Before a Link Becomes Intelligence

A line on a chart is easy to draw. Justifying what that line means is considerably harder.

Two people appear in the same database. Two telephone numbers communicate. Two vehicles are observed near the same location. Two organizations share an address. One individual follows another on social media. Money moves between two accounts.

A connection exists.

But what kind of connection is it? How reliable is the underlying information? Is the association operational, financial, familial, administrative, historical, coincidental, or entirely misunderstood? Most importantly, does the connection help answer the intelligence question?

These questions mark the difference between data visualization and intelligence analysis.

A link chart may accurately reproduce information from a database while still presenting a misleading picture of the network. The software can show that two entities are connected. It cannot independently determine whether that connection is meaningful.

That judgment belongs to the analyst.

Link charts are persuasive because they convert fragmented information into a visible structure. Names, telephone numbers, addresses, vehicles, financial accounts, locations, organizations, and events suddenly appear to form a network.

The result feels analytical.

A dense chart looks sophisticated. A highly connected node appears important. A cluster appears coordinated. A line between two subjects suggests a relationship that deserves attention.

Sometimes those interpretations are correct.

Sometimes the chart is merely showing that several people use the same commercial service, live in the same apartment complex, appear in a broadly populated database, attended the same public event, or were mentioned in reports containing similar terminology.

The visual connection may be real while its analytical importance is negligible.

This is why analysts must resist a dangerous mental shortcut:

Visible association does not automatically establish substantive relevance.

The line is not the intelligence. The line is a proposition that the analyst must test.

The distinction between information and intelligence is foundational to the profession.

The Bureau of Justice Assistance’s discussion of intelligence-led policing explains that intelligence is not simply what has been collected. Intelligence is produced after collected information has been evaluated and analyzed. The analyst transforms fragmented reporting into something that can inform a decision.

That transformation requires more than retrieving records and arranging them visually.

The Office of the Director of National Intelligence identifies several applicable tradecraft expectations in its explanation of Intelligence Community Directive 203. Analysts should:

• Describe the quality and credibility of sources, data, and methodologies.

• Express and explain uncertainty.

• Distinguish underlying intelligence information from assumptions and judgments.

• Incorporate analysis of alternatives.

• Demonstrate relevance to the customer.

• Use clear and logical argumentation.

• Employ effective visual information where appropriate.

A link chart may contribute to several of these standards. It can clarify relationships, reveal gaps, identify clusters, and support communication.

It can also undermine those standards when it disguises uncertainty, omits provenance, or presents an inference as though it were an observed fact.

The chart is therefore not merely a picture of the investigation.

It is an argument about the investigation.

Suppose two individuals communicated by telephone.

That fact alone does not establish:

• Who initiated the communication

• Who used each device

• What was discussed

• Whether the contact was unusual

• Whether the interaction was criminally or operationally relevant

• Whether the relationship continued

• Whether either party understood the other’s activities

• Whether the communication affected the event under examination

Likewise, co-location does not automatically establish coordination. A financial transaction does not establish illicit purpose. Organizational membership does not establish operational knowledge. Social-media interaction does not establish a substantive relationship.

The problem is not that analysts use these associations. Many investigations begin with precisely such fragments.

The problem arises when the analytical language becomes stronger than the evidence.

“Communicated with” becomes “coordinated with.”

“Was present near” becomes “participated in.”

“Transferred funds to” becomes “financed.”

“Is associated with” becomes “is a member of.”

“Appears in the network” becomes “plays a central role.”

Each change may seem linguistically minor. Analytically, it is substantial. The language has moved from observation to inference and then from inference to implied certainty.

Before treating an association as analytically meaningful, apply five tests:

• V — Verify the entities and sources

• A — Articulate the exact relationship

• L — Link the relationship to the intelligence requirement

• I — Investigate alternative explanations

• D — Define confidence and implications

Together, these questions form the VALID framework.

Before interpreting a connection, determine whether the entities have been identified correctly.

