Chapter 2

Intelligence Theory

"Many intelligence reports in war are contradictory; even more are false, and most are uncertain. What one can reasonably ask of an officer is that he should possess a standard of judgment, which he can gain only from knowledge of men and affairs and from common sense. He should be guided by the laws of probability. These are difficult enough to apply when plans are drafted in an office, far from the sphere of action; the task becomes infinitely harder in the thick of fighting itself, with reports streaming in."1

                                                                                                                                                        —Clausewitz, On War

"It will be vital to identify centers of gravity rapidly and determine the critical vulnerabilities that will be our pathways to them. We won't always have the luxury of a passive foe, and there's no natural law that says that every high-tech war must be fought in a desert with unlimited visibility and good weather."2

                                                                                                                                                        —Carl E. Mundy

Having reached a common understanding of the nature of intelligence, we turn now to developing a theory about the intelligence process that in turn will serve as the basis for creating an effective intelligence system.


In war, it is easier to defeat an enemy we understand, even partially, than to fight an enemy who is an enigma. Intelligence is the means by which we come to understand the enemy. What is it about the enemy that commanders need to learn? The commander needs to gain knowledge at a variety of levels, ranging from that which is quantifiable to that which is purely intangible.

Obviously, we want to know the measurable things: the number of enemy personnel, armored vehicles, artillery pieces, and aircraft. We hope to learn the dispositions, organization, and locations of enemy forces. We also want to obtain technical specifications: the performance characteristics of enemy tanks and aircraft and the range and effectiveness of opposing weapons. Traditionally, intelligence has focused on these tangible factors. They usually provide a concrete image of the threat and the nature of its combat power. These tangible factors and images thus provide the foundation for de- veloping a more complete understanding of the enemy based upon other intangible factors.

While numbers definitely matter, they provide only partial insight into enemy capabilities. Less quantifiable and more subjectively deduced is the enemy's level of readiness—the state of his training, the quality of his leadership, and the morale of his forces. Commanders need to know the enemy's methods—his doctrine, tactics, techniques, and procedures—as well as his past performance in training and in combat. Even this is not enough. The successful commander cannot truly know an enemy simply through analysis of his physical environment, material might, and political and military institutions.

We must seek still more deeply for those moral and cultural forces which shape the enemy's actions. War is ultimately a human conflict, and much of human nature is decidedly illogical and incalculable. Developing sound intelligence requires an understanding of the institutions, preferences, and habits of a different culture. Commanders must appreciate the values, goals, and past experiences which motivate the enemy. We must gain insight into why he fights. To know what motivates an enemy to action requires an identification and appreciation of what the enemy holds dear.

Coming to grips with the intangible aspects of the enemy situation is much more difficult than assessing those factors that are quantifiable, but it is essential if commanders are to truly understand an enemy. This is exactly what intelligence must endeavor to do—to understand what factors shape an enemy's behavior in order to describe or explain that behavior.

When we try to understand an enemy, it is important to visualize the enemy as he sees himself and to see the situation as he views it. While gaining an objective appreciation for the enemy's capabilities is important, it is equally important to appreciate how the enemy perceives his own capabilities, since it is this image that will have the greatest influence on his actions. The enemy will do what he thinks is possible, not what we think he can do.

Seeing the situation from the opponent's perspective is especially important when confronting an adversary with a significantly different set of cultural or societal values. Enemy behavior which appears irrational—and therefore surprising—to us may in fact reflect perfectly reasonable and even predictable actions, given the enemy's values or the information available to him at the time. Consider the use of the banzai charge and kamikaze attacks by the Japanese in World War II or employment of women and children as shields to cover the actions of Somalian clansmen against U.N. forces. None of these actions is rational when viewed from a Western perspective. However, within the context of Japanese or Somalian societal norms, they are less surprising. A commander who fails to understand the enemy on his own terms risks a fundamental failure to understand the very nature of the conflict.

Finally, intelligence should strive to determine not only the enemy's capabilities but also his intentions. Intelligence estimates deal in both: they describe what an adversary can do, and they attempt to discern what he will do based upon possibilities and probabilities. Ideally, intelligence should identify several possible scenarios, answering questions such as: Which is the most likely enemy course of action? Which is the most dangerous? Intelligence should also correlate the effect of possible enemy actions on friendly plans.

The goal is, therefore, to obtain as complete an understanding of the enemy as possible. The ultimate purpose in seeking this understanding is to identify enemy centers of gravity and critical vulnerabilities and other limitations that may be exploited to defeat him: weaknesses in specific warfighting capabilities, numbers, or dispositions; technical deficiencies in weapon systems; or shortcomings in readiness, leadership, or morale. Conversely, intelligence should provide warning of particularly dangerous enemy capabilities that pose a threat to friendly forces.

