information may come from anywhere: open source (a tweet claiming
responsibility for an activity, say); a humint tip-off; forensic data from seized
media; information from a foreign liaison partner. Bulk data is vital at this
stage in the process and may often be one of the only sources of information
available to the Agencies.
UNDERSTAND
This is the process by which the intelligence picture is developed and
enriched to the point where decisions can be taken about resourcing and
prioritisation. Bulk data is used to help assess potential threats and
opportunities, and where appropriate to seek authorisation for targeted
intelligence collection to supplement bulk data.
ACTION
This action encompasses a wide range of activities, which bulk data will have
helped to inform. The output of the ‘identify’ and ‘understand’ phases might
be the production of intelligence reports, the running of recruitment
operations, or the launching of a disruption activity, such as through arrests to
prevent a e.g. terrorist attack plan.”
4.8.
The specific activities conducted by analysts within the SIAs were expressed as
follows:
“Target discovery – identifying individuals who may be subjects of intelligence
interest from lead intelligence.
Target development – enriching understanding of a subject of intelligence
interest, their connections, networks and patterns of activity, in order to
understand potential threat or opportunities.
Anomaly detection – a technology-based process by which patterns in bulk
data are identified and analysed to assist in the detection of e.g. malware and
cyber-attack signatures. This is essential for Cyber Defence.
Network Analysis – this is a technology-based process by which information
is gathered from interception to develop understanding of the network
environment to provide context to the intercepted data and enable more
effective operation of e.g. the bulk interception process.
Triage and prioritisation – at all stages bulk data helps to inform decisions
about prioritisation of resources by the Agencies, including the allocation of
scarce technical, analytic, human or other collection resources.”
4.9.
As will be apparent, many of the benefits of intelligence work come at a relatively
early stage in the investigative process. Some outcomes may have value even
though they do not contribute tangibly to national security (e.g. ruling out a line of
enquiry; establishing that a foreign national is not willing to be recruited).
73