The Geospatial Intelligence Professional

The Geospatial Intelligence professional is a “knowledge worker” or “symbol analyst” (a term used by the U.S. Department of Labor) who carries out multi-step operations, manipulates abstract symbols, addresses abstract and complex ideas, acquires new information, and must remain mindful enough to recognize change. Successful knowledge work, like all work, requires study and practice. Professionalism in the area calls for broad experience and understanding of the entire Intelligence Community. The individual who is only interested in geospatial technology, as central as it is to the discipline, is not fully a Geospatial Intelligence professional. Nor is the technical expert in GIS or remote sensing ipso facto a Geospatial Intelligence professional.

What is Intelligence?

Intelligence Analysis in a Cycle

Analysis resides within the larger intelligence cycle. The intelligence cycle determines the daily activities of the Intelligence Community. It starts with the needs of the intelligence "consumers' such as policymakers, military officials, and other decision makers who need intelligence for their activities. These requirements are sorted and prioritized within the Intelligence Community and are used to drive the collection activities of the Intelligence Community. The cycle, as depicted in the figure below, is repeated until an intelligence requirement has been satisfied.

Figure 2: The Intelligence Cycle.

http://www.preventwmd.gov/report/ [2]

The Intelligence Cycle is a concept that describes the general intelligence process in both a civilian or military intelligence agency or in law enforcement. The cycle is typically represented as a closed path of activities. Problems with a closed loop include an overall process that is no better than its weakest component and stove piping. In the traditional intelligence use of the term, stove piping keeps the output of different collection systems separated from one another. Stove piping prevents one discipline from cross-checking another and bypassing the regular analysis of raw intelligence by sending only raw intelligence that supports a particular position to the leadership.

Analysis is using information about the context of a situation, characterizing the known observables, and applying the appropriate statements of probability to anticipate future situations. Descriptions of the anticipated situations are developed from what may be inaccurate or deliberately deceptive information; therefore, the analyst must correlate the similarities among observations and develop a common "truth." A set of repeatable and useful problem-solving approaches is helpful and essential for analysts. Because of the nature of the intelligence problem and work, an analytic approach must be tolerant of deceptive information far more than the scientist performing an experiment. According to Richards Heuer [1], intelligence analysis involves incremental, iterative, refinement.

Intelligence Process

The term "intelligence process" refers to the steps of the cycle. Intelligence, as practiced in the United States, is commonly thought of as having five steps. Lowenthal (2006, p 55) added two phases for seven phases of the intelligence process as (1) requirements, (2) collection, (3) processing and exploitation, (4) analysis and production, (5) dissemination, (6) consumption, and (7) feedback. The following paraphrases Lowenthal (p 55):

• Requirements.
  Identifying requirements means defining those questions to which intelligence is expected to make a contribution. Requirements also means specifying the collection of certain types of intelligence. The impulse is to say that all policy areas have intelligence requirements, which they do. However, since intelligence capabilities are limited, priorities must be set.
• Collection.
  Once requirements and priorities have been established, the intelligence is collected. Some requirements have specific types of collection; some may require several types of collection. Making these decisions is a key issue and the question of how much can or should be collected to meet each requirement.
• Processing and Exploitation.
  Collection produces information which must undergo processing and exploitation before it can be regarded as intelligence and given to analysts. Conversion includes translations, decryption, and interpretation.
• Analysis and Production.
  Analysis and production includes the integration, evaluation, and analysis of all available data, and the preparation of intelligence products, including quickly developed single-source, event-oriented reports and longer term all-source and intelligence studies. "All-source" intelligence analysis is done exclusively by the CIA, DIA, and the State Department's Bureau of Intelligence and Research. All-source analysts complete a more thorough evaluation and assessment of the collected information by integrating the information from other classified and unclassified sources.

Significantly, according to Lowenthal, most discussions of the intelligence process end with the dissemination and the intelligence having reached the policy makers. However, Lowenthal bundles dissemination with consumption and adds feedback:

• Dissemination and Consumption
  Dissemination and Consumption are taken together by Lowenthal. The process of dissemination, or the process of moving intelligence from producers to consumers, is largely standardized, with consumption being assumed in the 5-step process. However, Lowenthal points out that policy makers are not pressed into action by the receipt of intelligence, and if and how they consume intelligence is key (Lowenthal p. 62).
• Feedback.
  A dialog between intelligence consumers and producers should occur before and continue after the intelligence has been received. The analyst should have some sense of how well their intelligence requirements are being met and address any adjustments that need to be made. Feedback assesses the degree to which the finished intelligence addresses the needs of the intelligence consumer and will determine if further collection and analysis is required.

Puzzles and Mysteries

The following discussion is a paraphrase of the RAND report Assessing the Tradecraft of Intelligence Analysis [3] (Chapter 2, pages 3-12).The intelligence cycle can be contrasted with the intelligence analytic cycle which, according to the RAND report, typically includes three forms of analysis:

• technical processing as a form of analysis
• single discipline analysis such as GEOINT
• all-source analysis

The distinction between the first two types and all-source analysis is being blurred because of this use of tools, such as GIS, to integrate multiple intelligence sources. As such, some suggest a continuum of analysis from the collection system at one end to analysis at the other. Along this continuum, there is a transition where the data is used to support analysis. According to RAND, past this transitional area, analysis splits into:

• puzzle-solving
• mystery-framing

According to RAND:

• A puzzle tests the ingenuity of the solver to use information. Here one pieces together the information pieces in a logical way in order to come up with the solution, sort of like, the overlay process in GIS. Puzzle-solving in GIS involves pulling together many sources of data and information and, using that evidence, identifies new spatial patterns or trends and develops new knowledge.
• Mystery-framing includes political and societal questions related to humans. Anticipating human actions, e.g., where will a terrorist strike next, always involves subjective judgment which is less certain and more prone to biases. The analytic logic is also significant different for mysteries because there is no definitive solution. Mysteries can only be generally framed and made sense of which suggested that the argument is as important as the evidence. In the geospatial realm, information is always lacking because of accuracy, age, detail, or relevance. Therefore, many geospatial intelligence questions are mysteries. Mysteries involving human perceptions benefit from experience.

It should be no surprise that there are competing views of geospatial analysis. One school is that intuition, experience, and subjective judgment are key. Analysis here is an art, and non-quantitative methods predominate. Another school is that quantitative data and analysis using such tools as GIS are most relevant. Intelligence analysis here is science-like, and quantitative methods as applied in spatial analysis predominate. This controversy somewhat mirrors a long-standing debate in the intelligence community: if good analysis depends largely on subjective, intuitive judgment (an art) or systematic analytic methods (a science). Understanding this question is important to the person when developing an effective approach to geospatial intelligence creation. To help understand these points of view, I will define the terms using the Merriam-Webster Collegiate Dictionary, tenth edition, as:

• Art - the conscious use of skill and creative imagination in the production of anesthetic objects.
• Science - knowledge or a system of knowledge covering general truths or the operation of general laws, especially as obtained and tested through the scientific method.

Interestingly, there are those that consider integrative geospatial data tools, such as those found in GIS, as primarily aids to intuition and experience-based analysis and not the application of quantitative analytic methods. This seems contrary to the technical capabilities GIS brings to the geospatial intelligence. It is correct to say that there is no certain dividing line between art and science. Some contend there is no diving line at all and a pure scientific approach to geospatial analysis is impossible. The dissatisfaction with the push toward a science only perspective in GIS has been seen as a step backward by some. In this thinking, GIS’s models and analysis methods are not rich enough in geographical concepts and understanding to accurately reflect reality.

Geospatial intelligence is geospatial analysis, and geospatial analysis, at its core, is geography. Geography is both the conscious use of creative imagination in the representations of the earth and the science of developing general truths about the earth. For something to be automatable, it must be modeled and the facts (inputs) quantified. Since a model is a simplified abstract view of the complex reality, the model represents a limited set of rules which allows analysts to work out an answer if they have certain information. Quantifiability of the information is important because unquantifiable inputs cannot be tested, and thus unquantifiable results can neither be duplicated nor contradicted. However, we know that reliable models and data are not available for all analysis.

Pulling all of these thoughts together, the table in the image below categorizes the broad types of geospatial analysis. The upper right quadrantof the matrix identifies the ideal of GIS analysis as a Scientific Processin which there is good knowledge of the data and models surrounding an output. In the model, analysts understand the problem that confronts them and can take into account the key factors that bear on the problem. The notion of fixed-in-advance standard procedures typically plays an important role in such geospatial analysis.

However, many of the analytic tasks in geospatial intelligence fall outside of the scientific quadrant. Consider the Puzzle Solving Process (lower right) quadrant in which there is agreement on models, but disagreement on data. The notion of "foraging" for the data to solve the problem plays an important role in such analysis.

Analysis as an Opinion Process (upper left quadrant) is the opposite. In this analytic environment, there is agreement on data, but disagreement on model. Analysis is characterized by analysts involved in a struggle for influence, and decisions emerge from that struggle. This kind of analysis necessitates bargaining, accommodation, and consensus, as well as controversy. The bottom line is that conclusions are most often the result of bargaining between diverse and strongly held beliefs.

Intelligence analysis as a Heuristic Process (lower left quadrant) is the most contentious, with disagreement on data and models. Under these conditions, science and technology tools have significantly less direct relevance. Here, conclusions depend on parameters that change over the period the analysis is being made. As a consequence, the analytic process is experience-based. In the end, this is the framing of questions. They can only be framed, not solved, and thus the logic of argument and analysis is as important as the evidence.