There are practical limitations to achieving this level of understanding. The effects of uncertainty on intelligence have already been discussed, but it is worth repeating that gaps in our knowledge of the enemy situation are natural and unavoidable. Furthermore, attaining in-depth knowledge on the variety of potential threats confronting Marine forces is a significant challenge. Our education, cultural appreciation, and experience may be insufficient to provide detailed insight into an adversary without extensive study. The time required for this study may not be available when responding to a developing crisis. In these situations, we build as complete a picture of the enemy as possible in the time available—relying primarily on known factors and likely capabilities—while striving to fill in that picture rapidly as our understanding of the adversary grows.

An example of this approach can be seen in the history of Marine forces' involvement in Somalia. When the 15th Marine Expeditionary Unit landed in Mogadishu to begin Operation Restore Hope in December 1992, Marines had only a basic understanding of Somalian culture, the clan structure, and the threat it presented to U.S. and U.N. forces. Intensive intelligence development, in particular through human intelligence operations, rapidly increased our level of understanding. This intelligence was used over the course of the campaign to plan and execute numerous successful tactical actions that in turn further enhanced the intelligence picture. When the Marines of I Marine Expeditionary Force (MEF) returned in February of 1995 to assist in the final withdrawal of U.N. forces, they were able to draw on an extensive reservoir of intelligence to plan and execute Operation United Shield. Based on this intelligence, I MEF prepared a "playbook" of responses to cover virtually any Somalian reaction. Further, the playbook evolved as new intelligence was produced and the intelligence estimate changed. The detailed intelligence available contributed directly to the safe and effective accomplishment of the mission.3


In the previous chapter, we discussed our expectations of intelligence—its capabilities and limitations as well as what can and cannot be reasonably expected of intelligence. As the next step in developing a theory of intelligence, it is important to describe the characteristics of good intelligence.

First, intelligence should be objective—as free as humanly possible of bias or distortion. We have already noted that a significant problem in intelligence is not the lack of information, but the difficulty in interpreting that information correctly. Intelligence can be distorted if we attempt to make it conform to preconceived notions, fail to view the situation from the enemy's perspective, or manipulate the intelligence product to support a particular decision or conclusion. For example, prior to Chinese intervention in the Korean War, there were ample indications and warnings of imminent Chinese involvement. However, despite availability of much factual information to the contrary, strongly held preconceptions led commanders and their intelligence officers to conclude that the Chinese would not intervene.4 Unfortunately, data and information are almost always susceptible to more than one interpretation and can be manipulated consciously or uncon- sciously to support preconceived notions.

Second, intelligence should be thorough, meaning that it satisfies the intelligence requirements of the commander. Thoroughness does not imply completeness and certainty to the last detail, but rather sufficient depth to assist the commander in reaching sound decisions and developing effective plans. Intelligence personnel should not only identify for the commander what is known but also what is not known. The commander may then assess the risks and decide what actions are worth these risks.

Third, intelligence should be accurate, meaning that it should be factually correct. Sound estimates of the enemy's capabilities and intentions must agree with the facts at hand. Since intelligence cannot be precise to the last detail, commanders must have an appreciation of the reliability of a particular intelligence assessment or product.

Fourth, intelligence must be timely, meaning that it must arrive in the hands of appropriate decisionmakers in time to affect tactical decisions. Intelligence does not exist for its own sake, but as the basis for taking effective action. The most accurate and valuable piece of intelligence is of no use if it arrives too late to be acted upon. Some kinds of intelli- gence are more time-sensitive, or perishable, than others—a warning report, for example, is a type of intelligence product that tends to be highly perishable. It is important to keep this time-sensitivity in mind when dealing with any intelligence product.

Fifth, intelligence should be usable, appearing in a form meaningful to and easily assimilated by decisionmakers. Good intelligence should be concise and clear. It must create coherent images—meaningful mental pictures that are immediately and easily understood—rather than present the commander with a mass of unfocused data. Because we generally understand information better when it is presented in the form of images, we attempt to present intelligence in a visual format whenever possible.

Sixth, intelligence should be relevant in that it supports the commander's planning and decisionmaking requirements. Relevance means that intelligence is pertinent to the level of command for which it is intended. Relevance means also that commanders are provided information and intelligence bearing significantly on the situation at hand and that they are not burdened with information and intelligence of minimal or no importance. Intelligence that is tailored appropriately for one commander may be too generic or too detailed for commanders above and below that particular level. However, it may be extremely difficult to know in advance what is relevant and what is not. This leads again to the necessity for commanders to focus the intelligence effort.

The value of providing relevant intelligence is illustrated by the following example. Following the bombing of the Marine Corps compound in Beirut in 1983, Department of Defense investigators faulted commanders and intelligence for inundating on-scene commanders with information and failing to provide them with timely intelligence tailored to their specific operational needs.5 While information overload was certainly not the only cause of the Beirut tragedy, more focused intelligence might have helped commanders prevent its occurrence or at least take greater security precautions.

