Analytical techniques

There are a number of techniques to be considered when conducting analysis. They can be used to understand and predict threat, harm, risk and opportunities. Analytical techniques include traditional and emerging techniques alongside thinking products that encourage the thought space to ensure effective analysis. This section covers a number of the techniques available but is not exhaustive.

When considering the question and determining the most appropriate technique(s) to use, the analyst should not be constrained by the outcome or the end analytical profiles. More and more analytical products are the result of a combination of several techniques within one product.

The techniques fall into five groups, defined by the function they perform within the analytical process.

• Creative thinking and hypothesis generation.
• Making sense of complex data.
• Hypothesis testing.
• Generation and evaluation of scenarios.
• Other techniques.

Creative thinking and hypothesis generation

Key assumptions checks

Our assumptions affect virtually every perception we have and assessment we make. In the majority of cases, they are subconscious and, in some cases, they are based on fact and may prove correct. In some instances, our assumptions are actually key uncertainties. It is essential that we identify our key assumptions so that we are aware of them and that they do not enter into our analysis.

Key Assumption Checks (KACs) are used once a most likely scenario has been established. The process involves identifying all the assumptions behind the likely scenario, then making judgements about how important and well supported they are. This allows the analyst to check their own analysis or that of another analyst for hidden (unconscious) assumptions which may have gone unchallenged over time. This technique is extremely important for analysts who routinely have to make assumptions in order to fill in the gaps in the information they receive where information is incomplete or ambiguous.

KACs may work better as a group activity rather than in isolation as it may help to have more perspectives than just those of one person. Those involved in the process should identify the analytical line to be tested and then list all the assumptions that they believe support that line. Once the list has been created, it should be critically examined to assess how the assumptions affect the analytical line, for example, if the information was false would it undermine your analysis? This process can help identify areas where further research is required in order ensure that the analysis stands up to rigour.

Hypothesis generation

A hypothesis is a tentative statement about the relationship between two or more variables which can be tested to be proven or disproven. Although the quality of data that analysts have access to is not always of a high standard, an analyst should still test their hypotheses by applying high standards in the same way as experimental sciences, for example.

When creating hypotheses, analysts should be aware that they should be proposed in order to be discussed and tested and not seen as the only explanation. It is important to generate multiple hypotheses as this ensures that a wide range of possibilities are considered, not just what seems the easiest explanation as to why something is occurring. There are different techniques which can be used to help with hypothesis generation – a number are detailed below.

Structured brainstorming

Structured brainstorming is a technique which is useful when generating hypotheses. It is most commonly used as a group creativity technique designed to generate a large number of ideas and concepts in order to help better understand or solve a problem or tackle a challenge. This technique should be carried out by analysts and key stakeholders in order to generate explanations in order to explain events.

There are two stages of brainstorming, the first of which is the divergent thought stage which helps generate new ideas. The second is the convergent stage whereby ideas are organised and, where appropriate, removed (discarded). When performing this technique, the question to be answered should be clarified in advance of the session to ensure the effectiveness of the session.

The technique is usually carried out with six to eight participants and takes around an hour to complete, depending on the subject.

Facilitating brainstorms

Structured brainstorming requires a facilitator to ensure that the session runs effectively – they should set the ground rules at the start of the session. Participants should be given a few minutes to think about their ideas and should write down their own ideas. There are a variety of ways of doing this. One of the most common and easiest to facilitate is through use of sticky notes for this technique, with no more than one idea on each note. This part of the process should be done alone and will give the participant time to think about some hypotheses dependent on their ideas. The facilitator should then collect the ideas and read them out loud, where necessary seeking clarification before placing them on a whiteboard or wall where everyone can see them. This part of the session will often generate some new ideas which participants are able to add at this stage. This stage is only for recording the ideas and there should not be any criticism or debate. Only one person should speak at a time and everyone should be given the opportunity to voice their ideas.

Convergent stage

The second stage is the convergent stage, which involves reducing the ideas, resulting in only those ideas remaining which are going to be taken forward. The facilitator should help the group to go through each idea and order them into groups or themes, removing any duplication and irrelevant ideas. Sometimes further ideas will be generated at this stage, which should be included. There is often a large amount of discussion at this stage and the facilitator should ensure that this is focused.

This technique is useful for generating the key drivers for scenario generation techniques, such as the cone of plausibility, and also in scenario evaluation techniques such as backcasting (which will be discussed later).