Broad Types of Geospatial Analysis
Click to expand to provide more information

The "sensemaking" area within which the geospatial analyst works is the Puzzle Solving Process area. 

Broad Types of Geospatial Analysis

Model Fit - Low	Model Fit - High
Opinion Process ("strongly held beliefs") Data Certainty: high	Scientific Process ("Ideal of Analysis") Data Certainty: high
Heuristic Process ("Framed by Experience") Data Certainty: low	Puzzle Solving Process ("Foraging for Good Data") Data Certainty: high

Is geospatial intelligence an art or science? Analytic problems can fall into any of the four quadrants ---- you, the analyst, need to understand the problem solving environment and the nature of the problem solving process. The term “sensemaking” is used as a term to describe the analysis process and incorporates traits associated with the classical definitions of both “art” and “science.” Sensemaking is more formally defined as the deliberate effort to understand events using explanatory structure that defines entities by describing their relationship to other entities. Data elicit and help to construct the frame; the frame defines, connects and filters the data.

Analysts learn by doing, and the best analysts learn from their mistakes. However, mistakes in intelligence work are dreaded, and one never wants to hear the words "intelligence failure." Intelligence failures are often disastrous, and lives may be lost. It is important, therefore, to constantly work at improving the mind and never accept old habits of thinking. Methods of thought have evolved with respect to intelligence analysis, but they appear to have largely excluded geospatial analytics.

Dr. Rob Johnston in his work Analytic Culture in the US Intelligence Community: An Ethnographic Study (2005) finds no baseline standard analytic method for the Intelligence Community. He also finds the validation of data is questionable, and there is much more emphasis on avoiding error than in-depth analysis. Overall, his research suggests the need for serious study of analytic methods in the communities of practice.

It has also been my experience that there is no baseline standard analytic method for geospatial analysis. The most common practice is to develop a workflow. If the results are reviewed, it is usually conducted as a limited peer review on the basis of previous workflows. This likely produces a bias toward confirming earlier views.

While we discuss critical thinking, the validation of input geospatial data is questionable. Dr. Rob Johnston also points out that none of the analytic agencies knows much about the analytic techniques of others, and there tends to be an over emphasis on writing and communication skills rather than on analytic methods.

The Structured Geospatial Analytical Method (SGAM) is offered to solve the wicked problem of teaching the cognitive skills needed to approach geospatial analysis. The SGAM’s model is a first step utilizing a sequential process where progress is seen as flowing steadily through the steps. There are known disadvantages of such sequential process models. Foremost, the flow most probably does not represent the natural cognitive problem solving process. Further, the problems in one step are never solved completely and many problems regarding a particular step arise after the step is completed. Acknowledging these limitations, it is our argument that the SGAM’s simple approach is necessarily more understandable for the novice and, therefore, more effective in teaching inexperienced analysts. Rather than what the master analysts sees as a creative problem solving chaos (which by definition is unrepeatable and therefore unteachable), the SGAM model provides a teachable structured approach for the inexperienced analyst; a model that progresses linearly through discrete, easily understandable and explainable steps.

The method is based upon three stages and organized into two major loops. The three stages and associated outputs are:

Figure 2: SGAM Stages and Outputs

Analytic Stage 1: Problem Initiation. This stage broadly outlines the general analytic question.

Analytic Stage 2: Information foraging. This stage refines the general question to understand the geospatial aspects and results in the development of a rapid assessment based on informal methods or experience, and employing a form of trial and error iteration.

Analytic Stage 3: Sensemaking. This stage results in the development of a detailed analytic assessment utilizing an established methodology.

The two major loops are a:

• Foraging loop aimed at seeking information, searching and filtering it, and reading and extracting information.
• Sensemaking loop that involves iterative development of a mental model from the schema that best fits the evidence.

The foraging loop recognizes that analysts tended to forage for data by beginning with a broad set of data and then proceeded to narrow that set down into successively smaller, higher-precision sets of data, before analyzing the information (Pirolli,1999). The three foraging actions of exploring for new information, narrowing the set of items that have been collected, and exploiting items in the narrowed set trade off against one another under deadline or data overload constraints. It is important to note that much geospatial intelligence work never departs the foraging loop and simply consists of extracting information and repackaging it without much actual analysis and is in practice a rapid assessment of the question.

Sensemaking is the ability to make sense of an ambiguous situation; it is creating situational awareness and understanding in situations of high complexity or uncertainty in order to make decisions. It is "a motivated, continuous effort to understand connections (which can be among people, places, and events) in order to anticipate their trajectories and act effectively" (Klein, G., Moon, B. and Hoffman, R.F. 2006. Making sense of sensemaking. IEEE Intelligent Systems, 21(4), 70-73. ). When geospatial intelligence analysis departs the foraging loop and completes the sensemaking process, this yields an analytic assessment.

The below figure represents the Structured Geospatial Analytic Process derived from and incorporating aspects of both Heuer’s ACH and Pirolli and Card's sensemaking process. This is a generalized view of the geospatial analysis process that fits within the larger intelligence process. The rectangular boxes represent analytic activities. The arrows represent the flow from one activity to the next. The activities are arranged by degree of effort and degree of information structure. The overall analytic method has back loops. One set of activities focuses around finding information and another set of activities focuses on making sense of the information.

Figure 3: Structured Geospatial Analytic Process

The diagram summarizes how an analyst comes up with new information. The data flow shows the transformation of information as it flows from raw information to reportable results through the following steps:

Question. Developing the question is a two-way interface between the client requiring information and the geospatial analyst supplying it.Critically, the question defines the broad nature of the spatial and temporal patterns the analyst is seeking to ultimately identify.

Grounding and Team Building. Grounding is the raw evidence that reaches the analyst. Grounding is building a potential repertoire of prototypical geospatial and temporal patterns from which a number of hypothetical (possible alternative) patterns will be selected. Step 2 is where the analytic team is formed.

Hypothesis Development. Hypotheses are the tentative representation of conclusions with supporting arguments. This step involves selecting all the reasonably possible geospatial and temporal patterns that might match the pattern envisioned during the development of your question.

Evidence Development. Evidence refers to snippets extracted from items discovered in the grounding. Development of the evidence includes developing and applying Schemas, which are the representation or organized marshaling of the information so that it can be used more easily to draw conclusions. This includes developing a smaller subset, which Pirolli and Card call the “shoebox”, of the data that are relevant for processing. Much of geospatial intelligence work never departs the foraging loop (Steps 1-4) and simply consists of extracting information and repackaging it without much actual analysis. In short, evidence is the development and accumulation of all facts to reject the hypothetical geospatial and temporal patterns determined in Step 3. GIS assists in the development and accumulation of the facts.

Fusion. The multi modal (graphical and text) nature of geospatial intelligence data analysis, which is used to reduce the influence of unreliable sources, is essentially a fusion process. Fusion in this step uses the ACH process to combine graphical and textual data, to achieve inferences, which will be more efficient and potentially more accurate than if they were achieved by means of a single source. Simply put, the fusion process is the comparing of the evidence to each hypothetical geospatial and temporal pattern to determine consistency.

Conclusions. The conclusion is a proposition about which hypothetical pattern(s) is (are) most consistent with the evidence and answers the question. Ultimately there is a presentation or other work product.

Basically, the data flow represents the converting of raw information into a form where expertise can apply, and then out to another form suited for communication. Information processing can be driven by bottom-up processes (from data to theory) or top-down (from theory to data). The bottom-up process is as described in steps 1 through 6. The top down process is slightly different in that it follows the sequence of:

1. Evaluate conclusion. Inquiries from clients or indicators from signposts may generate re-evaluations of the current conclusions developed by an analyst. This may also require the marshaling of additional evidence to support or disconfirm the analysis or the generation and testing of alternative outcome.
2. Deconstruct the synthesis. Reexamine the table of hypothesis and evidence beginning with the rankings.
3. Examine the evidence. Reexamine collected evidence or search for new evidence. Search for nuggets of information that may suggest new geospatial or temporal patterns that generate hypotheses about plausible relations among entities and events.
4. Re-evaluate the hypotheses. Looking for new hypotheses may generate new searches, further data extraction or a search for additional raw data.
5. Question your grounding in the problem. New hypotheses may cause analysts to broaden their grounding in prototypical geospatial and temporal patterns.
6. Question the question. Revalidate with the client the nature of the geospatial and temporal patterns the analyst is ultimately seeking to identify. Re-examine the process, use of tools, and quality.

A number of "ingredients" (concepts) have been used in the development of the Structured Geospatial Analysis Method "stew." It is difficult to understand how to apply the method without understanding the ingredients and their associated qualities. The following is a brief discussion of each ingredient for your general reference:

• critical thinking
• spatial thinking
• understanding spatial fallacies
• geospatial reasoning
• analytic methods
• geospatial analytic methods

Structured Geospatial Analytic Method(SGAM) Ingredients

Spatial thinking is the essence of Geospatial Intelligence. Spatial thinking is thinking that finds meaning in the shape, size, orientation, location, direction or trajectory, of objects, processes or phenomena, or the relative positions in space of multiple objects, processes or phenomena. Geospatial thinking is spatial thinking related to the earth. An expert geospatial thinker (NAP, 2006, p. 3):

Geospatial analysis can be very difficult to do well. Much of the difficulty is cognitive and not related to an individual's ability to use the technical tools, i.e., GIS. It takes far greater mental agility than gathering evidence supporting a single hypothesis that was pre-judged as the most likely answer. To develop and retain multiple spatial schemes in working memory and note how each item of information fits into each hypothesis is beyond the mental capabilities of most analysts. (Note: Working memory tasks include the active monitoring or manipulation of information or behaviors.)