Finally, intelligence must be available—which means that it is readily accessible to appropriate commanders. Availability is a function of both timeliness and usability, but it is also a function of an effective information management system that allows commanders at various levels to readily access the intelligence they need. Availability also means that relevant basic intelligence has been developed in advance and that intelligence assets are maintained in readiness to develop other intelligence products as needed. Finally, availability is a function of effective use of security classifications that protect sources of information while at the same time ensuring that commanders have reasonable access to intelligence.

This discussion is not meant to specify a checklist for what does or does not constitute good intelligence, but to describe the general characteristics which effective intelligence tends to exhibit to one degree or another. Few intelligence products will exhibit all the above characteristics. Some of the characteristics such as timeliness, usability, and availability are mutually supportable. Others such as timeliness and thor- oughness can be in conflict. The extent to which actual intelligence demonstrates each of these characteristics depends on the particular situation.


If we could describe a complete intelligence picture—one that provides us everything we need to know about a given situation—that description would include knowledge of established conditions which have existed in the past, unfolding conditions as they exist in the present, and conditions which may exist in the future. Our complete image would include what has been, what is, and what might be. With this background, two classes of intelligence are defined. The first is descriptive intelligence, which describes existing and previously existing conditions. The second class, which attempts to anticipate future possibilities and probabilities, is estimative intelligence.

Descriptive intelligence has two components. The first is basic intelligence. Basic intelligence is general background knowledge about established and relatively constant con-ditions. Basic intelligence is often compiled in advance of potential operations and retained in databases or reference publications. Basic intelligence might describe the geography, culture, economy, and government institutions of a potentially hostile nation or area. With regard to the military capa- bilities and limitations of potential enemies, basic intelligence might detail the size, organization, and equipment of their military forces. These factors may change, but only slowly.

Basic intelligence is often encyclopedic in nature and is consequently often the most mundane. While it tends to be the easiest to gather, often being available through open sources, the depth and detail of the intelligence required to support most operations makes developing basic intelligence a labor-intensive and time-consuming task. Of all the types of intelligence, basic intelligence tends to be the most accurate and reliable. However, basic intelligence is also the most general and least time-sensitive. By itself it rarely reveals much that is decisive. Further, since basic intelligence does not address specific situations, it rarely provides sufficient knowledge for effective decisionmaking. Nevertheless, basic intelligence establishes the necessary foundation for building a more complete intelligence picture.

Descriptive intelligence also includes current intelligence, which is concerned with describing the existing situation. In general, current intelligence describes more changeable factors than those addressed by basic intelligence and is therefore more time-sensitive than basic intelligence. For example, while basic intelligence reports climatic norms, current intelligence describes existing weather conditions and its effects on operations; while basic intelligence shows enemy doctrine and organization, current intelligence depicts actual dispositions, movements, and patterns of activity. At higher levels, basic intelligence describes economies and forms of government; current intelligence addresses ongoing enemy war preparations or the status of relations with other hostile or potentially hostile nations. As a rule, current intelligence tends to be more specific than basic intelligence but less reliable and harder to obtain. Basic intelligence provides the broad picture upon which current intelligence expands by adding specific details about the existing situation.

Estimative intelligence, the second class of intelligence, focuses on potential developments. Developing estimative intelligence is perhaps the most important and at the same time most demanding task of intelligence. Estimative intelligence evaluates the past as delineated by basic intelligence and the present as described by current intelligence and seeks to anticipate a possible future—or several possible futures. It is concerned with determining when, where, how, or even if an enemy or potential enemy will attack or defend. Commanders cannot reasonably expect estimative intelligence to precisely predict the future; rather, estimative intelligence deals with the realm of possibilities and probabilities. It is inherently the less reliable of the classes of intelligence because it is not based on what actually is or has been, but rather on what might occur.

Although described as conceptually distinct, the two classes of intelligence are inseparable. Descriptive intelligence provides the base from which estimative intelligence assesses possible or probable futures. Without both classes of intelligence, it is impossible to develop a full image of a hostile situation.


Another way to frame this same discussion is in terms of capabilities and intentions. Descriptive intelligence attempts to discern enemy capabilities and existing conditions. It attempts to answer the questions: "What conditions currently exist? What can the enemy do? What can't he do?" Estimative intelligence attempts to discern enemy intentions and future conditions. It asks: "What conditions will probably exist in the future? What are their effects on friendly and enemy capabilities and courses of action? What might the enemy do? What is the enemy most likely to do?" Although the answers to all these questions are estimates rather than certainties, generally we can assess enemy capabilities with greater precision than enemy intentions.

Estimating enemy capabilities is largely a matter of interpreting the facts. Estimating enemy intentions, however, is a matter of far less certainty. Intentions exist only in the enemy's mind. In any given situation, an enemy commander will probably have several courses of action available. There may be little or no indication of which one he favors. He may be intentionally attempting to conceal his intentions from us, or he may be trying to keep more than one option open. He may be gripped by indecision and not know what he intends to do. Furthermore, he can change his mind. He can respond to changes in the situation or our own actions in ways we cannot anticipate.

