The intelligence community has not always learned the lessons of its successes and failures. Lowenthal (2012) suggests a couple of reasons for why this might be: · First, intelligence consumers keep the intelligence community busy. Intelligence analysts and their managers rarely feel they have time to withdraw from their day-to-day work to assess the effectiveness of that work. We have already mentioned several times how analysts working in fast-paced, tactical environments are often hard-pressed managing their time to produce intelligence products, as it is, leaving little to no opportunity to learn from one’s mistakes or successes. · Second, members of the intelligence community tend to treat their products in a take-it-or-leave-it manner. If a decision-maker chooses poorly based on a less than perfect intelligence product, then the fault falls to him or her for failing to make wise choices. Intelligence analysts take pride in their technical competence and have a tendency to resist being audited or having their work reviewed. As a consequence, self-reflection seems to occur as a reaction to a failure rather than as part of a standard operating procedure. Intelligence Analysis: Process or Project? We often seem to straddle the line between thinking about intelligence analysis as a process and as a project. Seeing it as a process allows us to take a more organic approach, emphasizing what Clark (2007) would call its ‘social nature’.  Intelligence as a process gives primacy place to its character as a fluid, continuous activity underlying ongoing operations. It also allows us to fall into the trap of thinking that the way in which we work has no end point, excusing our professed inability to stop and assess the quality of our work. Many aspects of intelligence analysis, however, might benefit better from approaching it as a field of practice in which we manage projects. The Project Management Institute defines a project as “a temporary endeavor undertaken to create a unique product, service, or result” (2008, p. 5). Projects are understood in contrast to processes, which are ongoing, repetitive efforts following an organization’s standard procedures. Projects are distinct from processes not only because projects result in something new, but because they involve the uncertainties of creating something new. In criminal intelligence analysis, we already often deal with cases in our everyday lives that have specific starting points and specific ending points concluding with a specific product – hopefully a conviction in our case. Despite their resemblances, it would be fair to say that no two cases are exactly alike, which means every case results in ‘a unique product, service, or result’. When we think of cases as the result of finished projects, then we might think of criminal intelligence analysis – in so far as it contributes to cases – as projects themselves. The Project Management Institute states that recording experiences should be a prio ...

1. The intelligence community has not always learned the lessons
of its successes and failures.
Lowenthal (2012) suggests a couple of reasons for why this
might be:
· First, intelligence consumers keep the intelligence community
busy. Intelligence analysts and their managers rarely feel they
have time to withdraw from their day-to-day work to assess the
effectiveness of that work. We have already mentioned several
times how analysts working in fast-paced, tactical
environments are often hard-pressed managing their time to
produce intelligence products, as it is, leaving little to no
opportunity to learn from one’s mistakes or successes.
· Second, members of the intelligence community tend to treat
their products in a take-it-or-leave-it manner. If a decision-
maker chooses poorly based on a less than perfect intelligence
product, then the fault falls to him or her for failing to make
wise choices. Intelligence analysts take pride in their technical
competence and have a tendency to resist being audited or
having their work reviewed. As a consequence, self-reflection
seems to occur as a reaction to a failure rather than as part of a
standard operating procedure.
Intelligence Analysis: Process or Project?
We often seem to straddle the line between thinking
about intelligence analysis as a process and as a project. Seeing
it as a process allows us to take a more organic approach,
emphasizing what Clark (2007) would call its ‘social nature’.
Intelligence as a process gives primacy place to its character as
a fluid, continuous activity underlying ongoing operations. It
also allows us to fall into the trap of thinking that the way in
which we work has no end point, excusing our professed
inability to stop and assess the quality of our work. Many
aspects of intelligence analysis, however, might benefit better
from approaching it as a field of practice in which we manage
projects.

