Good day Ladies and gentlemen, what we're going to cover today is a very quick intelligence overview. very broad brush, we're going to look at a couple of subjects that are vital to our intelligence analysis, especially when it relates to security management. And then later lessons, we'll be drilling down to a bit more detail. Of course, some of the aims we're going to complete today or introduce you to some of the levels and types of intelligence to discuss the ripple effect, because that should be in the background of everything you look at. How does one thing happened in one side of the world affect the safety and security of your staff in others. As an example, we're going to introduce some ways to justify and prioritize your intelligence, which is pretty vital, because if you can't justify it, if you can't sell it to your employer or to your client, then again, it's going to be pretty worthless.

They're gonna make up a wrong decision, potentially, because you haven't sold your intelligence enough, it doesn't mean that you bring it up that you live by your intelligence, it just means to say, this is my intelligence. This is the evidence that backs that intelligence up. So the levels of intelligence we're looking at. Strategic is probably the biggest broadest brush you can get. It'll come under different names, but strategic is one of the common ones. And it's events that are going to happen in a region, maybe even worldwide, and the may have some impact on the safety and security of your staff.

But overall, it's a big broad brush. And this could be things going on between countries. It could be like at the moment, we have the US and Iran. bitching at each other. That impacts on the safety and security of staff because There's lots of other things going on in the region that's been triggered by this. Something simple, like flights are no longer allowed to fly around for a while.

So they've either got to be deterred, which may take them into even riskier areas, or it may cause lots of travel delays, and additional problems, it may mean that for staff safety, and security, you don't want them transiting through various regional airports, because of what's going on around them. There may be an increase in terrorists, offensive terrorist trends, terrorist related trends because of this whole geopolitical strategic thing that's going on around us. So don't always just forget about the big picture. This may have lots and lots of implications at the ground level, operational that covers the general operating area. So if you're working in Lebanon, for instance, Now we'll cover Lebanon may cover some border activities I've seen to Syria that may cover what the Israelis are doing. That in turn may be triggered by what the Americans are doing, which may become a strategic event.

And but you're generally looking at sort of country wide, or certainly within the area of operations within a country. In tactical, the air and your base around the compound, the office, the location, where you're going to be traveling from and to, on a day to day basis, all the tactical ground, the ground stuff that really does affect the safety and security of your staff on a day to day basis. And this is probably the area where you're going to be most concerned with on a day to day basis. The operational stuff you may look at weekly, what's going to what's happening in three towns further down. That's not directly impacting us. But could whatever happens there could affect us.

In a week's time, and that's the sort of general picture. As I said, well, their strategic, big picture, you may get sort of security information reports once a day, they say there, this is happening in this country, and this is happening in this country. Just be aware that For instance, if you have operations in Pakistan, then things that happened in the Middle East can cause demonstrations in Pakistan, and vice versa, things that are happening in Pakistan can cause increased violence in Palestine, Israel, Lebanon, or in demonstrations. So that whole strategic overview needs to be watched, but not on a daily basis as you would the tactical stuff. drilling down Of course, we're looking at Afghanistan cabal, operationally, if cabal and the surrounding areas is where your project is, based, where the traveling from, say from kaboom to about, that's you Operational Operational Area. And that's the one you'll be focusing on mainly in our day to day basis because you may not have traveled going from Kabul to Jalalabad every single day.

But you will want to see you want to monitor what's happening down that route. You want to monitor what's happening in Jalalabad. And of course, you want to monitor what's happening cabal, but that's more your tactical stuff. And as your tactical stuff, this is your area of focus, this is where your staff are, this is where they live. This is why they travel around every single day. This is what will impact you on a day to day basis.

All right, the other stuff, you'll focus on every other day or once a week, but this is every day, something may happen. So you have to keep your eyes open to what's happening on almost hourly, tactical basis and something like Afghanistan. I mentioned the ripple effect. This A few years ago, now. But this caused a lot of problems. So this pastor, as you can read there in Florida, decided that he wanted to burn some crowns.

Locally I in Florida, it didn't cause much of a fuss, people ignore them and just throw these crazy. Outside of there. It caused a lot of problems. And it instigated some terrorist attacks instigated a lot of demonstrations and riots and protests quite naturally. And this guy caused a lot of problems for the safety and security of staff, well away from Florida, not even the same region and the other side of the world. So this sort of ripple effect may happen on Monday.

You might not feel that ripple until the next Friday or the next Monday or even a couple of weeks later. When people start to hear about it, start to talk about it. Start to generate some anger about it. So this was one example. And guising. Other issues that came out of that word, of course, the the lots of issues in the background brewed up, which led to the attack against the the ambassador compound, and the death of the ambassador in Benghazi.