Complicating this problem is the reality that an enemy's intentions are normally the product of thought processes different from our own. We are sometimes surprised when an enemy takes an action which we consider to be irrational. However, when viewed from the perspective of the enemy's cultural norms or values, his actions may be perfectly logical and predictable. Unfortunately, it is extremely difficult to gain the depth of insight needed to understand the thought process of each and every potential adversary we face. Our own values and cultural background will always be a significant obstacle in estimating the intentions of terrorists willing to blow themselves up in suicide bombings or a dictator who would inflict massive damage on the environment by setting hundreds of oil wells on fire.

Enemy capabilities and enemy intentions are closely related. Capabilities establish the limits of intentions; the enemy cannot intend to do something beyond his capabilities and accomplish it successfully. However, it is crucial to note that it is not actual capabilities that matter, but the enemy's perception of his capabilities. The enemy will act based on his perception of his capabilities. His perception may or may not agree with our evaluation of what he can or cannot do. Our analysis of enemy forces in South Vietnam did not credit the North Vietnamese and Viet Cong with the capability to launch a nationwide offensive in 1968. The Tet offensive of that year clearly demonstrated that the enemy believed other- wise.6 Again, a key element in assessing both capabilities and intentions is the ability to view the situation as the enemy perceives it.

Analysis of capabilities and analysis of intentions are by no means incompatible. Any effective intelligence picture must provide insight into both. Without some appreciation of enemy intentions, it is extremely difficult to decide on an effective plan of action. However, without an understanding of the enemy's capabilities, it is impossible to estimate his intentions.


Complicating our ability to assess capabilities and estimate intentions is the problem of interpretation of the information we collect. To develop objective and accurate intelligence, we must understand this problem. We can examine it through a discussion of signals and noise.7

Signals refer to those pieces of information commanders receive that, if properly interpreted, can lead to valuable in- sight about the situation. Signals help with our situation assessment. Noise, on the other hand, refers to various pieces of useless information—information which is false, out of date, inaccurate, ambiguous, misleading, or irrelevant. An enemy may intentionally present a foe with noise in order to mislead, but noise is not necessarily the product of an enemy deception. Like static on a radio, noise interferes with our reception and interpretation of valuable signals.

The difficulty is to distinguish signals from noise. Unlike the distinction between radio static and the true signal, the difference between true and false information is rarely easy to distinguish. We endeavor to identify critical enemy vulnerabilities, but signals of such vulnerabilities are rarely clear at the time. The recognition of what is important, relevant, and accurate sometimes becomes clear only in hindsight—if then.

Clausewitz advises that, "A sensitive and discriminating judgment is called for; a skilled intelligence to scent out the truth."8 Just as judgment is no substitute for good intelligence, intelligence is no substitute for good judgment. The two must go hand in hand.

This point illustrates the importance of mindset to intelligence. A mindset is a set of assumptions, biases, and preconceptions. A mindset reflects a preexisting image of what is reasonable; it serves as a filter that helps to distinguish the signals from the noise. The human tendency is to be more receptive to information that is consistent with one's mindset and more skeptical of information that is not. In other words, information that is consistent with an existing mindset is interpreted as signals, and information that is not is construed as noise.9

Every individual possesses a unique mindset. Biases and preconceptions are also indispensable to intelligence. Without them, it would be impossible to make sense of the available mass of confusing and sometimes contradictory information. Mindsets serve as a frame of reference, enabling us to quickly categorize and assess the relevance and reliability of vast amounts of information. Without a preexisting mindset, commanders would likely be overwhelmed by the amount of information and unable to distinguish between signals and noise.

At the same time, mindsets always bring the danger that we will subconsciously interpret intelligence to comply with our preconceived notions rather than with reality. This hazard applies equally to the producers and users of intelligence.

The danger of preconceived notions and their impact on signals and noise is illustrated by this example from the Arab-Israeli War of 1973.10 In October 1973, a simultaneous Syrian and Egyptian attack caught the Israeli army badly unprepared. There had been plenty of signals of the Egyptian intentions. The Israeli high command had extremely detailed and accurate information on their enemies' order of battle, unit locations, armaments, and readiness status. In fact, Israeli intelligence was fully aware of unprecedented forward de- ployments of enemy troops and ammunition stocks. Nonetheless, the possibility of war was discounted until just 8 hours prior to the beginning of the Arab offensive.

The problem was not lack of information, but an inability to filter out noise coupled with reliance on a set of rigid and faulty preconceptions. The Egyptians employed a variety of deception activities, both political and military, to create noise. Included were the continued preparation of defensive positions, repeated repositioning of units along the front, and the use of training exercises as a cover for forward deployments.