2. The Project Management Institute defines a project as “a
temporary endeavor undertaken to create a unique product,
service, or result” (2008, p. 5). Projects are understood in
contrast to processes, which are ongoing, repetitive efforts
following an organization’s standard procedures. Projects are
distinct from processes not only because projects result in
something new, but because they involve the uncertainties of
creating something new.
In criminal intelligence analysis, we already often deal with
cases in our everyday lives that have specific starting points and
specific ending points concluding with a specific product –
hopefully a conviction in our case. Despite their resemblances,
it would be fair to say that no two cases are exactly alike, which
means every case results in ‘a unique product, service, or
result’. When we think of cases as the result of finished
projects, then we might think of criminal intelligence analysis –
in so far as it contributes to cases – as projects themselves.
The Project Management Institute states that recording
experiences should be a priority for any organization that
manages the uncertainties inherent in creating a new product.
Lessons learned and historical information contribute to an
organization’s knowledge base. A lessons learned record should
include all the documents related to an intelligence analysis
operation. Records should outline each major step in the
operation and state the thought processes behind any major
decisions. Since all intelligence analysis involves risk and
uncertainty, the record should state areas were key assumptions
were made and what steps were taken to manage risk.
· A lessons learned body of knowledge is more than just a
dossier of documents describing what happened. It also includes
assessments of the product’s overall effectiveness, areas of
unforeseen successes, and recommendations for how challenges
might be overcome if faced in the future.
On the first point, it should include feedback from end users on
how well final products met their needs. On the second and
third points, all analysts experience variances in the quality of

3. their work. Performing quality control requires identifying the
reasons behind these variances, articulating corrective actions
taken, and measuring their performances. Ideally, this activity
will take place throughout the intelligence cycle, but at a
minimum they should be performed at the end of a substantial
project or case.
Lessons Learned Initiatives
The intelligence community as a whole has seen a shift in its
composition that has affected the level of technical expertise in
its ranks (Lowenthal, 2012). At the national level, the Cold War
spurred large investments in a robust intelligence collection and
analysis capacity. With its conclusion in the 1990s, many older,
experienced intelligence professionals retired from the
community and were not replaced thanks to budget cuts
correlating to a reduction in defense spending in general.
After the attacks of September 11, 2001, the intelligence
community received a rapid injection of funding that in some
respects surpassed its ability to absorb. Young analysts were
hired, sped through abbreviated training programs, and set to
work on intelligence problems for which they were often ill
prepared. They had access to only a limited numbers of mentors,
most of who had spent their careers addressing traditional
threats through traditional means that could not manage the
level of complexity new threats involved.
· Meanwhile, intelligence reforms focused on strengthening
intelligence collection capabilities and cross-agency
information sharing, leaping over the need to advance the field
of intelligence analysis. The DNI eventually identified this
omission and has since sought to build a lessons learned
knowledge base that can be re-invested into the intelligence
community, but levels of investment in terms of time, funds,
and personnel seem to remain a low priority.
A few examples in the intelligence community do exist for
proactively assessing the quality of one’s work and building a
body of knowledge based on an analysis of past experience.
For instance, the U.S. Army operates a Center for Army Lessons

4. Learned (CALL). CALL issues a wide array of succinct
handbooks for military commanders on dealing with challenges
that influence their mission success in the contemporary
operational environment. CALL relies on a rotating group of
professionals with operational experience in various areas
deemed critical for mission success. These professionals have
worked on the ground in environments where key challenges
have been identified.
In between these field experiences, they are called upon to meet
with others who work under similar conditions, to interview
them on what went well (and what went poorly), and to process
this information into suggestions for the future. A review of the
CALL website reveals papers on supporting Agribusiness in
Afghanistan, paying informants in a deployed environment,
responding to disasters, and even setting up a lessons learned
program at the unit level. The intention is to keep commanders
informed about new trends that affect their operations and to
increase the overall quality of their decision-making. The other
branches of the military have their own, similar versions.
In 2004, the Department of Justice established the Criminal
Intelligence Coordination Council (CICC)to implement 28
recommendations stated in the National Criminal Intelligence
Sharing Plan. The CICC’s stated mission is to support the
development of criminal intelligence standards for information
sharing, technologies, and training. The CICC operates the
National Criminal Intelligence Resource Center (NCIRC), but it
is only available on secure networks used within criminal
intelligence organizations. The emphasis of the CICC and the
NCIRC does not appear heavily focused on the development of
criminal intelligence analytical tradecraft, echoing the
persistent need Heuer and Pherson describe for supporting
increased professional competence of intelligence analysts at all
echelons.
The most dynamic area of analysis about intelligence analysis
may be the academic research sector. Independent universities,
government-funded think tanks, and non-governmental