Moreover, truly good geospatial analysis requires monitoring your progress, making changes and adapting the ways you are thinking. It is about self-reflection, self-responsibility, and initiative to achieve the analytic results within the time allotted. This mental agility can be accomplished with the help of a few simple thinking tools discussed here.

Heuer makes three important points relative to intelligence in his work, the Psychology of Intelligence Analysis [1].

• Human minds are ill equipped ("poorly wired") to cope effectively with both inherent and induced uncertainty.
• Increased knowledge of one's own inherent biases tends to be of little assistance to the analyst.
• Tools and techniques that apply higher levels of critical thinking can substantially improve analysis of complex problems.

He provides the following series of images to illustrate how poorly we are cognitively equipped to accurate interpret the world.

Question #1: What did you see in the figure? The answer is at the bottom of this page.

Figure 1

Source: Heuer, Psychology of Intelligence Analysis [1]

Question #2: Look at the drawing of the man in the upper right. Are the drawings all of men? The answer is at the bottom of this page.

Figure 2

Source: Heuer, Psychology of Intelligence Analysis [1]

Question #3: What do you see—an old woman or a young woman? The answer is at the bottom of this page.

Figure 3

Source: Heuer, Psychology of Intelligence Analysis [1]

Now look to see if you can reorganize the drawing to form a different image of a young woman, if your original perception was of an old woman, or of the old woman if you first perceived the young one.

According to Heuer, and as the above figures illustrate, mental models, or mindsets, or cognitive patterns are essentially the analogous image by which people perceive information. Even though every analyst sees the same piece of information, it is interpreted differently due to a variety of factors. In essence, one's perceptions are morphed by a variety of factors that are completely out of the control of the analyst. Heuer sees these cognitive patterns ;as potentially good and bad for the analyst. On the positive side, they tend to simplify information for the sake of comprehension but they also bias interpretation. The key risks of mindsets are that:

• analysts perceive what they expect to perceive;
• once formed, they are resistant to change;
• new information is assimilated, sometimes erroneously, into existing mental models; and
• conflicting information is often dismissed or ignored.

Therefore, since all people observe the same information with inherent and different biases, Heuer believes an effective analysis method needs a few safeguards. The analysis method should:

• encourage products that clearly show their assumptions and chains of inferences; and
• emphasize procedures that expose alternative points of view.

What is required of analysts is a process for challenging, refining, and challenging their own working mental models. This is a key component of his Structured Analytic Techniques (SATs), which include Analysis of Competing Hypotheses.

These problems notwithstanding, cognitive patterns are critical to allowing individuals to process what otherwise would be an incomprehensible volume of information. Yet, they can cause analysts to overlook, reject, or forget important incoming or missing information that is not in accord with their assumptions and expectations. Seasoned analysts may be more susceptible to these mindset problems as a result of their expertise and past success in using time-tested mental models.

Answers

Answer #1: The article is written twice in each of the three phrases. This is commonly overlooked because perception is influenced by our expectations about how these familiar phrases are normally written.

Answer #2: The above figure illustrates that mind-sets tend to be quick to form but resistant to change by showing part of a longer series of progressively modified drawings that change almost imperceptibly from a man into a woman. The right-hand drawing in the top row, when viewed alone, has equal chances of being perceived as a man or a woman.

Answer #3: The old woman’s nose, mouth, and eye are, respectively, the young woman’s chin, necklace, and ear. The old woman is seen in profile looking left. The young woman is also looking left, but we see her mainly from behind so most facial features are not visible. Her eyelash, nose, and the curve of her cheek may be seen just above the old woman’s nose.

Structured analytic techniques are simply a "box of tools" to help the analyst mitigate the adverse impact on analysis of one's cognitive limitations and pitfalls. Taken alone, they do not constitute an analytic method for solving geospatial analytic problems. The most distinctive characteristic is that structured techniques help to decompose one's geospatial thinking in a manner that enables it to be reviewed, documented, and critiqued. "A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis [11]" (CIA, 2009) highlights a few structured analytic techniques used in the private sector, academia, and the intelligence profession.

Structured thinking in general and structured geospatial thinking specifically is at variance with the way in which the human mind is in the habit of working. Most people solve geospatial problems intuitively by trial and error. Structured analysis is a relatively new approach to intelligence analysis with the driving forces behind the use of these techniques being:

• an increased understanding of cognitive limitations and pitfalls that make intelligence analysis difficult;
• prominent intelligence failures that have prompted reexamination of how intelligence analysis is generated;
• DNI policy support and technical support for interagency collaboration; and
• a desire by policy makers who receive analysis that it be more transparent as to how conclusions were reached.

In general, the Intelligence Community began focusing on structured techniques because analytic failures led to the recognition that it had to do a better job overcoming cognitive limitations, analytic pitfalls, and addressing the problems associated with mindsets. Structured analytic techniques help the mind think more rigorously about an analytic problem. In the geospatial realm, they ensure that our key geospatial assumptions, biases, and cognitive patterns are not just assumed correct but are well considered. The use of these techniques later helps to review the geospatial analysis and identify the cause of any error.

Moreover, structured techniques provide a variety of tools to help reach a conclusion. Even if both intuitive and scientific approaches provide the same degree of accuracy, structured techniques have value in that they can be easily used to balance the art and science of their analysis. It is clear is that structured methodologies are severely neglected by the geospatial community. Even in the rare cases where a specific technique is used, no one technique is appropriate to every step of the problem solving process.

There are two ways to view the nature of these techniques. Heuer categorized structured techniques by how they help analysts overcome human cognitive limitations or pitfalls to analysis. Heuer's grouping is as follows:

• Decomposition and Visualization: The number of things most people can keep in working memory at one time is seven, plus or minus two. Complexity increases geometrically as the number of variables increases. In other words, it is very difficult to do error-free analysis only in our heads. The two basic tools for coping with complexity in the analysis are to: (1) break things down into their component parts, so that we can deal with each part separately, and (2) put all the parts down on paper or a computer screen in some organized manner such as a list, matrix, map, or tree so that we and others can see how they interrelate as we work with them. Many common techniques serve this purpose.
• Indicators, Signposts, Scenarios: The human mind tends to see what it expects to see and to overlook the unexpected. Change often happens so gradually that we do not see it, or we rationalize it as not being of fundamental importance until it is too obvious to ignore. Identification of indicators, signposts, and scenarios create an awareness that prepares the mind to recognize change.
• Challenging Mindsets: A simple definition of a mindset is “a set of expectations through which a human being sees the world.” Our mindset, or mental model of how things normally work in another country, enables us to make assumptions that fill in the gaps when needed evidence is missing or ambiguous. When this set of expectations turns out to be wrong, it often leads to intelligence failure. Techniques for challenging mindsets include reframing the question in a way that helps break mental blocks, structured confrontation such as devil’s advocacy or red teaming, and structured self-critique such as what we call a key assumption check. In one sense, all structured techniques that are implemented in a small team or group process also serve to question your mindset. Team discussions help us identify and evaluate new evidence or arguments and expose us to diverse perspectives on the existing evidence or arguments.
• Hypothesis Generation and Testing: “Satisficing” is the tendency to accept the first answer that comes to mind that is “good enough.” This is commonly followed by confirmation bias, which refers to looking at the evidence only from the perspective of whether or not it supports a preconceived answer. These are among the most common causes of intelligence failure. Good analysis requires identifying, considering, and weighing the evidence both for and against all the reasonably possible hypotheses, explanations, or outcomes. Analysis of Competing Hypotheses is one technique for doing this.
• Group Process Techniques: Just as analytic techniques provide structure to our individual thought processes, they also provide structure to the interaction of analysts within a team or group. Most structured techniques are best used as a collaborative group process, because a group is more effective than an individual in generating new ideas and at least as effective in synthesizing
  divergent ideas. The structured process helps identify differences in perspective between team or group members, and this is good. The more divergent views are available, the stronger the eventual synthesis of these views. The specific techniques listed under this category, such as brainstorming and Delphi, are designed as group processes and can only be implemented in a group.

Others have grouped techniques by their purpose:

• Diagnostic techniques are primarily aimed at making analytic arguments, assumptions, or intelligence gaps more transparent;
• Contrarian techniques explicitly challenge current thinking; and
• Imaginative thinking techniques aim at developing new insights, different perspectives and/or develop alternative outcomes. In fact, many of the techniques will do some combination of these functions.

These different groupings of the techniques notwithstanding, the analysts should select the technique that best accomplishes the specific task they set out for themselves. The techniques are not a guarantee of analytic precision or accuracy of judgments; they do improve the usefulness, sophistication, and credibility of intelligence assessments.

It is often difficult for an analyst to determine the next step in an analytic process or to visualize how various techniques and tools fit together. Using the below as a list of the common GIS operations, the analyst might use:

• data entry;
• data conversion;
• data validation;
• spatial data management;
• attribute data management;
• data visualization;
• data processing/analysis and
• output of maps and reports.