Making sense of complex data

Information subject to analysis often contains a series of events or describes the relationships between entities such as people, locations and businesses. There are a number of techniques which allow analysts to visually present this information to:

• clarify their own thinking
• assist with formulating hypotheses
• make the information clear to customers

These techniques are analytical, rather than solely data presentation. Decisions will be required in terms of which aspects of an offence are incorporated into the comparative case analysis (CCA) and how potentially linked offences are identified.

Pattern analysis

Pattern analysis (also known as crime pattern analysis) is a technique which allows the analyst to identify:

• emerging and current trends
• linked crimes or incidents
• hotspots of activity
• common characteristics of offenders/offending behaviour

There are many ways in which this type of analysis can be done and often maps, charts, graphs and tables are the best ways of displaying the patterns. Pattern analysis allows the analyst to make predictions as to what they believe is occurring and is likely to occur in the future if the criminality continues without intervention.

Analysts can produce timelines and sequence of events to portray the chronology of events that have taken place. These will usually take into account themes such as people, vehicles, groups, addresses, communications data, CCTV, Automatic Number Plate Recognition (ANPR) and any other types of events that occur which are of relevance to the operation.

Dependent on the time frame and the type of information to be included, this type of analysis may be displayed using software such as i2 Notebooks. For large datasets, Excel would be more appropriate.

Producing a sequence of events allows the analyst to understand the bigger picture of what is going on and who is in contact with who at any point in time. This technique will also allow the analyst to identify patterns in behaviour (such as patterns in telecommunications data, travel) and will help to identify any gaps or discrepancies in accounts.

Comparative case analysis

Comparative case analysis (CCA) allows a number of similar crimes or incidents to be identified as part of a series which are likely to have been committed by one offender or a group of offenders. They will be linked through similarities in:

• modus operandi (MO)
• signature behaviour
• intelligence
• forensic evidence

CCA is usually carried out using a chart or table which allows the analyst to organise data in a format where descriptive details of the crime or incidents are displayed in one place. Details may include people, objects, locations, events, language used, MO and vehicles, which would then allow the analyst to identify any potential linked series. This method allows the analyst to find patterns in the detail of an incident and crime which are distinct enough that it separates them from others which are not likely to be part of the series.

Network analysis

Network analysis is usually managed through creating association charts. These show the links between people, groups, companies, vehicles, communications data and addresses. The aim of this type of analysis is to highlight the nature of the associations and to help with identifying any intelligence gaps, disruption opportunities and intervention points. As new information is received, the charts can easily be updated, allowing the analyst to evaluate the associations on a regular basis.

This technique allows the analyst to provide a detailed picture of the roles played by individuals and can identify the hierarchy within a criminal network, including the roles which each individual plays and any links outside the network being investigated.

Analysts may also develop ‘social network analysis’, employing software applications to support a sophisticated visualisation and assessment of the role, relationship and influence of individuals within a network, for example.

Hypothesis testing

Once a hypothesis has been generated, it is important that it is tested to establish whether or not valid interpretations have been made. In order to test the hypothesis, the question being answered needs to be closed and in the present (not future focused). While testing hypotheses, it is important to keep conducting KACs. Techniques such as the analysis of competing hypotheses (ACH) may be useful.

Analysis of competing hypotheses

The ACH is a technique used to test hypotheses already generated. ACH involves identifying a list of potentially relevant pieces of information, then assessing their consistency with the hypotheses which have already been written. This ensures that all pieces of evidence are considered and allows the analyst to overcome common analytical pitfalls such as cognitive biases and limitations that they may have.

This technique provides an audit trail of what the analyst has considered and how they have arrived at their conclusions and recommendations. If ACH is applied in the early stages of hypotheses testing, it can be done fairly quickly by one analyst, however, it can be more effective when done in a group of analysts (with a maximum of eight analysts). Where ACH is applied to a long-standing problem, it can be very labour intensive. It can be revisited at any stage of the analysis when new evidence or information is received.

ACH allows the analyst to generate alternative explanations, ensuring that all the information and arguments are considered and evaluated and information which may affect an investigation is not missed. This technique ensures that all reasonable alternatives are identified and have competed against each other, rather than being looked at in isolation.

In order to carry out ACH the analyst(s) would need to create a matrix and write the hypotheses along the top, one per column. Down the vertical axis, the analysts should list all relevant evidence being used to evaluate the hypotheses. The evidence could include known facts, assumptions, arguments and the absence of things that would be expected if the hypothesis were to be true.

The analyst then should work their way down the list of evidence and assess it against the hypotheses. For each hypothesis, ask the following question: ‘If this hypothesis were true, how likely would this evidence be?’ They will then assign a score to each piece of information and, at the end, add up the score for each of the hypotheses.