5. organizations have made active contributions to the public’s
understanding of intelligence analysis and have increased the
intelligence community’s awareness of best practices by leaps
and bounds.
· An example of such work, made available for your review as
this week’s supplementary material, is a short book published
by the Joint Military Intelligence College to educate
competitive intelligence professionals about intelligence
analysis lessons learned from the national and military
intelligence sectors (Krizan, 1999).
Though it predates post-9/11 intelligence reforms and so it does
not address common intelligence practices exactly as we have
addressed them in this course, it does provide an example of
information sharing across intelligence disciplines at the macro-
level.
During Week 2 we looked Hansen’s article on the future of US
intelligence (2004), which was published in the International
Journal of Intelligence and Counterintelligence – a very useful
resource of tracking trends in research about the field of
intelligence and intelligence analysis.
The journal Intelligence and National Security covers historical
reviews of intelligence issues, while theJournal of Homeland
Security and Emergency Management focuses on reporting
innovations in field operations and cutting edge academic
research primarily focused on the state and national levels. As
students of intelligence analysis, we should develop an
awareness of other journals and the work of specific researchers
on areas of our interest that appear in journals not specific to
intelligence.
Victory!
Welcome to the final chapter in the story of our 8-week
exploration of criminal intelligence analysis. We have talked
about tools and techniques used to process and exploit
intelligence information in order to produce intelligence
products. And we have seen how many of these activities fit

6. within the broader scope of the intelligence analysis enterprise.
Finally, we have applied these discussions toward adapted real-
world scenario.
Now it is time to pause a moment, to organize our materials,
and to make a record of our successes and failures, our
challenges and our learning, so that those who come after us
will have the advantage of our insights and experience.
Scenario
Last week, Chief Heaton authorized a raid against El Movi
based on your recommendations. The action led to
the successful apprehension of its targets without anyone
getting hurt. While some of the members of the organization not
present where direct action occurred did escape, Chief Heaton is
confident that over time they will surface again. For now,
prosecutions are underway. But perhaps more importantly, El
Movi is no longer a functioning organization and its victims are
safe.
Chief Heaton has been impressed with the quality of your work
overall on this case. He started out somewhat skeptical about
your use of statistics, complicated computer programs, and
structured analytic techniques, but now he sees the value of
them. He wants you to close out your work by producing your
own assessment of your efforts so the TPD can retain a record
of your experience.
He wants you and your office to keep such records from now
on so that he can use them to justify more investment in the
criminal intelligence analysis section and you can use them to
train new criminal intelligence analysts coming on board to the
organization for the first time.
While this final report will describe each of the major steps
taken in the El Movi case, the emphasis is on assessing your
experience working through the case. Begin the report with a
timeline of all the major events in the case, ensuring you
indicate where in the timeline your products fall. For each of
your products, briefly respond to the following questions:
· What was the most helpful about the technique I used to create

7. this product, and why?
· What was the biggest hindrance of the technique I used to
create this product, and why?
· What other technique or aspect of another technique would
have helped me overcome this hindrance to create a better
product, and why?
Close out your report by finishing the following sentences about
your work on the case as a whole:
· The moment when I was the most engaged, excited, and
involved in the case was when…
· The moment when I was the most distanced, disengaged, and
uninvolved in the case was when…
· I would like to say about my experience as a criminal
intelligence analysis on this case that…
· The one piece of advice I would give the next person who
works on a similar case using similar techniques is…
Chapter 13
Treason
Treason is the only crime defined in the U.S. Constitution. The
revolutionaries who wrote the U.S. Constitution knew very well
the new government they were about to create couldn’t survive
without the active support (or at least the passive submission)
of most of the people.
They also realized it was going to be some time before this new
republican form of government took hold among the people. The
people’s allegiance would be especially important to the
newborn nation’s survival in the early years following the
Revolution, a time of gigantic threats from enemies inside and
outside the new country.
Everything they did to further the interests of the colonies was
done under threat of prosecution for treason. English
prosecutions for treason weren’t pretty.
The authors of the Constitution worried that treason law would
be abused because of two concerns:

