligence Essentials for Everyone.” ResearchGate. 1999. https://www.researchgate.net/publication/235073074_Intelligence_Essentials_for_Everyone.
  • Marrin, Stephen. 2012. Improving Intelligence Analysis: Bridging the Gap between Scholarship and Practice. Routledge.
  • Ratcliffe, Jerry H. 2008. Intelligence-Led Policing. 1 edition. Cullompton, Devon: Willan.
  • Rønn, Kira Vrist, and Simon Høffding. 2013. “The Epistemic Status of Intelligence: An Epistemological Contribution to the Understanding of Intelligence.” 2013. https://www.researchgate.net/publication/263573379_The_Epistemic_Status_of_Intelligence_An_Epistemological_Contribution_to_the_Understanding_of_Intelligence.
  • Scott, Len, and Peter Jackson. 2004. “The Study of Intelligence in Theory and Practice.” Intelligence and National Security 19 (2): 139–69. https://doi.org/10.1080/0268452042000302930.
  • Singer, J. David. 1958. “Threat-Perception and the Armament-Tension Dilemma.” The Journal of Conflict Resolution 2 (1): 90–105. https://www.jstor.org/stable/172848.
  • Vandepeer, Charles. 2011. “Rethinking Threat: Intelligence Analysis, Intentions, Capabilities, and the Challenge of Non-State Actors.” Thesis. https://digital.library.adelaide.edu.au/dspace/handle/2440/70732.
  • Waltz, Edward. 2003. Knowledge Management in the Intelligence Enterprise. Artech House.
  • Wheaton, Kristan J., and Michael T. Beerbower. 2006. “Towards a New Definition of Intelligence.” Stanford Law School. 2006. https://law.stanford.edu/publications/towards-new-definition-intelligence/.

Nicolae Sfetcu
Email: nicolae@sfetcu.com

This article is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International. To view a copy of this license, visit http://creativecommons.org/licenses/by-nd/4.0/.

Sfetcu, Nicolae, “Epistemology of Intelligence Analysis”, SetThings (March 20, 2019), MultiMedia Publishing (ed.), URL = https://www.telework.ro/en/epistemology-of-intelligence-analysis/

Leave a Reply

Your email address will not be published.