Despite the effort to deceive, Israeli intelligence detected most of the key preparations for war. However, even though there was information pointing to an impending attack, the Israeli mindset prevented accurate interpretation of it. The Israelis believed that any Arab attack would be based on military rather than political or psychological factors. Since the Israelis felt that Syrian or Egyptian armies had no capability to conquer substantial territory from Israel, they discounted any possibility that the Arabs would attack. In fact, the Arab objective was not territorial conquest, but creation of a diplomatic crisis that would be resolved in their favor. Compounding the Israelis' misreading of Arab intentions was the failure of Israeli intelligence to objectively assess Egyptian military capabilities. The Israelis' preconception that the Egyptian army was incompetent caused them to dismiss any possibility that the Egyptians could mount an effective attack. Due to Israeli bias and preconceptions, an overwhelming body of first-rate intelligence that would have provided adequate warning of the attack was simply dismissed as irrelevant.

We seek to develop a balanced mindset that provides a sensitive and discriminating judgment which is not so entrenched that it deafens us to alternative signals. One of the most valuable contributions intelligence personnel can provide is unbiased analyses to uncover and guard against dangerous preconceptions.


A complete intelligence picture must also provide insight into the enemy as a complete entity or system, not merely as a collection of unrelated individuals, units, or organizations. Companies, batteries, or squadrons normally do not act inde- pendently. They conduct operations in accordance with the plans and orders of a senior headquarters that in turn is attempting to achieve some strategic or operational objective. In order to understand what the enemy unit directly opposite us is doing now or what it might do in the future, it is usually necessary to examine the capabilities and intentions of enemy units and commanders two levels or more above our immediate adversary.

Developing this type of understanding requires us to consider that intelligence cuts across the three levels of war: tactical, operational, and strategic. As this intelligence varies in terms of scope, application, and level of detail, we divide intelligence into levels which correspond to the levels of war. Tactical intelligence concerns itself primarily with the location, capabilities, and possible intentions of enemy units on the battlefield and with the tactical aspects of terrain and weather. Operational intelligence pertains more broadly to the location, capabilities, and possible intentions of enemy forces within the theater and with the operational aspects of geography. Finally, strategic intelligence is broadest of all in scope and addresses the factors needed to formulate policy and military plans at the national and international levels.

Marine Corps intelligence focuses on tactical intelligence, which is the level of intelligence Marines need, generate, and use most often. However, in order to operate effectively, Marine forces require ready access to operational and strategic intelligence, as well as tactical, to comprehend the larger situation and provide appropriate context for the development of tactical intelligence products.


A unit's intelligence effort begins with receipt of the mission and the commander's guidance. On-hand intelligence is rarely sufficient to support comprehensive planning and decisionmaking needs—gaps will remain. Such intelligence gaps are known as intelligence requirements.

Intelligence requirements are questions about the enemy and the environment, the answers to which a commander requires to make sound decisions. The breadth of potential intelligence gaps, however, will generally far exceed organic intelligence capabilities. Thus, it is important to focus intelligence operations on those intelligence requirements crucial to mission success. We call these requirements priority intelligence requirements.11

Priority intelligence requirements are intelligence requirements associated with a decision that will critically affect the overall success of the command's mission. Priority intelligence requirements constitute the commander's guidance for the intelligence collection, production, and dissemination efforts.

The nature and scope of intelligence requirements will vary with the level of command and its mission. Further, the type of operation and at what particular phase of planning or execution the commander states a requirement will be major influences on its breadth and complexity. However, it is the commander who designates the priority intelligence requirements and therefore provides direction to the intelligence effort.

The importance of clear and focused intelligence requirements was demonstrated during the recovery of Air Force pilot Capt Scott O'Grady from Bosnia in June 1995. After Capt O'Grady was shot down, the 24th Marine Expeditionary Unit (Special Operations Capable) afloat in the Adriatic was placed on alert to conduct a tactical recovery of aircraft and personnel (TRAP) mission. Upon notification that a signal had been received from Capt O'Grady's recovery beacon, the MEU commander designated three priority intelligence requirements: determine Capt O'Grady's exact location, update and reassess air defense threats to the TRAP force, and identify and describe flight hazards to the TRAP force. The clear identification of the critical intelligence needed to execute the mission enabled the MEU intelligence section to concentrate its effort on satisfying those requirements in the few hours it had available.12


Intelligence information comes from a wide variety of information sources, ranging from a reconnaissance Marine with a pair of binoculars to a sophisticated electronic sensor. Intel- ligence information may be derived from any Marine, other human sources, imagery, radar, signals, other emissions or signatures, and open-source references. Effective intelligence operations employ all information sources, whether organic or external. The value of a source is not necessarily related to the sophistication or cost of that source. Sources of information must be appropriate to the nature of the particular intelligence requirement; that is, the collection method or capability used must be appropriate to the aspect of the enemy or the en- vironment about which information is needed. For example, electronic intelligence will likely be of little use against a technologically unsophisticated enemy; human intelligence sources will generally be more valuable. We must tailor the sources to the requirement, ensuring that we exploit both the observations of units in direct contact with the enemy and our more sophisticated sensors.


Intelligence performs six specific functions in order to provide knowledge of the threat and the surrounding environment as well as to deny that same knowledge to the enemy.