The Structured Geospatial Analytic Method (SGAM) provides the means to relate the analytical step to the Structured Analytic Technique (SAT) and then to the appropriate geospatial operation. The following table summarizes this mapping:

The Intelligence Community began to use structured techniques because of analytic failures related to cognitive limitations and pitfalls or biases. The use of SATs does not guarantee getting intelligence analysis right, because there are so many uncertainties. SATs help to reduce the frequency and severity of error. These include SATs that partially overcome cognitive limitations, address analytic pitfalls, and confront the problems associated with mindsets. SATs help the mind think more rigorously about an analytic problem. Specifically, they ensure that assumptions, preconceptions, and mindsets are not taken for granted but are explicitly examined and tested. The use of SATs also helps to review the analysis and identify the cause of any error.

This chapter discusses the first step of the SGAM, highlighted below in gold, the Analytic Question.

Structured Geospatial Analytic Process

The question, or analytical problem, can be viewed as an active two-way interface between the client requiring the information and the geospatial analyst supplying it. The problem defines the geospatial patterns the analyst is seeking. Foraging and sensemaking define the nature of the analysis and quality in this context defined as satisfying the client. A geospatial question that leads to the sensemaking process must meet three criteria of:

• At least one plausible explanation exists with some geospatial aspect.
• Counter-explanations are possible.
• The hypotheses can be defined sufficiently with respect to the geospatial aspects to allow us to gather evidence.

Therefore, the problem possesses a highly strategic significance. The figure below depicts a three-way connection between the client and analyst’s domain:

Three-way connection between the client and analyst domains

Before beginning, ask the following questions:

• Who is the key person for whom the analysis is being completed?
• Do I understand the question? (If necessary, clarify this before proceeding.)
• What is the most important message to give this client?
• How is the client expected to use this information?
• How much time does the client have?
• What format would convey the information most effectively?
• What is the client’s level of tolerance for technical geospatial specific language? How much detail and what geospatial accuracy does the client expect?
• Would the client expect the analyst to reach out to other experts within or outside the Intelligence Community?
• To whom, or to what source, might the client turn for alternative views on this topic? What data or analysis might others provide that could influence how the client reacts to what is being prepared in this paper?

The question focuses the analyst on the nature of the spatial and temporal patterns the analyst is seeking to identify and understand. Many new geospatial analysts struggle to translate the question into the context of spatial concepts. To overcome this, we stress the importance of understanding the general analytical question and developing a spatial corollary of this broader question.

What is an analytic question? There are significant differences between a “factoid question,” which are the most common in Geospatial Intelligence, and an “analytical question.” A factoid question seeks a piece of information that would be answered with a corresponding true statement. For example:

Question: “How many miles are between two shooter events?”

Answer: “There are 5 miles between events."

In general, a factoid question usually has just one correct answer that can be easily judged for its truthfulness. Answers to factoid questions are important as evidence but are not to be the focus of an analytic effort. Data foraging provides factoids (or evidence), a small but potentially important bit of information. In contrast to a factoid question, an analytical question has a less certain relationship with expected answer. For example:

Question: “Who is the DC Shooter?”

Answer: “The shooter could be a foreign terrorist or a serial killer.”

In general, an analytical question has many possibly correct answers that cannot be easily judged for truthfulness. An analytical question is generally quite flexible in the sense that there is always a strong possibility that we may not arrive at the “expected” answer. Thus, a change of analytic strategy, and even the initial expectations of the analysis, may be warranted. This suggests a solution to an analytic question must involve iterative information foraging and sensemaking.

Geospatial Corollary

The Geospatial Corollary is a highly spatial problem statement which follows readily from the broader analytic problem, and suggests a narrowly focused spectrum of geospatial questions. The evidence developed as part of the spatial corollary contributes to the larger body of evidence of the initial analytic problem; the spatial corollary is unlikely to be as significant to the stakeholder as those of initial analytic problem statement. The development of this spatial corollary involves an active two-way discussion between the client requiring the information and the geospatial analyst supplying it. For example, “What geospatial aspects of the events help to explain if the DC Shooter is a foreign terrorist?” The spatial corollary must be “analytic” which means four conditions are met:

• It must be at least one spatial quality or relationship to be explained;
• At least one plausible explanation of the spatial quality or relationship must be posed;
• Counter-explanations are possible and analysis must include an investigation of alternative hypotheses; and
• The hypotheses must be capable of being defined sufficiently to allow us to gather spatial evidence.

Actions That Help Define the Analytic Question

Action 1: Develop an understanding of the general analytic question. Understanding the general question will require a two-way dialog between the client requiring information and the geospatial analyst supplying it. The distinguishing characteristics of an “analytical question” in geospatial intelligence are:

• That the analyst cannot anticipate the answer without reasoning.
• While certain answer may be expected, the result is for the most part unknown and heavily biased by the available data.
• The initial efforts probe the available data with other probes determining follow up questions. In our case, these will be geospatial questions.
• Clarifications will possibly be needed to adjust the scope and intent of the question.

Action 2: Familiarize yourself to the problem. Before finalizing the question, the analyst must have a preliminary and broad base of knowledge about the problem. When dealing with a new and unfamiliar subject, the uncritical and relatively non-selective accumulation and review of information is necessary. This is a process of absorbing information, not analyzing it.

Action 3: Think about the Spaces. An object or event can be specified relative to the observer, to the environment, to its own intrinsic structure, or to other objects in the environment. Each instance requires the adoption of specific spatial frames of reference or context. The spatial context is critical because it is the space the data is in that ultimately determines its interpretation. There are three spatial contexts within which we can make the data-to-information transition. In all cases, space provides an interpretive context that gives meaning to the data. These include:

• Life spaces - Life space is the four-dimensional space-time that provides the means of coming to grips with the spatial relations between self and objects in the physical environment. This is cognition in space and involves thinking about the world in which we live. It is exemplified by navigation and the actions that we perform in space. For example, the route the sniper took between shootings.
• Physical spaces - Physical space is the four-dimensional space-time that focuses on a scientific understanding of the nature, structure, and function of phenomena. This is cognition about space and involves thinking about the ways in which the "world" works. An example might be how an earthquake creates a tsunami. Another example is the sniper's weapon had a certain range the projectile will travel.
• Intellectual spaces - Intellectual space is in relationship to concepts and objects that are not in and of themselves necessarily spatial, but the nature of the space is defined by the particular problem. This is cognition with space and involves thinking with or through the medium of space in the abstract. An example is perceived extent of tribe influence by a tribal leader. Another example might be areas where the sniper felt safe from detection.

Action 4: Think about the fundamental spatial questions. When making sense about the spaces (Gershmehl and Gershmehl, 2006) the analyst first asks and answers the following questions each of the life, physical, and intellectual spaces:

• Where is this object or event?
• What is at this object or event?
• How is this object or event linked to other objects and events?

Action 5: Think about the qualities of the objects or events for each space. The analyst then proceeds to examine the object or events for each space by asking the following questions:

• How are objects or events similar or different?
• How can we compare them fairly?
• What effect(s) does the object or event have on nearby areas?
• What nearby objects or events are similar to each other and can be grouped together?
• Where does this object or event fit in a hierarchy?
• Is the change between objects or events abrupt, gradual, or irregular?
• What distant objects or events have similar situations and therefore may have similar conditions?
• Are there clusters, strings, rings, waves, or other non-random arrangements of objects or events?
• Do objects or events tend to occur together (have similar spatial patterns)?

Action 6: Think about the relationship between the objects and event for each space. Last, the comparisons are placed into the context of space and time. This is spatiotemporal thinking which asks the questions:

• How do spatial objects or events change through time?
• How do conditions change at a place over time?
• What is the change in position of something over time?
• What is the change in extent of something over time?
• Where are the objects or events that do not seem to follow an observed “rule”?

Action 7: Write the Geospatial Corollary. The geospatial corollary is a highly spatial problem statement which follows readily from the broader analytic problem, and suggests a narrowly focused spectrum of geospatial questions. The evidence developed as part of the spatial corollary contributes to the larger body of evidence of the initial analytic problem; the spatial corollary is unlikely to be as significant to the stakeholder as those of initial analytic problem statement. The development of this spatial corollary involves an active two-way discussion between the client requiring the information and the geospatial analyst supplying it. The spatial corollary must be “analytic” which means four conditions are met:

1. there must be at least one spatial quality or relationship to be explained;
2. at least one plausible explanation of the spatial quality or relationship must be posed;
3. counter-explanations are possible and analysis must include an investigation of alternative hypotheses; and
4. the hypotheses must be capable of being defined sufficiently to allow us to gather spatial evidence.

This chapter discusses the second step of the SGAM, highlighted below in gold, Grounding in the Problem and Team Building.

Structured Geospatial Analytic Process, Step 2

Obviously, an analyst must have a base of knowledge to work with before starting analysis. The significance of geospatial information is always a joint function of the nature of the information and the context in which it is interpreted. When dealing with a new and unfamiliar subject, the uncritical and relatively non-selective accumulation and review of information is an appropriate first step. This is a process of absorbing geospatial information, not analyzing it. Another view of this process is as a problem reduction effort. In this view, a problem is decomposed into a structured set of subproblems. Each subproblem is subject to further decomposition until the subproblems produced are investigatable with given techniques.