And this is another example, just 2012. But you could go back a few months and find similar sort of examples of how things how things are triggered. And it may just be extremist organizations taking advantage. They may, for instance, have seen reports like the pastor wanting to burn the Quran, and they say I'm going to stand up for ourselves and we're going to Attack whatever we can in the neighborhood, it may not be that the US controller wherever you're working is a viable target. So the look at the next us thing, or the next British thing, or next European thing, whatever is available and whatever is relatively simple to attack. So you have to work out what's happening around the world.

How could it affect you? will it affect you? And what can you do about it to try and stop that realist the turret so timeframes of intelligence, we've looked at the strategic, the operational, the tactical, the ripple effect, and how all this can happen. It's very interesting to see, monitor how the ripple effect works around the world. There is increased communication, people speak more, you can get news almost immediately. It still takes a few days to get from one side of the world to the other as far as sort of violent response goes.

So thanks gives you a little bit of time, but you need to start wanting your staff straight away that something's happening in Florida. We need to start taking a bit more care, maybe slow down movement outside of the compound, increase the guard, increase awareness, pick up on the training a little bit to make sure that your staff are aware to report anything suspicious back and start liaising with your networks. So timeframes historic, historic is obviously something that's passed. We talked about al Shabaab in the introduction. What they've done in the past gives you quite a good picture of what they're capable of in the future. Not everything bear in mind, they will learn trends from other extremist organizations from other countries.

They'll watch the news and say, Hey, hotel attacks, that looks like good fun. We should do that next. They'll pick up and trends very quickly, but bizarrely extremist groups tend to stick to what they're good at. If they're good at complex attacks initiated by suicide bombs, and go in, shoot the place up from when the security forces come in, they blow themselves up. That's the trend they will stick with. Because once you've planned it, once you've successfully executed that type of attack, it's you know how to do it again.

And it's worthwhile and it makes the news a lot of the times current. So what are they up to now? What are the crime trends like in your area, while the crime trends strategically, operationally, tactically, you know, the, the regional crime trends may be good. There's hardly any crime in this area in this sort of region. It's a very quiet, very passive area. People are religious, the family orientated, coming into the country.

They may be more cyber orientated as far as far as crime goes, credit cards, stuff like that. They're very aware of how to do lots of scams online. And then tactically, you don't use a credit card or debit card anywhere in the city you operate in. Because immediately the number be taken, your bank account will be empty, things like that. So you have to look at, you know, it's a 3d model, and how are things happening now compared to what they were happening and what's happening in the areas. A year ago, or two months ago, if you're looking at countries like Afghanistan have so many incidents, you can pretty much only look back two weeks.

As far as building trends and patterns. You can say in in 2018, there were 2000 attacks, and July 2019, there have been 1000 attacks. It's still on trend. All that talk the security forces doing isn't really look positive when you look at the statistics so there's there's lots of things you can do historically, combine it with what's happening at the moment. On the ground, I'm in the future. Of course, this is the tricky bit, none of us can see into the future.

We can take educated guesses, we can do our analysis. The bad news is a lot of the time unless we're very, very good, we're right about 50% of the time. So it takes a lot of effort to understand appreciate criminal activity, the way the criminals think, or extremist trends, and, and also the patterns of natural disasters, for instance. So in the future, this is what everyone's ever wants to know what's going to happen down that road in a week's time. You can make a good assessment by building a historic picture against what's happening at the moment, and then painting that into what you think is going to happen in the future. It could be that terrorist activity was very heavy, historically, currently is quite quiet.

And the reason why that's quite good Quiet is because there's been an extra battalion of police moved into the area, they're going to be staying here for at least six months. So in the future, we expect that downward trend to continue. Unless the extremists get wise to the tactics of the police and levels, start picking up again. But that's what you're there for. You're there to monitor that stuff, and then report straight away, say, the terrorists are back at their own game. Instant levels are rising.

Let's reduce transport travel on this road, until we can work out what the pattern is. Types of intelligence, there's quite a few. And there's probably more than some of this list. So open source intelligence, pretty much anything you can get online. I'm not talking about Wikipedia, but you know, the Media Research, you can get lots of statistics nowadays of figures on terrorist attacks around the world. You can get lots of mapping that organizations do that you can pick up on that can help you with your reports.

Human intelligence is something that I favor a lot. If you're working in one country, say the US, UK, Europe, as a security manager or an analyst to a security manager, then you may want to start picking up sources of intelligence who may already have in other parts of the world to help support your operations. And by support, I mean, if there's a bomb goes off in one town and you have someone there, you can pick a phone up by sending emails, hey, what's been going on what's happening, and they may have some good sources that can give you the information that you're not going to pick up with the news. We do you mean in a bit more detail and further along the courses. electronic intelligence obviously something that you may or may not be interested in, but generally not from a business perspective, but that's there is picking up electronic data.