Where evidence and arguments are consistent with all the hypotheses, they should be deleted as they add no value. When the analysts have narrowed their hypotheses down, they should consider how strong their lead hypothesis is and whether or not the judgement would stand if the evidence was incorrect. They should then use their conclusions to improve their analytical assessment and determine what information needs further development. See Quick Wins for Busy Analysts for more information (available via the Knowledge Hub Criminal Intelligence Analysis Community, which is an OFFICIAL online tool with access limited to registered PNN and GSi users).

Where ACH is to be done in large groups, the group should include managers and analysts to identify the hypotheses using structured brainstorming. Small groups of analysts should then load the data onto the ACH matrix before the larger group reconvenes to compare and contrast the matrices in order to explore which data emerges as the most discriminating. This process will identify key findings as part of the analysis.

Generating and evaluating scenarios

Scenario generation techniques are used when considering how a situation or subject area might look after a given length of time. Using structured techniques to generate scenarios helps the analyst figure out what are plausible scenarios for the future which can be justified by a clearly laid out line of reasoning.

Scenario generation assists in supporting contingency planning and allows decision makers to know that the predictions made by the analyst are plausible, even those that may be unlikely to occur. These techniques allow decision makers to have a range of plans in place should a situation change or develop.

When using scenario generation techniques, the analyst will identify a number of indicators which can act as early warning signs. This means that their customer is able to make policy decisions on what action to take if any of these indicators were to occur, which could then prevent an event from taking place. This can help the analyst move into the estimative stage of analysis, allowing their customers to be aware of what may happen next. It is important to note that the complexity of some situations means that it is difficult to identify what angle of the threat the analyst should focus on. Analysts cannot consider every eventuality which might occur in the future.

There are four techniques to be considered:

• quadrant crunching
• force field analysis
• cone of plausibility
• red teaming

Quadrant crunching

Quadrant crunching is a useful technique which allows the analyst to consider a broad set of alternatives when they are provided with limited data with a high level of uncertainty. It allows analysts and decision makers to identify their priorities and what factors may have an impact on ambiguous threats.

To carry out this technique successfully, there needs to be a well-established hypothesis which can then be broken down into sections which focus on the 5WH. The analyst should use a matrix to generate examples of how they think factors may affect one another.

An example is that of where a prolific protestor is due to be released from prison just prior to an event taking place. If they are released and other protestors are willing to travel, then a protest may occur, however, if they are kept in prison and other protestors are not willing to travel, it is less likely that a protest will occur. See example below for structure.

Quadrant crunching diagram

 

Force field analysis

Force field analysis is structured technique which allows analysts to examine the key drivers that are acting on an issue, organisation or individual. This technique was developed by Kurt Lewin (a social psychologist) who said that an issue, organisation or individual is held in a dynamic balance or imbalance by a combination of forces which compete to drive the issue, organisation or individual in a variety of directions.

This technique should be used to focus on what is driving the activity that is taking place and should not be used as a way of identifying pros and cons for dealing with the activity. Force field analysis enables the analyst to work to a structured, auditable framework which then allows them to identify the strength of the drivers that are being examined to see what changes potential movements are likely to bring about.

It allows the analyst to identify and understand the current balance of the forces acting on a particular basis and how they might change over time, meaning that the potential future development of these changes can be examined. It is particularly useful in identifying potential opportunities to change the development such as through intervention (including changes in policies) and can help the analyst gain an insight into how the drivers stabilise or destabilise an issue.

This technique should be used at the beginning of the analysis in order to identify the key drivers which will provide greater understanding of the issue being considered. As a situation develops over time, it can also be revisited to gain an insight as to how the strengths of key drivers change or how new drivers that have appeared affect potential future developments.

Once key drivers have been identified, they should be assigned a score between 1 and 5 (1 being the weakest intensity and 5 the strongest). Each driver should be considered individually, which can result in several drivers having the same score. This process will identify the drivers which have the most impact and can inform the analysis as to where the biggest impact would be if certain drivers were removed.

Cone of plausibility

The cone of plausibility is a scenario generation technique which is used to generate a range of plausible scenarios which describe how a particular subject area may look after a given timeframe. Generating key drivers relating to a subject area can provide some insight into what factors are most important in shaping future events. This technique can be carried out in groups and by an analyst on their own. See Quick Wins for Busy Analysts for more information (available via the Knowledge Hub Criminal Intelligence Analysis Community, which is an OFFICIAL online tool with access limited to registered PNN and GSi users).