Developing an understanding of the analytic problem domain is often referred to as “grounding.” Why ground yourself in the problem? It should be a frightening prospect for a geospatial analyst to develop intelligence without a firm understanding of an analytic problem domain. Grounding is an act of information foraging ,which is a tradeoff among three kinds of processes. Analysts tended to begin with a broad set of documents and then proceeded to narrow that set down into successively smaller, higher-precision sets of data before reading and analyzing the documents. Generally, there are three processes that tradeoff against one another under deadline or data overload constraints:

1. Exploring or monitoring more of the space, and by this means increasing the amount of new geospatial information brought into the analysis process. In geospatial terms, this corresponds to increasing geospatial data and information relating to the question being interpreted. There are generally three major categories of results from this search ( according to Kludas, 2007 [12]):
   • Skimmed results- many diverse and relevant items
   • Chorus of results- many similar and relevant items
   • Dark Horse results- an unusually accurate single source
2. Enriching (or narrowing) the set of items that have been collected for analysis. This is a process in which smaller, higher-precision sets of documents are created. This is, to a great extent, a problem reduction effort where the problem is decomposed into a structured set of subproblems. Each subproblem is subject to further decomposition until the subproblems produced are investigatable with given techniques.
3. Exploiting the items in the set, by which we mean more thorough reading of documents, using geospatial visualization tools (such as GIS) to extract information, generate inferences, notice patterns, etc.

Grounding is the foundation of future hypotheses. In a practical sense, grounding is the confirmation and discovery of geospatial information about the problem. Grounding is related to the problem of how patterns get their meaning. In Geospatial Intelligence, grounding is developing the ability to see a pattern by the inner eye. This is to say, patterns on maps and images only acquire meaning when they are observed by a recipient that is self aware. The analyst needs an explicit theoretical and methodological grounding in the problem with special attention to the contexts in which the patterns occur. This allows knowledge to be focused as specifically as possible to the context of the problem. In recent years, the confirmation and discovery of geospatial information and a “knowledge team” have become inseparable because of the:

• complexity of space-time problems;
• requirement for multidisciplinary input;
• need to share more information more quickly;
• growing dispersion of expertise, and;
• need to identify and evaluate the validity of alternative models.

It has often been said that Geospatial Intelligence is a team sport. What does this mean? The Director of National Intelligence’s (DNI) vision for 2015 is one in which intelligence analysis increasingly becomes a collaborative enterprise with the focus of collaboration shifting “away from coordination of draft products toward regular discussion of data and hypotheses early in the research phase.” This is a major change from the traditional concept of geospatial analysis as largely an individual activity. It is driven in part by the growing complexity and need for multidisciplinary input when developing analytic products; the need to share information across organizational boundaries; and the need to identify and explore the validity of alternative hypotheses. It is enabled by advances in social networking practices. It is important to note that team-based analysis brings a new set of challenges comparable to the cognitive limitations and pitfalls faced by the individual analyst. As mentioned previously, geospatial analysis and a “knowledge team” have become inseparable because of the:

• complexity of space-time problems;
• requirement for multidisciplinary input;
• need to share more information more quickly;
• growing dispersion of expertise, and;
• need to identify and evaluate the validity of alternative models.

A “knowledge team” is an informal network of individuals devoted to vetting ideas which helps the analyst make better geospatial decisions. A knowledge team is more akin to a debating team than a sympathetic support group. An effective knowledge team:

• Identifies and shares supporting and contrary information;
• includes subject matter experts to help address key issues;
• develops information that can be used for bench marking analysis, and;
• develops feedback that benefits the analyst problem solving.

Our knowledge team should be a rich mix of individuals meeting the following:

• Qualities include:
  • Individual thinkers, working in sync, with the combined geospatial skills, technical skills, and domain experience that spans the problem domain.
  • A dynamic, likely conflicted team that expresses alternate perspectives, but still has energy and purpose that propels it forward in achieving its purpose.
  • Individuals willing and responsible for expressing their perspective.
  • The contrast with a group. A group is like a bunch of people on a bus all heading in the same direction driven by the bus driver. People do not talk with each other on the bus. They get on and off as they please. The only commonality is the vehicle.
• Actions of the team:
  • demonstrate accountability;
  • demonstrate a high order of geospatial awareness;
  • involve conflict;
  • focus on problem-solving including the geospatial perspective;
  • have a formal leader;
  • have informal leaders;
  • are temporary, and;
  • have individual roles that are critical to and subordinate to team goals. "I" is each of the parts that forms the "we" that pull together to make it about the bigger "us."
• Images that fit teams include:
  • an aircraft carrier, and;
  • a surgical team.

Action 1: Review the spatial corollary from Step 1 (Problem).

Action 2: Make a list of key words or phrases to help identify information about the topic.

For example:

• Shooter
• Terrorist

Action 3: Scan the tertiary sources. Scan means that you should not deal with all of the content, but search through the material looking for an overview and:

• Where is this object or event? (e.g., shooting)
• What is at this object or event? (e.g., access to highway)
• How is this object or event linked to other objects and events? (e.g., periods of heavy traffic)

Internet sites may provide tertiary source for information. However, citation of unvetted Internet sites, such as Wikipedia, in intelligence research is not considered acceptable because they are not considered a credible source. It is important to understand that a tertiary source is often a selective “downstream” summary and compilation of generalizations, analysis, interpretations, or evaluations of original information or primary sources. The most desirable are primary sources (or evidence), that is an artifact, a document, a recording, or other source of information that was created at the time under event.

Action 4: Skim secondary and primary sources relevant to the topic. To skim the material, read a page by reading the headings and first sentences of each paragraph or section. Note sources that might address your geospatial corollary. Secondary sources involve generalization, analysis, synthesis, interpretation, or evaluation of original information or primary sources. A primary source (or evidence) is an artifact, a document, a recording, or other source of information that was created at the time under study.

Action 5: Create an annotated bibliography of sources you will use. An annotated bibliography is a list of citations to books, articles, and documents. Each citation is followed by a brief (30 words) description of the source and a quick evaluation if it pertains to life space, physical space, or intellectual space. For example:

Pherson Associates (2009) The D.C. Sniper Case.

This document is intended to illustrate the Analysis of Competing Hypotheses (ACH) methodology.
Uncertain as to the factual accuracy. if valid, provides an insight into the life and intellectual spaces.

Action 6: Form your knowledge team. Your knowledge team is an informal network of two (2) to five (5) subject matter experts you organize around the problem. The knowledge team members have in common their knowledge about the analytic problem, tools, or techniques to address the problem. Consequently, ideas can be vetted. The role of the analyst is to make sure that all possibilities are considered.

Action 7: Test your understanding. Test your understanding by:

1. Listing the spatial qualities and/or relationships of the life, physical, and intellectual spaces that relate to your problem.
2. Providing a short explanation of the spatial qualities or relationships identified.
3. Providing a short counter-explanation for each item identified in #2 above.
4. Listing possible spatial evidence including, but not limited to, imagery, data sets, and possible GIS operations.

Action 8: Go back to Action 2 and go through the process again. Remember that the research process is a recursive one which means that you may need to revisit your previous work more than once if you find it doesn't work out.

Action 9: If necessary, go back to the problem Definition (Step 1) and revise your Spatial Corollary.

This chapter discusses the third step of the SGAM, highlighted below in gold, Hypothesis Development.

Structured Geospatial Analytic Process, Step 3

A hypothesis is often defined as an educated guess because it is informed by what you already know about a topic. This step in the process is to identify all hypotheses that merit detailed examination, keeping in mind that there is a distinction between the hypothesis generation and hypothesis evaluation.

If the analysis does not begin with the correct hypothesis, it is unlikely to get the correct answer. Psychological research into how people go about generating hypotheses shows that people are actually rather poor at thinking of all the possibilities. Therefore, at the hypothesis generation stage, it is wise to bring together a group of analysts with different backgrounds and perspectives for a brainstorming session. Brainstorming in a group stimulates the imagination and usually brings out possibilities that individual members of the group had not thought of. Experience shows that initial discussion in the group elicits every possibility, no matter how remote, before judging likelihood or feasibility. Only when all the possibilities are on the table, is the focus on judging them and selecting the hypotheses to be examined in greater detail in subsequent analysis.

When screening out the seemingly improbable hypotheses, it is necessary to distinguish hypotheses that appear to be disproved (i.e., improbable) from those that are simply unproven. For an unproven hypothesis, there is no evidence that it is correct. For a disproved hypothesis, there is positive evidence that it is wrong. Early rejection of unproven, but not disproved, hypotheses biases the analysis, because one does not then look for the evidence that might support them. Unproven hypotheses should be kept alive until they can be disproved. One example of a hypothesis that often falls into this unproven but not disproved category is the hypothesis that an opponent is trying to deceive us. You may reject the possibility of denial and deception because you see no evidence of it, but rejection is not justified under these circumstances. If deception is planned well and properly implemented, one should not expect to find evidence of it readily at hand. The possibility should not be rejected until it is disproved, or, at least, until after a systematic search for evidence has been made, and none has been found.

There is no "correct" number of hypotheses to be considered. The number depends upon the nature of the analytical problem and how advanced you are in the analysis of it. As a general rule, the greater your level of uncertainty, or the greater the impact of your conclusion, the more alternatives you may wish to consider. More than seven hypotheses may be unmanageable; if there are this many alternatives, it may be advisable to group several of them together for your initial cut at the analysis.

Developing Multiple Hypotheses

Developing good hypotheses requires divergent thinking to ensure that all hypotheses are considered. It also requires convergent thinking to ensure that redundant and irrational hypotheses are eliminated. A hypothesis is stated as an "if … then" statement. There are two important qualities about a hypothesis expressed as an "if … then" statement. These are:

• Is the hypothesis testable; in other words, could evidence be found to test the validity of the statement?
• Is the hypothesis falsifiable; in other words, could evidence reveal that such an idea is not true?