Also counter data. So countering people who are picking up on electronic intelligence signals intelligence that comes across the, the waves, the airwaves. But also nowadays, we're looking at lots of various sources for signals intelligence, that could be anything from your WhatsApp, to email. But there'll be very strict borders, depending of the types of intelligence and the collection of the intelligence, depending on what agencies are doing it, what countries operating and so on and so forth. geospatial intelligence, so the mapping, who's where what tanks of move looking at satellites, and a great source of that is, of course, Google Earth. Not especially geospatial intelligence.

But when you start putting attack data on there, or the data of where your location so you're going to visit married to that attack data, you could start to see visually, patterns and trends. trends that are great for briefings, great for your own analysis and great for reports. And we'll be doing that later on in the course as well. Imagery intelligence, that's more satellite stuff that's sort of melded together as far as being the amateur level. geospatial, and imagery, intelligence. imagery.

Intelligence can also come from your drones, for instance, and your aircraft, but it's similar sort of top down information. Machine measurement, signal intelligence, signature intelligence that's going around and sort of picking up the strengths of Wi Fi in North Korea and Pakistan, for instance, and seeing what the usage levels are Financial Intelligence that's very big at the moment, and will continue to be as countries trying to degrade extremist organizations by attacking their finances. So people with financial backgrounds, start to gather information produce intelligence. As to how terrorist organizations are financed, and how the heads of these organizations, finance operations. So skipping over a little bit information flow, so there we are in the middle, we may be a sub to that I the security analyst or an analyst intelligence analyst. But the simplicity of this diagram is that information should flow everywhere.

That doesn't mean you give away your secrets. But I found through my, my experience, that the more you speak to people, the more you give, the more you get back. Obviously, you have to be careful about some of the information you give away. But if it's valuable to them, I saved their lives. Then it's, it's worth passing on. less cost.

You're tied down by the Official Secrets Act in the UK, for instance. Something like that. But from an NGO basis or business basis. If there's a threat report coming out that you think you should share with your colleagues and other organizations, you should share it. I just did something similar this morning, it was a threat report came out about a buildup of attacks against religious buildings and religious gatherings in Pakistan. I didn't know if the hundreds of other people in the in the security network knew about it.

So I just threw it out there and shared it. Some did, some didn't. No one shared it, I shared it. And that gives them some incentive to share information with me. So that's the way the game goes. It's a quid pro quo.

You give you get, obviously within careful boundaries, depending on sort of business classifications, you've got so and so forth. So how do you just Fire intelligence. So it's really a hotel in Islam about there's no obvious targets. And this is how one area we sort of justified our intelligence on the left there terrorism crime case for our kidnap for ransom, and civil disorder. So we broke it down into the types. And then the cities within Pakistan Pasha was long bad Lahore, Malta.

These were of interest to the client. So as far as targets wise, we're looking at expatriates airlines or local nationals. So in each town, each city is broken down to x pattern local nationals. And the reason we did that is because, for instance, this is Pakistan. So in Pakistan, as a local national, you're more likely to be kidnapped, and it's quite a cottage industry. So there are differences that doesn't mean that ex parte were more valuable and they would be in a kidnapping situation to the kidnappers.

But it doesn't mean that to the to the client expats were more valuable it just meant that there's different crime trends as far as x plus a local nationals goes so that's why that was split up like that. And that's how we sort of presented the intelligence This is pretty much a threat assessment so for terrorism in Russia as an ex parte it's severe so we're justifying we're breaking it down the intelligence saying look, this is severe and also we would provide a little key that said this is what severe means. This is what high means. This is what moderate means. This is what guarded means. Islamabad terrorist threat against x patches Hi, there's one step down from the shower and guarded for local nationals.

Lahore, it was high again. more time just down the road from the horror it was Hi again. kidnap for ransom Pasha expats with severe high for local nationals lower for x packs in Islamabad because it's well guarded. And the same for local nationals. So you can see there's there's a difference. And that can affect the security decision making.

Okay, if we have to go to the shower, then we have to take lots and lots of care. We're not too bothered by criminals in Patiala, even though the few were extremely concerned about terrorism and kidnap ransom a particular group of experts. And that's how that sort of model that justified justification would play itself out as far as helping the security manager. And this would change remember, this whole thing's a cycle, you review it, and then if you're still sending people out to these places, in two months time, we would review it again. And some of those some of those skills might change. So scoring a rating.

You'll see this they had at airports they'll have in a train station, depending on what country you're in. rating or scoring the risks and threats, gives it a value. And this is useful when you're explaining what you think the threat is. So I've just explained sort of severe or how to justify your intelligence by looking at it from scoring it severe and high. And this is pretty much what it's what it says. So what it says five extreme, that'll be the severe on the other scale.