8. 1. that peaceful opposition to the government, not just rebellion,
would be repressed
2. that innocent people might be convicted of treason because of
perjury, passion, and/or insufficient evidence.
They were determined that disloyal feelings or opinions and the
passions of the time wouldn’t be a part of the law of treason.
As much as they recognized the need for allegiance to the new
government, their fear of abusive prosecutions for treason led
them to adopt limitation.
By the time the Constitution was adopted, the new government
and current thinking among the governing class came to limit
treason to two disloyal behaviors:
· levying war against your own country
· giving aid and comfort to the enemy
The authors of the Constitution adopted these two acts and then,
for more protection, added three more limits to the reach of
treason:
· they banned legislatures and courts from creating new
treasons;
· they required two witnesses to at least one overt (unconcealed)
act of treason or a confession in open court;
· they wrote these limits into the body of the U.S. Constitution.
Treason consists of three elements.
· First, treason actus reus consists of either levying war against
the United States or giving aid and comfort to the enemies of
the United States.
· Second, treason mens rea consists of intentionally giving aid
and comfort for the very purpose of betraying the United States.
· Third, proof of treason requires either two witnesses to the
actus reus or confession in open court.
Distrust of treason prosecutions didn’t end with the adoption of
the Constitution. Throughout U.S. history, the government has
prosecuted only a handful of people for treason, and presidents
have pardoned or at least mitigated death sentences of most of
those few who’ve been found guilty.
Sedition, Sabotage, and Espionage

9. Treason isn’t the only crime aimed at combating disloyalty and
keeping the allegiance of our citizens. Advocating the violent
overthrow of the government is called sedition.
The “stirring up” could be done by speeches (seditious speech),
writings (seditious libel), or agreement (seditious conspiracy).
In the Smith Act of 1940, Congress made it a crime to conspire
to teach or advocate overthrowing the government by force or to
be a member of a group that advocated the violent overthrow of
the government.
Sabotage is the crime of damaging or destroying property for
the purpose of interfering with and hindering preparations for
war and defense during national emergencies. The sabotage
levels of culpability vary. Most often, it’s “willfully,”
sometimes “with intent to,” and at least once “with reason to
believe.” Whatever the exact words, it’s probably closest to the
highest levels of culpability—purposely and/or knowingly.
The U.S. Code (2006, Title 18, Chapter 37, § 794)
separates espionage into two crimes:
· (1) espionage during peace
· (2) espionage during war. Espionage is spying for the enemy.
The crime of espionage during war consists of collecting,
recording, publishing, or communicating (or attempting to do
any of these) “any information” about troop movements, ships,
aircraft, or war materials and any other information “which
might be useful to the enemy.”
· The penalty is death or any term of imprisonment up to life
(§794[b]).
By the middle of the 1920’s, large scale sedition prosecutions
under the Espionage Act largely disappeared. But it didn’t die.
This is especially true during times like World War II, the Cold
War, the Vietnam War, and now in Iraq and Afghanistan, when
U.S. troops are engaged in combat and dangerous peacekeeping
operations abroad.
The U.S. Government has occasionally prosecuted these
employees. Now, the Espionage Act is back. Since 2009, the
U.S. Government has charged six U.S. Government employees