The first function of intelligence is to support the formulation of the commander's estimate of the situation by providing as accurate an image of the hostile situation as possible. Through this function, intelligence helps the commander gain an initial appreciation for the terrain, weather, and other aspects of the operational environment. Intelligence personnel use techniques (such as intelligence preparation of the battlespace) to estimate enemy capabilities, intentions, vulnerabilities, and possible courses of action. In this manner, intelligence supports initial decisionmaking and planning.

The second function of intelligence is to aid in situation development—to provide continuing knowledge of unfolding events to help update the commander's image of the hostile situation. While the commander's initial estimate of the situation takes place before execution and provides the basis for the plan, situation development occurs during execution and provides the basis for adjusting plans to adapt to new circumstances or to exploit opportunities as they arise.

The third function of intelligence is to provide indications and warnings. Indications and warnings serve a protective purpose, namely to provide early warning of potential hostile action and thereby lessen the chance of being surprised. Properly used, indications and warnings act as alarms. They alert us to developments that run counter to the commander's planning assumptions and understanding of the situation in time to take necessary actions or precautions.

A fourth function of intelligence is to provide support to force protection. Force protection includes defensive operations, security measures, and collection activities undertaken by a commander to guard the force against the effects of enemy action. Intelligence supports the commander's force protection needs by estimating an enemy's intelligence, ter- rorism, espionage, sabotage, and subversion capabilities as well as recommending countermeasures against those capabilities. Support to force protection requires detailed assessments of both the capabilities and intentions of the enemy. A successful program of force protection lessens the enemy's ability to take offensive action against us.

The fifth intelligence function is to support targeting, a function that intelligence shares with operations. Targeting is the process of acquiring information about targets and choosing the best method for attacking those targets. Intelligence supports this process by locating and portraying targets for attack and by estimating the vulnerability and relative importance of those targets. Targets may be physical targets such as a bridge or enemy position, or they may be functional targets such as the enemy's command and control system.

The final role of intelligence is to support combat assessment. Combat assessment is the process used to determine the effects of friendly actions on the enemy. It includes battle damage assessment which refers specifically to the effects of friendly fires on enemy targets. It also applies more broadly the overall effects of friendly actions on enemy capabilities and intentions. Combat assessment provides the basis for future friendly actions as well as a dynamic link back to the first step of the intelligence cycle.


Safeguarding intelligence is an essential consideration. Intelligence is normally less valuable if the enemy is aware of what we know. If the enemy concludes that we are in posses- sion of a key piece of intelligence, he will likely change his plans and thus invalidate the intelligence. Security is important not only because it protects a specific piece of intelligence but also because it protects the sources upon which the intelligence is based. Thus, in the interests of security, the dissemination of and access to intelligence is often restricted.

A tension exists between the legitimate need for security and the essential need for dissemination. On the one hand, we must protect not only the value of individual pieces of intelligence but also the sources which we depend upon to provide additional valuable intelligence in the future. On the other hand, intelligence is useless unless it can be acted upon; to be of value, intelligence must be in the hands of the decisionmakers who plan and execute military operations. Finding the proper balance between greater security and wider dissemination is a matter of reasoned judgment based upon the situation, the nature of the intelligence, and the sources involved.13

An example of the judgments involved in balancing security and dissemination can be seen in the use of signals in-telligence during World War II. The Allies had significant success in breaking both German and Japanese codes during the war. Because of the sensitivity of the intelligence derived from communications intercepts, the desire to ensure continued availability of this source of intelligence, and the ease with which the enemy could have taken measures to protect their communications, access and dissemination were tightly controlled. Commanders were faced with difficult choices in deciding when and how to use this intelligence, weighing the potential gain against the risk of compromising the source of intelligence. For example, when U.S. cryptologists intercepted advance notification of an inspection tour of the forward area by the commander in chief of the Japanese imperial combined fleet, Admiral Isoroku Yamamoto, American commanders had to decide whether or not to ambush Yamamoto's plane. In this case, they deemed the potential gain of elim- inating Japan's best military leader worth the risk of compromising the source of the intelligence. U.S. forces were able to shoot down Yamamoto's plane, resulting in his death—without compromising any U.S. intelligence sources.14


The intelligence cycle describes the general sequence of activities involved in developing intelligence. The cycle is not meant to prescribe a procedure to be followed, but simply to describe a process which generally occurs. The intelligence cycle has six phases through which information is planned, obtained, assembled, converted into intelligence, provided to decisionmakers, and, ultimately, used in making decisions. (See figure 2.)

The first phase in the intelligence cycle is planning and direction. This phase consists of the identification of intelligence requirements and the planning of intelligence oper- ations and activities to satisfy those requirements. The commander directs the intelligence effort; the intelligence officer manages this effort for the commander. In so doing, the intelligence officer is guided by the commander's intent, the established priority intelligence requirements, and specific guidance provided by the commander for the conduct of the intelligence effort. Planning and direction encompasses the supervision of collection, processing, production, and dissemination operations as well as developing the intelligence structure necessary to support planned or ongoing operations.