Hypothesis development is ultimately experience-based. In this experienced-based reasoning, new knowledge is compared to previous knowledge. New knowledge is added to this internal knowledge base. Before long, an analyst has developed an internal set of spatial rules. These rules are then used to develop possible hypotheses.

Looking Forward

Developing hypotheses and evidence is the beginning of the sensemaking and Analysis of Competing Hypotheses (ACH) process. ACH is a general purpose intelligence analysis methodology developed by Richards Heuer while he was an analyst at the Central Intelligence Agency (CIA). ACH draws on the scientific method, cognitive psychology, and decision analysis. ACH became widely available when the CIA published Heuer’s The Psychology of Intelligence Analysis. The ACH methodology can help the geospatial analyst overcome cognitive biases common to analysis in national security, law enforcement, and competitive intelligence. ACH forces analysts to disprove hypotheses rather than jump to conclusions and permit biases and mindsets to determine the outcome. ACH is a very logical step-by-step process that has been incorporated into our Structured Geospatial Analytical Method. A complete discussion of ACH is found in Chapter 8 of Heuer’s book. [1]

Science follows at least three general methods of problem solving using hypotheses. These can be called the:

• method of the ruling theory
• method of the working hypothesis
• method of multiple working hypotheses

The first two are the most popular but they can lead to overlooking relevant perspectives, data, and encourage biases. It has been suggested that multiple hypotheses offers a more effective way of overcoming this problem.

Ruling Theories and Working Hypotheses

Our desire to reach an explanation commonly leads us to a tentative interpretation that is based on a single case. The explanation can blind us to other possibilities that we ignored at first glance. This premature explanation can become a ruling theory, and our research becomes focused on proving that ruling theory. The result is a bias to evidence that disproves the ruling theory or supports an alternate explanation. Only if the original hypothesis was by chance correct does our analysis lead to any meaningful intelligence work. The working hypothesis is supposed to be a hypothesis to be tested, not in order to prove the hypothesis, but as a stimulus for study and fact-finding. Nonetheless, the single working hypothesis can become a ruling theory, and the desire to prove the working hypothesis, despite evidence to the contrary, can become as strong as the desire to prove the ruling theory.

Multiple Hypotheses

The method of multiple working hypotheses involves the development, prior to our search for evidence, of several hypotheses that might explain what are attempting to explain. Many of these hypotheses should be contradictory, so that many will prove to be improbable. However, the development of multiple hypotheses prior to the intelligence analysis lets us avoid the trap of the ruling hypothesis and thus makes it more likely that our intelligence work will lead to meaningful results. We open-mindedly envision all the possible explanations of the events, including the possibility that none of the hypotheses are plausible and the possibility that more research and hypothesis development is needed. The method of multiple working hypotheses has several other beneficial effects on intelligence analysis. Human actions are often the result of several factors, not just one, and multiple hypotheses make it more likely that we will see the interaction of the several factors. The beginning with multiple hypotheses also promotes much greater thoroughness than analysis directed toward one hypothesis, leading to analytic lines that we might otherwise overlook, and thus to evidence and insights that might never have been considered. Thirdly, the method makes us much more likely to see the imperfections in our understanding and thus to avoid the pitfall of accepting weak or flawed evidence for one hypothesis when another provides a more possible explanation.

Drawbacks of Multiple Hypotheses

Multiple hypotheses have drawbacks. One is that it is difficult to express multiple hypotheses simultaneously, and therefore there is a natural tendency to favor one. Another problem is developing a large number of hypotheses that can be tested. A third possible problem is that of the indecision that arises as an analyst balances the evidence for various hypotheses, which is likely preferable to the premature rush to a false conclusion.

Actions That Help the Analyst Develop Hypotheses

Action 1: Brainstorming. Begin with a brainstorming session with your knowledge team to identify a set of alternative hypotheses. Focus on the hypotheses that are:

• logically consistent with the theories and data uncovered in your grounding;
• address the quality and relationships of spaces.

State the hypotheses stated in an "if ... then" format, for example:

• If the DC Shooter is a terrorist, then the geospatial pattern of events would be similar to other terrorist acts.
• If the DC Shooter is a serial killer, then the geospatial pattern of events would be similar to other serial killers.

Action 2: Review the hypotheses for testability, i.e., can evidence be could found to test the validity of the statement.

Action 3: Check the hypotheses for falsifiability, i.e., could evidence reveal that such an idea is not true.

Action 4: Combine redundant hypotheses.

Action 5:Consider the elimination of improbable and unproven hypotheses.

This chapter discusses the fourth step of the SGAM, highlighted below in gold, Evidence Development.

Structured Geospatial Analytic Process, Step 4

How do you choose your evidence? By basic definition, evidence is proof supporting a theory. The term evidence in geospatial intelligence includes the combination of aspatial evidence and spatial evidence to increase the estimate of the probability of the truthfulness of a hypothesis. It is important to note that evidence is dependent on the agent that estimates the probability. This is to say, a map, data, or textual information is regarded as evidence only when it is compatible with the hypothesis.

The goal is thinking with the evidence vs. thinking about the subject matter of the evidence. This is an important distinction and critical to the use of evidence to explain other evidence, solving problems, and formulating a perspective. Evidence includes assumptions and logical deductions as well as specific reported or researched items. Assumptions or logical deductions about how things normally work are often more important than hard evidence in determining analytical conclusions. Using geospatial tools, you can begin to further identify and characterize patterns. Here, developing evidence requires an understanding of the data, domain, and how to appropriately manipulate the data. These internal rule sets allow an analyst to evaluate evidence. The internal rule sets can be modified and enhanced as additional information is added and integrated into thinking. Sources of evidence may include:

• Print sources including maps, text books, and photos
• Electronic sources including digital geographic databases, imagery, photos, spread sheets, graphs, etc. from Internet sites such as Twitter, Facebook, blogs, MySpace, Flickr, YouTube, etc.
• Interviews, surveys, and intercepts
• Experiments such as GIS modeling, statistical models, geovisualization, data exploration, geostatistics, network analysis, etc.
• Personal experience

The absence of evidence is also evidence and should be noted. Not all evidence needs to be included. Old evidence is likely to bias the analysis in favor of concluding that the status quo will continue. If there is going to be a significant change, that may well be apparent only from the recent evidence.

The following actions help the analyst to develop evidence.

Action 1: Make a list of the significant evidence.

Action 2: Acquire or develop missing evidence. The recognition, collection, development, and effective presentation of evidence is essential to successful analysis. Use GIS and remote sensing tools to develop evidence in support your analysis.

Action 3: Describe the evidence. Does this occur in life, physical, or intellectual space? What does the evidence teach about the fundamental spatial questions of where, what, and how objects are linked? What are the important spatial qualities and relationships?

Action 4: Evaluate the evidence. Evaluate:

• Credibility - Trustworthy source, author’s credentials, evidence of quality control, known or respected authority, organizational support.
• Accuracy - Lineage, positional accuracy, attribute accuracy, logical consistency, temporal quality, and resolution.
• Reasonableness - Fair, balanced, objective, reasoned, no conflict of interest, absence of fallacies or slanted tone.
• Support - Listed sources, contact information, available corroboration, claims supported, documentation supplied.

Action 5: Check for significant missing evidence. Ask yourself for each hypothesis: If this hypothesis is true, what are all the spatial qualities and relationships that must have happened and what evidence of this should I expect to see? Then ask: If I am not seeing this evidence, why not? Is it because it is not happening, it is being concealed, or because I have not looked for it? Include as evidence the absence of things you would expect to see if a hypothesis were true.

Action 6: Check for deception. If you are uncertain whether an item of evidence is deceptive, enter that evidence twice, once with the assumption that it is not deceptive, and once with the assumption that it is deceptive.

This chapter discusses the fifth step of the SGAM, highlighted below in gold, Fusion.

Structured Geospatial Analytic Process, Step 5

The integration of data, recorded from multiple modes, together with knowledge, is known as fusion according to this paper by J. Esteban published in 2005 [13]. Fusion is specifically used here as a term to describe how an organization arrives at a decision based upon data and information. Traditionally, the field has been thought to be the domain of mathematicians and statisticians who could use facts to justify a decision. In general, fusion is the process one goes through in an analytic method so that the influence of unreliable sources can be lowered compared to the reliable sources according to this document by Kludas published in 2007 [14]. In a great sense, the multi modal (graphical and text) nature of geospatial intelligence data analysis to reduce the influence of unreliable sources is essentially a fusion process. Step 5 of the SGAM is where it happens.

The following actions are involved in the fusion of information:

Action 1: Prepare a matrix with hypotheses across the top and evidence and arguments down the side. Please note that your evidence and arguments may or may not be geospatial in nature. The matrix gives an overview of all the significant components of your analytical problem.

Figure 1: Matrix with hypotheses across the top and arguments down the side

Action 2: Working down the column to each piece of evidence and then across the rows of the matrix, examine one item of evidence at a time to see how consistent that item of evidence is with each of the hypotheses. Later you will work across the columns of the matrix, examining one hypothesis at a time, to see how consistent that hypothesis is with all the evidence.

Figure 2: Working down the matrix

To fill in the matrix, take the first item of evidence and ask whether it is consistent with, inconsistent with, or irrelevant to each hypothesis. Then make a notation accordingly in the appropriate cell under each hypothesis in the matrix. The form of these notations in the matrix is a matter of personal preference. It may be pluses, minuses, and question marks. It may be C, I, and N/A standing for consistent, inconsistent, or not applicable. Or it may be some textual notation. Simply put, what you use is a shorthand representation of the complex reasoning that went on as you thought about how the evidence relates to each hypothesis. In some cases, it may be useful to refine this procedure by using a numerical probability, rather than a general notation such as plus or minus, to describe how the evidence relates to each hypothesis.