Once this technique has been completed by the analyst, it provides a useful framework for structuring and producing a product quickly and enables the analyst to present the results effectively.

Red teaming

Red teaming is a technique whereby the analyst puts themselves in the shoes of another person or group in order to understand the potential threat that they may pose. The technique involves modelling the behaviour of an individual or group by trying to replicate their behaviour, viewpoints and intentions using critical thinking skills. It is essential that those involved have a good understanding of the subject being considered, otherwise it will be difficult to carry out.

When carrying out red teaming, those involved need to develop first-person questions such as the following.

• If I was the subject, how would I react to this?
• What concerns would I have?
• How would I mitigate these concerns?

This allows the analyst to develop a broader understanding of the subject without introducing their own biases into analysis and can lead to them identifying new vulnerabilities which had not previously been considered. This technique can help to reduce the threat posed by the subject or group and can help to fill some of the intelligence gaps that may be present.

Scenario evaluation

Scenario evaluation techniques help to raise awareness of the indicators for a high-impact event occurring, even where it is very unlikely. Scenario evaluation techniques help to identify intelligence gaps and some of the limitations of using intelligence for particular problems. The main structured scenario evaluation technique to consider is backcasting.

Backcasting

Backcasting is a technique which is most appropriately used for closed, future-focused questions. It can be used where there are early indicators that something is going to happen in order to put measures in place which will reduce the threat. Backcasting allows the analyst to consider specific scenarios in order to identify any warning indicators and key points. In some situations, the analyst will have an idea of what may lead to particular scenarios occurring, however, it will help identify any warning indicators which the analyst may miss, intelligence gaps and early intervention points which could prevent an event from occurring. This technique can be done in groups or alone.

The analyst needs to consider:

• specific outcomes and timeframes for the event to occur
• key assumptions (what is essential for the event to occur)
• plot a timeline (using key assumptions) showing plausible events and trends which would lead to the outcome

This technique should allow the analyst to provide their customer with the precursor events which will lead to something to occur.

For more details, see Quick Wins for Busy Analysts for more information(available via the Knowledge Hub Criminal Intelligence Analysis Community, which is an OFFICIAL online tool with access limited to registered PNN and GSi users).

Other techniques

SWOT analysis

SWOT analysis provides a framework for analysing the strengths, weaknesses, opportunities and threats related to the problem being considered. Strengths and weaknesses are internal to the organisation and opportunities and threats are generated by the external environment.

When conducting SWOT analysis, the analyst needs to be aware of what the objective of the analysis is and then generate the analysis around that. This technique provides an understanding of available strengths and opportunities which can then be built on in order to develop recommendations for tackling the issue at hand. In addition to this, they identify threats and weaknesses which should be examined when making a decision about how to approach the issue.

SWOT analysis can be applied to a range of different situations and can be used throughout analysis, including at the recommendations stage. This technique can be carried out by an analyst on their own or as part of a group.

Once each area has been identified, options can then be considered. Analysts can identify strengths to be exploited or ways to improve on weaknesses that have been found.

Crime script analysis

Crime scripting is a type of analysis that breaks down information into logical steps in an organised sequence. When committing a crime, there are often four stages that the criminal will go through in order to carry out the offence.

• Preparation – the offender identifies the opportunity in which they can commit their crime.
• Pre-activity – the logistical or transactional precursors that may need to occur (for example, reconnaissance at the location to be targeted).
• Activity – how they are actually going to commit the offence.
• Post-activity – the logistical or transactional steps required in order to leave the scene (for example, having a getaway driver waiting, engine running).

Script analysis allows the analyst to build a profile of criminal activity in order to identify answer questions around the 5WH. It is useful when data is limited, as it helps provide a greater understanding of the problem and can help identify opportunities for preventing and detecting crimes.

Crime script analysis follows a process similar to an analytic technique formerly defined as the ‘criminal business profile’ or ‘criminal business analysis’. This actually forms more of an intelligence product, where the specific aim is to determine how a criminal group or enterprise operates.

Crime scripting would allow a criminal group to be envisaged in a manner similar to a business, with the analyst determining how they source their commodity, how they process it, how they distribute it and how they disseminate the profits, for example.

For further information, see Crime Analysis for Problem solvers in 60 small steps.

Team A/team B

This technique is used where there is no clear answer to a problem but action needs to be taken one way or another.

Analysts will work as part of a team to research one view point or another and then argue their case for it. The decision maker is then able to make a decision on what action to take, based on the best available assessment at that time.