10. under the Act: Bradley Manning; Thomas Drake; Shamai
Leibowitz; Stephen Jin-Woo Kim; Jeffrey Sterling; and John
Kirakou.
Terrorism and Anti-Terrorism
Terrorism and Anti-Terrorism Crimes
Terrorism is the use of violence or intimidation in the pursuit of
political aims. A number of sections of the U.S. Code are
available for prosecuting crimes related to terrorists and
terrorist organizations.
There are some specific antiterrorism crimes—mainly, U.S.
Code Chapter 113B, “Terrorism” (Title 18, Part I), the Anti-
Terrorism and Effective Death Penalty Act (AEDPA) (1996),
and the USA Patriot Act (2001). The code divides terrorism into
two kinds: international terrorism and domestic terrorism.
According to the U.S. Code (2006), it’s a felony punishable by
up to life imprisonment, or execution if someone dies, to use, to
threaten to use, or attempt or conspire to use, a weapon of mass
destruction against a U.S. citizen outside the United States
(Title 18, Part I, Chapter 113B, § 2332a); any person or
property inside the United States (§ 2332a); any property
owned, leased, or used by the U.S. government inside or outside
the United States (§ 2332a[3]); or any property owned, leased,
or used by a foreign government inside the United States (§
2332a[4]).
The actus reus of harboring or concealing consists
of harboring or concealing persons who have committed or are
about to commit a list of terrorist-related crimes.
The mens rea of harboring or concealing requires knowing (or
that a reasonable person should have known) the actus reus of
harboring or concealing was about to be committed. The penalty
is a fine or up to 10 years of imprisonment.
The felony of providing material support was first created in the
1996 Anti-Terrorism and Effective Death Penalty Act (AEDPA)
(§ 323), which was aimed at domestic terrorist acts. The crimes
of providing material support to individuals or organizations are
proximity crimes.

11. The term “training” means instruction or teaching designed to
impart a specific skill, as opposed to general knowledge. The
term “expert advice or assistance” means advice or assistance
from scientific, technical, or other specialized knowledge.
No person may be prosecuted under this section in connection
with the term “personnel” unless that person has knowingly
provided, attempted to provide, or conspired to provide a
foreign terrorist organization with 1 or more individuals (who
may include himself) to work under that terrorist organization’s
direction or control, or otherwise direct the operation of that
organization.
As of September 2010, the U.S. Government had prosecuted
about 1,000 terrorist cases since September 11, 2001 (TTRC
2010, 6). The top plots include only defendants inspired by
jihadist ideas, namely “defendants who were formally or
informally associated with an Islamist terror group—whether
one with a global jihadist ideology (Al Qaeda) or a local
Islamist movement (Hamas).
It also includes defendants unaffiliated with a terror group who
aspired to such affiliation or who subscribed to a global
jihadist ideology (TTRC 2011, 7). But it excludes terror cases
not inspired by jihadist ideas, like far right (militias) or far left
(environmentalist extremists).
Is the U.S. creating its own terrorists? Yes, according to the
Law and Security Center. Eighty one percent(127) of the
defendants in the top 50 plot cases were legal residents of the
U.S.
Seventy-three (57%) were born in the U.S.; the rest had lived in
the U.S. for at least 10 years and several as long as 20 years,
long enough to become familiar with U.S. culture and habits
(TTRC 2010, 3).
Homegrown terrorist defendants have been among high profile
cases ever since 2001, but the number seemed to spike in 2010,
partly because of lengthy investigations. Furthermore, some
defendants spent years trying to become terrorists before they
were arrested.

12. The statutes charged in the top 50 terrorist cases include:
providing material support to terrorists; providing material
support or resources to designated foreign terrorist
organizations; use of weapons of mass destruction; prohibitions
against the financing of terrorism; and receiving military-type
training from a foreign terrorist organization.
The predominant number of cases are “material support”
offenses to terrorists and terrorist organizations. A number of
lower courts have decided challenges to the constitutionality of
the “material support” sections.
They have reached conflicting results. Then in 2010, the U.S.
Supreme Court decided that as applied to the facts of the case in
Holder v. Humanitarian Law Project that the “material support”
for terrorist organization was neither constitutionally vague, nor
did it violate the First Amendment speech and assembly rights.