Analyze the "diagnosticity" of each piece of evidence and each argument as you complete the matrix. This step is the most important; it is the step that deviates most from the intuitive approach to geospatial analysis. Diagnosticity is how helpful the evidence or argument is in judging the relative likelihood of alternative hypotheses. Diagnosticity of evidence is an important concept that is unfamiliar to many geospatial analysts. Diagnosticity may be illustrated by a medical analogy. A high-temperature reading may have great value in telling a doctor that a patient is sick, but relatively little value in determining which illness a person is suffering from. Because a high temperature is consistent with so many possible hypotheses about a patient's illness, this evidence has limited diagnostic value in determining which illness (hypothesis) is the most likely one.

The matrix format helps you weigh the diagnosticity of each item of evidence. If an item of evidence seems consistent with all the hypotheses, it may have no diagnostic value. A common experience is to discover that most of the evidence supporting what you believe is the most likely hypothesis really is not very helpful, because that same evidence is also consistent with other hypotheses. When you do identify items that are highly diagnostic, these should drive your judgment.

Action 3: Refine the matrix by reconsidering the hypotheses, and delete evidence and arguments that have no diagnostic value. The wording of the hypotheses is critical to the conclusions one can draw from the analysis. By this point, you will have seen how the evidence breaks out under each hypothesis, and it is necessary to reconsider and reword the hypotheses. New hypotheses may need to be added, or finer distinctions may need to be made in order to consider all the significant alternatives. If there is little or no evidence that helps distinguish between two hypotheses, consider combining the two.

Also, reconsider the geospatial evidence. Question if your thinking about which hypotheses are most likely and least likely is influenced by factors that are not included in the evidence. If so, use the data and tools in hand to create this evidence and include it in your analysis. Delete from the matrix items of evidence or arguments that now seem unimportant or have no diagnostic value. Save these items in a separate list as a record of information that was considered.

This chapter discusses the fifth step of the SGAM, highlighted below in gold, Develop Conclusions and Report.

Structured Geospatial Analytic Process, Step 6

Develop Tentative Conclusions

The matrix gives an overview of all the evidence for and against all the hypotheses. Proceed by rejecting or eliminating hypotheses, while tentatively accepting only those hypotheses that cannot be refuted. Critically, the matrix should not dictate the conclusion. It simply reflects your judgment of what is important and how these important factors relate to the probability of each hypothesis. The matrix is an aid to thinking and analysis, to ensure consideration of all the possible interrelationships between evidence and hypotheses and identification of those few items that really swing your judgment on the issue.

Applying Judgment

No matter how much information is consistent with a given hypothesis, hypotheses cannot be proved as true. The fact that a hypothesis is inconsistent with the evidence is the basis for rejecting it. The pluses, indicating evidence that is consistent with a hypothesis, are less significant because a list of evidence that is consistent with almost any reasonable hypothesis can be easily made. What is difficult to find, and is most significant when found, is hard evidence that is clearly inconsistent with a reasonable hypothesis. The analyst should look for the linchpin assumptions or items of evidence that really drive the outcome of your analysis. Do this by asking:

• Are there questionable assumptions that drive your understanding and interpretation?
• Are there unexplored alternative explanations or interpretations?
• Could the evidence be incomplete and misleading?

If there is any concern at all about denial and deception, look at the sources of your key evidence. When analysis turns out to be wrong, it is often because of key assumptions that went unchallenged and proved invalid. The problem is to determine which assumptions merit questioning.

Reporting Your Conclusions

When writing your report, identify critical assumptions that went into your interpretation and note that your conclusion is dependent upon the validity of these assumptions. The written argument for a certain judgment is incomplete without a discussion of alternative judgments that were considered and why they were rejected. An analytical conclusion is always tentative. The situation may change, or it may remain unchanged while you receive new information that alters your appraisal. To address this, specify in advance milestones one should look for or be alert to that, if observed, would suggest a significant change in the probabilities.

Action 1: Develop Tentative Conclusions. You will now draw tentative conclusions about the relative likelihood of each hypothesis by trying to disprove the hypotheses rather than prove them. The matrix format gives an overview of all the evidence for and against all the hypotheses, so that you can examine all the hypotheses together and have them compete against each other. Previously you analyzed the "diagnosticity" of the evidence and arguments by working down and across the matrix, focusing on a single item of evidence and examining how it relates to each hypothesis. Now, work across and down the matrix, looking at each hypothesis and the evidence as a whole.

Working across the matrix

Analysts have a natural tendency to concentrate on confirming hypotheses they already believe to be true, and giving more weight to information that supports a favored hypothesis than to information that weakens it. Moreover, no matter how much information is consistent with a given hypothesis, you cannot prove that hypothesis is true, because the same information may also be consistent with one or more other hypotheses. On the other hand, a single item of evidence that is inconsistent with a hypothesis may be sufficient grounds for rejecting that hypothesis.

This step requires doing the opposite of what comes intuitively when evaluating the relative likelihood of alternative hypotheses, by looking for evidence or arguments that enable you to possibly reject the hypothesis or determine that it is unlikely. This follows a fundamental concept of the scientific method of rejecting or eliminating hypotheses, while tentatively accepting only those hypotheses that cannot be refuted. The scientific method obviously cannot be applied without the analyst's intuitive judgment, but the principle of seeking to disprove hypotheses, rather than confirm them, helps to overcome the natural tendency to favor one hypothesis.

In examining the matrix, look at the minuses, or whatever other notation you used to indicate geospatial evidence that may be inconsistent with a hypothesis. The hypothesis with the fewest minuses is probably the most likely one. The hypothesis with the most minuses is probably the least likely one. The fact that a hypothesis is inconsistent with the evidence is certainly a sound basis for rejecting it. The pluses, indicating evidence that is consistent with a hypothesis, are far less significant. It does not follow that the hypothesis with the most pluses is the most likely one, because a long list of evidence that is consistent with almost any reasonable hypothesis can be easily made. What is difficult to find, and is most significant when found, is hard evidence that is clearly inconsistent with a reasonable hypothesis.

This initial ranking by number of minuses is only a rough ranking, however, as some evidence obviously is more important than other evidence, and degrees of inconsistency cannot be captured by a single notation such as a plus or minus. By reconsidering the exact nature of the relationship between the evidence and the hypotheses, you will be able to judge how much weight to give it. Analysts who follow this procedure often realize that their judgments are actually based on very few factors, rather than on the large mass of information that they thought was influencing their views.

Action 2: Apply Judgment: The matrix does not dictate your conclusion. Rather, it should accurately reflect a judgment of what is important and how the evidence relates to the probability of each hypothesis. You, not the matrix, makes the decision. The matrix only organizes your analysis, to ensure consideration of all the possible interrelationships between evidence and hypotheses, and to identify those items that heavily influence your reasoning.

The matrix may show a hypothesis is probable, and you may disagree. If so, it is because you omitted from the matrix evidence or arguments that influenced on your judgment. Go back and add the evidence or argument, so that the analysis reflects your best judgment. Following this procedure will cause you to consider things you might otherwise have overlooked or revise your earlier estimate of the relative probabilities of the hypotheses. When you are done, the matrix serves as an audit trail of your thinking and analysis.

Importantly, this process forces you to spend more analytical time than you otherwise would on what you had thought were the less likely hypotheses. The seemingly less likely hypotheses usually involve more work. What you started out thinking was the most likely hypothesis tends to be based on a continuation of your recalled geospatial experiences and patterns. A principal advantage of the analysis of competing hypotheses to geospatial intelligence is that it forces you to consider the alternatives.

Action 3: Sensitivity Analysis: You should analyze how sensitive your conclusion is to a few critical items of evidence. This is done by considering the consequences for your geospatial analysis if that evidence were wrong, misleading, or subject to a different interpretation. In Step 5, you identified the evidence and arguments that were most diagnostic, and later you used these findings to make tentative judgments about the hypotheses. Now, go back and question the key items of evidence that drive the outcome of the analysis:

• Are there questionable assumptions that underlie your understanding and interpretation?
• Are there alternative explanations or interpretations?
• Could the evidence be incomplete and, therefore, misleading?

If there is any concern at all about denial of information and/or deception, this is an appropriate place to consider that possibility. Look at the sources of key evidence:

• Are any of the sources known to be controlled by a distrusted actor?
• Could the sources have been duped and provided information that was planted?
• Could the information have been manipulated?

Put yourself in the shoes of a deception planner to evaluate motive, opportunity, means, costs and benefits of deception as they might appear to the opponent.

Action 4: Report Your Conclusions. In this step, you may decide that additional research is needed to check key judgments. It may be appropriate to go back to check the original source materials rather than relying on someone else's interpretation. In writing your report, it is desirable to identify critical assumptions that went into your interpretation and to note that your conclusion is dependent upon the validity of these assumptions. If your report is to be used as the basis for decision-making, it is appropriate to provide the relative likelihood of alternative possibilities. Analytical judgments are never certain. Decision-makers need to make decisions on the basis of a full set of alternative possibilities, not just the single most likely alternative. You should consider a fallback plan in case one of the less likely alternatives turns out to be true.