Different organizations have different scales, but it's typically one to five, sometimes just 123. And it doesn't really matter. one to five seems to be the communist. Why is it necessary because you want to paint a picture for the people you're speaking to. They'll take in information in different ways. So as long as well as having the low you would low would be green generally moderate would be blue.

Medium would be yellow, for high would be orange, five extreme would be red. Typically, there are a lot of different cuts color schemes, but you know, usually red means dangerous. So you would put that extreme sometimes it's black. But that's hard to put into reports and doesn't look too good. But the other problem is orange and red seem to meld a bit and reports as well as you have to sort of look at it and say what's going to work for us. So the simplest method method is over rating of scoring the threat low is very unlikely that an incident will occur so you're talking about someone like Norway more maybe moderate it's unlikely then in some will happen maybe Ireland if you look geographically medium, the UK the US it's possible something's gonna happen.

Doesn't happen every day. But something is possible something will happen. Now the force you start to look at more your more riskier countries. The ones that NGOs tend to operate in are tend to be so high medium, so I want to say high, medium, upper medium, into high and then into Extreme which, of course, is your Afghanistan's, you're serious and around in some instances, because if you're sending expats over there to run NGOs, there's a good chance or a high chance that they may be arrested. North Korea may be in there as well in the mix between high and extreme not because security reasons, but your staff may get locked up, causing other problems. So it's not always bombs and bullets you have to think about and this is a good way of writing.

And I said that would go in conjunction with the coloring system. And here we have a different sort of similar, but different, how we rate the risks and threats. This is more complicated because it goes up to 25. This is just another example low guarded elevated high severe. This is probably too extreme. But on the left there, you're looking at catastrophic, critical, marginal, negligible none.

How what's the effect on your business Along the top is the frequency unlikely to happen seldom happens occasionally happens likely frequently. So let's look at terrorist incident. For instance, how often does it happen in your operational area? If it's occasional, okay, well, there's you and what would be the impact on your business? Well, terrorists don't normally go for business but they may go for the hotels, our staffs then. So it could be quite critical.

So you'd end up at E. In the middle there occasional critical where that crosses he would be elevated between 10 and 14.9. There's other components to this that will put the score up. This is just a simple start looking at the risks and threats and that would be a significant risk of event. Increased surveillance of critical locations, coordinate emergency plans, staff location awareness, make sure you know where they are all times and how to communicate with them. Increase procedural awareness increase alerting and advisories. So we're sending out alerts as frequently as they come in.

And that explains it so that at the bottom of a report or an annex, this would be describing what the risk rating of the threat level is in your country. And this would explain why, sorry, or your or your city. And here's another way of doing it. This is the one to five low to severe or low to extreme. As you've already seen, this has got a moderate Plus, there's nothing stopping you're building your own little model, something that's not quite as safe as a moderate, not quite as dangerous as a high. Maybe that it's going up that way.

So it, you would look at it and go Where does this particular threat fit on this scale have to moderate Plus, there's an increased likelihood of civil disorder. are ongoing issues not linked with your organization in that country. But there's definite social and political tension. And I don't mean may mean that that's the only threat the rest of the stuff, the terrorism, the crime is all pretty good. So it's still in a moderate sort of country. But there are there is that one area of concern, and that gives us sort of Madrid plus batch.

How others do it Australia. This explains how they they look at there's level one, level two, level three, this is all about travel safety on the internet. UK does it as well. They do low, moderate, substantial, severe and critical. Same thing one to five low to high or sorry, extreme, low to severe, low to critical in this case. We see the same sort of pattern.

And then you prioritize Oops, sorry about that. And then you prioritize What you're looking at what is most likely to happen, and this is usually the top three, road accidents, health or accident, someone falling down the stairs at work or someone getting ill, or the fire risk in your office, not the terrorism, not the serious crime. These are usually the three they'll happen on a day to day basis. And then you look at all the other stuff and you prioritize that as well. So you tend to end up with a list of maybe 2023 incident types that could adversely impact the safety of your staff. So that's prioritization, then you look at each one.

What about that could affect the safety and then you do it again week after week. And then you get a threat level of course, to say well this is high. The threat of road accident is high, bright orange for lighter five That's how it sort of works together. And that's a combination of security and risk management, and intelligence gathering or information gathering. All the information you get about all the threats in your country or your operational area or your tactical area goes into that bucket. And this is how you justify it and give it various levels so that you security manager, or yourself, can sell it to the client or sell it to your employer.

And that's it. That's the first one and there's been a fair bit. There's a lot more than I thought when I was putting the slides together, because I'm talking over it and waffling in some areas, but I hope it's been pretty useful. Again, let me know if you have any questions.