STRUCTURED DESCRIPTION OF THE STAGES OF SECURITY AND INTELLIGENCE
WORK, AND SPECIFIC ACTIVITIES UNDERTAKEN WITHIN THESE STAGES
(Supplied to the Review by MI5, MI6 and GCHQ: June 2016)
DEFINITIONS
Introduction
This note has been put together to provide a consistent structure and terminology for
discussions about the way in which the Security and Intelligence Agencies (SIA) make use
of bulk data in pursuit of their statutory functions. There have been a range of studies
conducted on both sides of the Atlantic which have used different terms to describe identical
activities, and conversely identical terms to describe different activities. Furthermore there
are words that are used in the public debate which have a specific technical or legal
meaning within the SIA (“surveillance” being the most obvious example). By setting out a
high-level structured description of the stages of security and intelligence work, and the
specific activities undertaken within these stages, we hope to facilitate discussion.
Stages of Security and Intelligence Work
The work of the Agencies can be broken down into three stages. In any given investigation,
and certainly in the sustained production of intelligence to meet a particular intelligence
priority, these stages are not followed in a strictly linear way. Most of the time there will be
elements of all three in train. Nonetheless we consider that the three stage model provides a
useful basis for considering how bulk data is used.
1. IDENTIFY
This is the process by which initial “seed” information is analysed and developed to
the point where it is clear that there is e.g. a potential terrorist threat, a possible
candidate for recruitment as an agent, or a source of exploitable intelligence meeting
current requirements. The initial “seed” information may come from anywhere: open
source (a tweet claiming responsibility for an activity, say); a humint tip-off; forensic
data from seized media; information from a foreign liaison partner. Bulk data is vital
at this stage in the process and may often be one of the only sources of information
available to the Agencies.
2. UNDERSTAND
This is the process by which the intelligence picture is developed and enriched to the
point where decisions can be taken about resourcing and prioritisation. Bulk data is
used to help assess potential threats and opportunities, and where appropriate to
seek authorisation for targeted intelligence collection to supplement bulk data.
3. ACTION
This stage encompasses a wide range of activities, which bulk data will have helped
to inform. The output of the “identify” and “understand” phases might be the
production of intelligence reports, the running of a recruitment operations, or the
launching of disruption activity whether through arrests to prevent a e.g. terrorist
attack plan or on-line “effects” operations.
142