This sounds elementary. It is not.

Names may be duplicated. Addresses may be outdated. Telephone numbers may be reassigned. Devices may be shared. IP addresses may represent multiple users. Commercial databases may merge separate individuals or reproduce the same original record through several vendors.

The analyst should ask:

• Are these genuinely separate entities?

• Has each identity been resolved?

• What source establishes the connection?

• Is the source direct, derived, or algorithmically inferred?

• How recent is the information?

• Has the connection been corroborated independently?

• Are several apparently independent records derived from the same original report?

Five records do not provide five-source corroboration when all five copied the same underlying information.

Source volume and source independence are not the same thing.

The word “associated” is often analytically evasive.

Associated how?

A useful link description should identify the nature of the relationship:

• Communicated with

• Resided with

• Was employed by

• Transferred funds to

• Traveled with

• Was observed with

• Shared ownership of

• Accessed the same account

• Participated in the same event

• Was named by

• Reported to

• Supplied

• Directed

• Facilitated

The analyst should also identify:

• Direction

• Frequency

• Duration

• Recency

• Exclusivity

• Sequence

• Strength

• Source

A single telephone contact five years ago is not equivalent to 37 contacts during the forty-eight hours preceding an event. Both produce a line on a chart, but they do not carry the same analytical weight.

Precision in describing the relationship is one of the simplest ways to prevent exaggeration.

A link may be valid and still be irrelevant.

This is the test analysts most often neglect.

The question is not merely:

Are these entities connected?

The better question is:

How does this connection help answer the intelligence requirement?

Suppose the intelligence requirement concerns whether a burglary series involves coordinated offenders. Discovering that two subjects attended the same high school may be accurate background information, but it does not necessarily demonstrate present coordination.

The analyst should ask:

• What proposition does this link support?

• Which hypothesis becomes more or less likely?

• Does the relationship help explain capability, access, intent, opportunity, movement, financing, communication, or command?

• Would removing this link materially alter the assessment?

• Is the link relevant to the decision the customer must make?

If the analyst cannot explain the link’s relationship to the intelligence requirement, the connection may belong in the database but not in the finished assessment.

Relevance is not a property possessed by information in isolation. It is a relationship between information and a question.

Analysts should actively search for explanations that do not support the initial hypothesis.

A shared address could indicate:

• Family membership

• A former residence

• A commercial mail service

• A shelter

• A large apartment complex

• An employer

• Identity theft

• A data-entry error

A financial transfer could represent:

• Reimbursement

• Rent

• A legitimate purchase

• Shared household expenses

• Repayment of a loan

• Criminal proceeds

• Operational financing

The purpose is not to invent a harmless explanation and declare the matter resolved. Nor is it to treat every alternative as equally probable.

The purpose is to determine whether the preferred interpretation survives comparison with credible alternatives.

A strong analyst asks:

What else could produce the same observed pattern?

A disciplined analyst then identifies the information needed to distinguish among those explanations.

After verifying and evaluating the link, the analyst must state what can reasonably be concluded.

This includes:

• The strength of the association

• The reliability of the supporting information

• The importance of the relationship

• Remaining collection gaps

• Plausible alternative explanations

• The analyst’s confidence

• Operational or strategic implications

The conclusion should not be stronger than its weakest essential premise.

Consider the difference between these judgments:

Mercer is a central coordinator in the burglary network.

And:

Multiple communications and a recent financial transfer indicate that Mercer likely maintains a substantive relationship with two subjects involved in the burglary series. The purpose of the communications and transfer remains unknown, limiting confidence that Mercer exercised a coordinating role.

The second judgment is less dramatic.

It is also more useful because it tells the decision-maker what is known, what is assessed, what remains uncertain, and what should be collected next.

That is analytical integrity.

Paid subscribers receive the complete VALID worksheet, link-strength scale, practical crime-analysis scenario, model assessment language, and supervisor review checklist below.