Figure 2

Collection is the second phase of the intelligence cycle. During collection, organic, attached, and supporting intelligence sources collect and deliver information to the appropriate processing or production unit—or, in some instances, directly to the appropriate commander for immediate action. Effective collection depends upon the use of a variety of mutually reinforcing sources. Necessary, planned redundancy and overlap of sources increase the reliability of information and can reduce the effectiveness of enemy deception or denial efforts.

Processing and exploitation is the third phase of the intelligence cycle, the conversion of raw data into a form suitable for the production of intelligence. Largely a technical function, processing and exploitation converts the data into an understandable form and enhances its presentation. Examples of processing and exploitation include developing and interpreting a piece of film, translating a foreign-language text, or decoding an encrypted radio report. Not all information requires processing; some is collected in a form already suitable for production. Sometimes processing and exploitation occurs automatically during collection.

The fourth phase of the intelligence cycle is production, the activities by which processed data is converted into intelligence. Production involves evaluating the pertinence, reliability, and accuracy of information. It involves analyzing information to isolate significant elements. It includes integrating all relevant information to combine and compare those elements of information with other known information. Finally, production involves interpreting the information to form logical conclusions that bear on the situation and that support the commander's plan to engage the enemy. Production is a process of synthesis—the most important action in developing usable intelligence for the commander. Production arranges the intelligence pieces to form coherent images. It is this step which adds meaning to these pieces, creating knowledge. Synthesis does not generally create a complete image—totally filling in the gaps and eliminating uncertainty—but it should provide an image from which the commander can reach an acceptable level of understanding. In the end, synthesis answers the all-important question: "What effect does all of this have on our ability to accomplish the mission?"

The fifth phase of the intelligence cycle is dissemination, the timely conveyance of intelligence in an appropriate form and by a suitable means to those who need it. Depending on its importance and time-sensitivity, intelligence may be dis- seminated— "pushed"—directly to users, or it can be sent to an accessible data base from which commanders can "pull" that intelligence which they need (see figure 3). Intelligence flows by any number of channels or methods. The form intelligence takes can influence dissemination. Some intelligence can be transmitted almost instantaneously to multiple users via a digital communications link, while other intelligence must be physically delivered by courier. The channel or means of dissemination is less important than the arrival of the intelligence at the proper destination on time and in a form readily usable to the commander. Depending on the urgency and time-sensitivity of the intelligence, it may follow established communications channels, or it may be broadcast to the entire force simultaneously as an alert or alarm.

The final phase in the intelligence cycle is utilization. The commander may provide direction, information may be collected and converted into intelligence, and the intelligence may be disseminated, but unless that intelligence is exploited through decision and action, it has served no purpose. Utilization is not a function of intelligence per se, but rather of command and control—making the decision and then carrying it out. This reinforces two important points made earlier: first, intelligence has no value for its own sake but assumes value only when acted upon; and secondly, intelligence is inextricably linked to command and control.

Figure 3

No one phase of the intelligence cycle is more important than the others—they are interdependent. Without proper direction, the other phases will be uncoordinated and ineffective. Without effective collection, there may be too much or too little information, and the information obtained may prove irrelevant. Without processing and production, the resulting mass of information may appear meaningless. Lengthening production time will delay dissemination. The first four phases of the intelligence cycle offer marginal value unless the intelligence arrives to the right person in time and in a useful form to support decisionmaking. Finally, intelligence operations are wasted if commanders fail to understand and act upon the knowledge intelligence offers. For simplicity, the intelligence cycle is described as a sequential method; however, in practice, it is a dynamic process responsive to changes in the situation and the commander's evolving in- telligence needs.


The method used to produce the U.S.'s intelligence assessment of North Vietnam's intentions for 1972 provides an example of the intelligence concepts discussed in this chapter.15 Forecasting the scope and intensity of the North Vietnamese Army (NVA) and Viet Cong (VC) operations within South Vietnam after the southwest monsoon season ended was the intelligence challenge.16

In seeking answers to these questions, intelligence analysts focused on a few key aspects of NVA and VC capabilities. The NVA logistics system often provided a reliable indicator of future activity. The level of NVA resupply activity usually reflected the scope and intensity of planned military operations. A related question was to determine the number of North Vietnamese soldiers moving into South Vietnam and, more specifically, to find out whether these were reinforcements or merely replacements for combat losses of the previous year.

Although there were weaknesses, by 1971 the overall quality of intelligence concerning NVA operations was good. The workings of the enemy's supply system, which had remained relatively unchanged for two decades, were well understood (see figure 4, page 66). Aerial infrared and radar imagery identified "hot-spots" of activity along the principal NVA resupply route, the Ho Chi Minh trail, and provided indications of the intensity of that activity. Remote ground sensors placed alongside key chokepoints transmitted data on the density and type of vehicular traffic. Long-range ground reconnaissance patrols, signals intelligence, translation of captured documents, and enemy prisoner of war interrogations all helped verify the accuracy of information collected by technical means and improved the overall intelligence picture. There were some problems in the intelligence system as well, one of which was the inability of U.S. intelligence agencies to process, analyze, and synthesize the huge volume of information collected by the technical sensors and other sources.