Action 5: Establish Milestones to Monitor. Analytical conclusions are always tentative, therefore, it is important to identify milestones that may indicate events are taking a different course than predicted. It is always helpful to specify things one should look for that suggest a significant change in the probabilities. This is useful for intelligence consumers who are following the situation on a continuing basis. Specifying in advance what would cause you to change your mind will also make it more difficult for you to rationalize such developments as not really requiring any modification of your judgment.

In October 2002, local, state, and federal authorities from the Washington, DC area joined in an unprecedented cooperative effort to capture the individuals charged with a series of shootings that paralyzed the National Capital Region. John Allen Muhammad and John Lee Malvo were apprehended following a 3-week shooting spree that brought together uniformed and investigative law enforcement personnel and communications resources from across the region. The extensive response and investigative effort required intelligence that was shared among hundreds of law enforcement officers from a variety of jurisdictions and levels of government.

Background

There were attempts to geographically profile the killers, that is, predict where they would kill next based on the killer's spatial pattern or signature. Geographic profiling brings the science of geography, criminology, mathematical modeling, statistical analysis, and environmental and forensic psychology into the realm of criminal investigation. Below is a news report about Dr. Kim Rossmo's geographic profiling: [15]

For geographic profiling to produce accurate profiles, the serial offenders must follow a predictable spatial model (or pattern). There is good reason to believe serial offenders do. Research has repeatedly shown that the majority of serial criminals travel relatively short distances from home to commit their crimes. Research has also demonstrated that the home location of many serial offenders' crimes literally surrounds their home; referred to as a marauding pattern. These are the primary reasons for the effectiveness of geographic profiling when applied to "typical" criminals. When serial offenders behave in ways that contradict these behaviors, such as terrorist activity, geographic profiling will typically be ineffective (Bennell, 2007 [17]). For more general information read Forecasting the Future of Predictive Crime Mapping [18]. Specifically look at the section on "The Role of Theory in Predictive Mapping."

The Analytic Question

There are significant differences between a “factoid question,” which are most common in Geospatial Intelligence, and an “analytical question.” A factoid question seeks a piece of information that would can be answered with a corresponding true statement. For example:

Question: “How many miles are between two shooter events?”

Answer: “There are 5 miles between events.”

In general, a factoid question usually has just one correct answer that can be easily judged for its truthfulness. Answers tofactoid questions are important as evidence but are not the focus of an analytic effort. Data foraging provides factoids (or evidence), small but potentially important bits of information.

In contrast to a factoid question, an analytical question has a less certain relationship with expected answer. For example:

Question: “Who is the DC Shooter?”

Answer: “The shooter could be a foreign terrorist or a serial killer.”

The geospatial aspects of the DC Shooter actions can still help to answer our question as part of a bottom-up process (from data to theory) or top-down (from theory to data). The bottom-up process converts raw information into knowledge of our killers. The top-down process provides evidence to support or disconfirm the assumed spatial signature of the killers. The question we have asked is, who is the DC Shooter (based on the total evidence we have included their spatial profile)?

Referring to the case study [19], the DC Beltway shooter attacks took place during three weeks in October 2002, in Washington, D.C., Maryland, and Virginia. Ten people were killed and three others critically injured in various locations throughout the Washington Metropolitan Area and along Interstate 95 in Virginia.

There are several important definitions we will use. These are:

• A serial killer is a person who murders three or more people over a period of more than thirty days, with a "cooling off" period between each murder, and whose motivation for killing is largely based on psychological gratification.
• Domestic terrorism is violence committed by a group(s) of two or more individuals to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.
• Foreign terrorism is violence committed by a group(s) of two or more individuals originating outside the US to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.

Maps of the shootings and ballistics information can be found on the Washington Post web site [20].

Beltway Sniper Shootings Map

Source: Wikipedia article on Beltway Sniper [21]

As discussed previously, there were attempts to spatially "model" the Shooter's behavior. Here is another article about the geographic profiling:

Dr. Maurice Godwin suggests that Rossmo's geographical model (See Rossmo's description [22]) was wrong and offered another spatial model [23] for the shooter's behavior. Research findings also indicated that there is a strong relationship among the locations of the terrorist incident, terrorists’ preparatory behaviors, and where these terrorists reside. Research in terrorist geospatial patterns and behavior is found in Geospatial Analysis of Terrorist Activities: The Identification of Spatial and Temporal Patterns of Preparatory Behavior of International and Environmental Terrorists [24]. Based on this information and other profiling efforts, here are some of the inferences and speculations offered about the DC shooter prior to the arrest of the two suspects (http://www.corpus-delicti.com/prof_archives_profiles.html [25]):

• FBI / Inductive profilers
  • white male
  • 25 to 40 years old
  • not a shooter and not likely military because of weapon choice (inaccurate round)
  • lives in or near the community>
  • no children
  • >firefighter or construction worker
  • possible terrorist links
  • not a true spree killer because a true spree killer would have kept going south.

• Deductive profiling
  • no evidence of race
  • no evidence of one or two offenders
  • anger motivation
  • cumulative rage from successive failures in personal life
  • straw that broke the camel's back would be an event in personal life such as divorce, custody battles, and/or loss of job.
  • would want to talk about offenses
  • case would most likely be solved by a tip from alert citizens
  • no shooter training (not a very good shot)
  • possible second or third party involved
  • limited evidence of a terrorist connection

Quality of Information Check

Weighing the validity of sources is critical thinking that the confidence of any analytic judgments ultimately rest upon. Analysts should review the quality of their information and refresh their understanding of the strengths and weaknesses. This is part of becoming grounded in the problem. Without understanding the context and conditions under which critical information has been provided, it will be difficult for analysts to assess the information’s validity and establish a confidence level in an intelligence assessment.

Using the DC Shooter scenario, perform a brief quality of information check as part of your grounding. Specifically:

• Identify geospatial information sources that might be critical but were not provided;
• check for corroboration of the locations (coordinates) with the text;
• validity of the geospatial behavioral models used, and;
• indicate a level of confidence you have in the sources which are likely to be used in future analytic assessments.

Example Quality of Information Check Results:

The following geospatial evidence could have been useful given more time and resources:

• High resolution land characterization to determine if shooting locations had sufficient vegetation or other cover within rifle range;
• geospatial behavioral models for criminal activities associated with shooter events, and;
• street camera recordings to identify the people and vehicles present at the crime scene locations.

Corroboration of the locations with the text were as stated:

• Using Google Earth, the site descriptions and addresses matched the coordinates.

Level of confidence you have in the sources, which are likely to figure in future analytic assessments.

• We are confident in the general locations with respect to the address but not the specific locations with respect to the site and events.

• Disgruntled Michael’s employee;
• foreign terrorist;
• serial killer, and;
• domestic terrorist.

Our initial evidence includes:

• Conforms to the geospatial model of a serial criminal.
• The majority of the shootings were at or near shopping centers. That is, the events are not near governmental buildings indicating that the government is not a target.
• Shootings were all on major highways or interstates for a quick exit from the scene. This indicates a desire not to be caught.
• There was only one shooting per location and often occurred at gas stations. This seems to indicate our Shooter is not in the role of a suicide terrorist.
• Sighting of a blue car with two black men.
• Sighting of a white van with two individuals at one killing.
• Military caliber weapon (5.56mm). This caliber is common to the US military and is also a sporting cartridge.
• Noise heard but shooter never seen. This possibly indicates some sniper training.

A matrix with hypotheses across the top and evidence and arguments down the side is developed. Note that your evidence and arguments may or may not be geospatial in nature.

Work down the evidence column and across the rows of the matrix, examining one item of evidence at a time to see how consistent that item of evidence is with each of the hypotheses. Make a notation C, I, and N/A standing for consistent, inconsistent, or not applicable. In this example, the evidence is weighted by using combinations of CC, II, C, and I.

Analyze the "diagnosticity" of each piece of evidence. We discover that the evidence of the rifle's caliber is not very helpful because it is consistent with all hypotheses. Refine the matrix by reconsidering the hypotheses and delete evidence and arguments that have no diagnostic value. In the case, I deleted the "Military caliber weapon (5.56mm)" evidence since it offered no diagnosticity.

Examine each the hypothesis one at a time by looking down the column to consider each hypothesis as a whole. Draw tentative conclusions by trying to disprove the hypotheses. Look at the “I”s to indicate evidence that may be inconsistent with a hypothesis. Generally, the hypothesis with the fewest “I”s is probably the most likely one. The hypothesis with the most “I”s is probably the least likely one.

The evidence leads us to believe the acts are either a foreign or domestic terrorist whose motivations are either unclear or are being concealed from the law enforcement authorities. There is also a preponderance of evidence to imply that there is actually a team committing the crimes and that it is not a single individual.

The analysis has lead us to the mostly likely hypothesis that the attacks were carried out by a terrorist with only a thin line between Domestic or Foreign. The milestones that would lead us to one or the other would be:

• An indication of motive - If the terrorist makes a list of demands that would indicate whether his goals are foreign based or domestic would be a solid indication of motive.
• An idealist alignment - If some sort of clue was left that showed the terrorist's beliefs, it would be much easier to pin point the terrorist's origins.

This report [26] is aimed at documenting the identification, discovery, filtering, and deriving of evidence, with a particular focus on geospatial information, to address the following analytic question. This effort is only intended as an initial building block which a subsequent analysis enhances and refines when making sense of the accumulated evidence in the context of the problem.

The geospatial narrative focuses on the sensemaking loop and involves iterative development of a mental model from the schema that best fits the evidence. The report documents the analysis of a place, events, and individuals linked to the location related aspects of an analytic question. An outline of this narrative is provided here. [27]