Figure 4

Analysis of the NVA logistics system did not uncover anything unusual or ominous. As for personnel, they appeared to be predominantly individual replacements with no new NVA or VC units identified. The bottom line of the estimate completed in November 1971 was that 1972 would be "business as usual" without any significant surprises.

By late December, however, new information began to challenge this estimate. The first clues resulted from the analysis of captured documents. A single analyst had detected subtle differences in the tone of South Vietnamese Communist Party documents (which were often filled with hidden messages since the enemy knew some of the documents would be captured) hinting at something big afoot. Shortly thereafter another analyst noted a sudden increase in the flow of personnel into the south. Further projections showed that if this higher level continued through January, it would greatly exceed numbers needed to replace combat losses.

These two indicators cued new collection operations and a renewed analytical effort. Particularly troubling was a photograph of a tank park located in North Vietnam near the South Vietnamese border. Such a concentration of combat vehicles had never been seen that far south. Finally, additional all-source analysis not only verified continued, unprecedented personnel replacements but also uncovered evidence that two new NVA divisions were headed south and would arrive by late February or early March.

The new intelligence caused a complete overhaul of the previous estimate. The new estimate was published in early January 1972. It concluded that the enemy had the capability to initiate a major escalation of the war during the 1972 dry season, beginning any time after the last week in February, using the equivalent of three new divisions and extensive armor forces. Additional hard intelligence indicated that major attacks would occur from the highlands of central Vietnam south to the delta region.

This revised intelligence estimate provided a minimum of 7 weeks' warning of impending enemy actions. This led to another challenge, one routinely faced by the intelligence professional: the more the user is told, the more the user wants to know. The new intelligence requirement was to determine more precisely the date the attack would begin. At the same time, operational commanders used the new intelligence to immediately launch an all-out bombing offensive to impede, weaken, or, if possible, destroy the NVA reinforcements. This had the effect of further complicating the intelligence task, as it was impossible to determine what effect the bombing would have on the enemy's plans. The predicted time for the offensive came and went, and the credibility of the estimate began to be challenged.

The bombing had only delayed the attack. On March 30, the NVA and VC launched an unprecedented offensive. Although not as widespread as the 1968 Tet offensive, it brought the commitment of division-sized regular units accompanied by armor and artillery units, some with weapons that outranged those of the U.S. and South Vietnamese. Even with the advance warning, combat actions were prolonged and intense.

Specific indications of the attack were much clearer for the south and central regions of the country and resulted in more effective defensive operations in those regions. Due primarily to the enemy's ability to better conceal his activities in the border region, intelligence did not adequately detect preparations for offensive operations in the northern region. The estimate did not predict major attacks on the north, and the NVA achieved significant successes in the border provinces.

The accuracy and timeliness of the updated January intel- ligence estimate was a key factor in ultimately repulsing attacks in the south and central portions of the country. Continuous evaluation of the standing estimate and a willingness on the part of two analysts in particular to challenge conventional wisdom led to this updated assessment. Once initiated, the collection of information from a variety of sources, coupled with in-depth knowledge of the enemy and detailed analysis, provided commanders timely and relevant intelligence they were able to apply to significant advantage.


Intelligence strives to build as complete a picture of both the enemy and the area of operations as possible. Such a picture is made up of a variety of factors—the concrete and measurable, the intangible and subjective, the environmental and cultural, the military and political—all of which must be assessed in order to develop the knowledge needed to support the commander's decisionmaking. Building this complete picture requires that we understand and apply the characteristics of good intelligence. Our intelligence picture must be comprehensive; it should combine relevant basic, current, and estimative intelligence from all levels of intelligence. It must include estimates of both capabilities and intentions. Finally, developing an understanding of the situation requires that we be able to distinguish between signals and noise—that we avoid the pitfalls of bias and preconception while interpreting collected information as objectively as possible.

We employ a variety of conceptual tools to help us in achieving our intelligence objectives. Properly defined intelligence requirements are crucial to providing focus to the intelligence effort. The six intelligence functions outline related tasks which, when accomplished, ensure comprehensive intel- ligence support to all phases of operational planning and execution. The intelligence cycle provides a process for the development of intelligence. The six steps in the cycle describe a coordinated sequence of activities which results in the production, dissemination, and utilization of accurate, timely, and relevant intelligence.

The object of the intelligence cycle is not to prescribe a procedure which, if successfully applied, will ensure the quality of the intelligence product. The criterion for good intelligence is not whether the different phases have been properly adhered to and whether an accurate, complete, and polished intelligence product has emerged. Likewise, the discussion of the characteristics of good intelligence is not meant as a checklist. These discussions are meant to emphasize that the sole criterion for good intelligence is whether it provides sufficient knowledge regarding the environment and an understanding of the enemy's capabilities, limitations, and intentions to effectively support the commander's planning and decisionmaking.

Chapter 1       Chapter3