How Information Becomes Actionable Intelligence – Part 1

If you are new to the Intelligence Community—or have not worked as an investigative journalist in the past, for example—it is unlikely you would already have a solid framework for consuming information with the explicit aim of producing actionable insight or intelligence. This article—part of a series—is intended to help newcomers understand the basics for developing such a framework, whilst allowing for adaptation to the demands and realities of one's particular environment or situation.

There is also a considerable body of technical and academic literature available on this topic for more seasoned professionals. However, if you are only just beginning, the following may offer a useful entry point, before delving deeper into the more intricate—and at times overwhelming—architecture of intelligence work.

As outlined in a previous piece, the notion of absolute truth—attainable with 100% certainty—is ultimately out of reach. This is not a philosophical position, but a recognition of the practical limits inherent to the human being’s ability to understand outside events and the universe in general. Nevertheless, we do still have the capacity to navigate with enough clarity that our actions become informed, timely, and advantageously positioned for many situations in life, if we decide to do so.

Information, Metadata and Context

Raw information is by itself inherently useless. Imagine the following piece of information: “There will be a flood tomorrow.” Although we may naturally take this as potentially useful, in reality, it is not. For example: where does this claim come from, and what are the credentials of the person or organisation issuing the warning? Where will the flooding occur, and to what extent? When will it begin, and how long will it last?

As you can see, a significant amount of metadata is required to render even a simple claim actionable. Metadata is not the same as context, however. Whilst metadata adds supplementary information to the original piece—such as origin, authority, timing, and reliability—context refers to the broader environment in which the information must be interpreted.

For instance, knowing whether the alert was issued by a national official or a local fisherman adds metadata. In contrast, knowing that the warning came after several days of heavy rainfall, or following another natural disaster, situates the message within a meaningful context.

Importance of Evidence

The mere existence of a piece of information is never good enough to make it usable in the context of intelligence analysis. Of course, it must be collected and seen as a potential piece of the puzzle, but without supporting evidence, it will be as useful as a nameless, unlabelled, unfamiliar container of medicine.

Understanding what counts as evidence, and to what extent it should be trusted, mostly relies on our understanding of what we are dealing with—in other words, whether we are a subject matter expert or not—but, as a general rule of thumb, we want no fewer than three pieces of reliable evidence, either supporting or contradicting each bit of information.

Why three? Well, as is often said in safety-critical or security-critical environments, two is one and one is none. This means a single piece of evidence is a weak standing point, as it suggests the argument is not being strongly supported or contested. Two pieces of evidence are certainly more helpful, but what if they disagree on the truthfulness of the information in question? We may find one piece of evidence stronger than the other, but ideally we want at least three pieces of evidence to understand why, and to what extent, we should trust a particular piece of information.

It is also important to collect as many pieces of evidence as possible, based on the role of the information and its effect on the overall case. For example, if the web browsing history of a suspect shows that the suspect has visited a certain website—based on the data gathered from the suspect’s computer and web browser—we may want to gather more evidence, depending on the implications of visiting that particular website for the suspect.

We may, for instance, want to ensure that the web browsing history on the computer has not been tampered with in any form or manner. If possible, we may also want to see whether the log files on the web server could support the evidence gathered from the suspect’s computer. We would then need to assess the likelihood of those log files being tampered with as well.

We could also examine the various Internet service providers that sit between the suspect’s computer and the web server where the website was hosted. But none of that is of much use if we cannot actually prove that it was indeed the suspect who visited the website. So, was the suspect seen using the computer at that exact time? Are there, for example, CCTV footage or eyewitness records that could be collected and verified as untampered or truthful accounts? Was the computer secured by a passcode that only the suspect was aware of—or is there any other clue that could help us get closer to the factual events?

When it comes to collecting evidence, knowing when to dig deeper or to focus attention elsewhere is both an art and a matter of expertise. That is why it is important to be aware of our own limitations and to seek help from experts whenever in doubt.

Forming Hypotheses

At the core of all this is a simple idea that often gets missed: we are not looking for a single conclusion or even a neatly curated set of them. What we are doing is forming hypotheses—plural, and often competing. In practice, that means holding multiple possibilities in our mind at once, allowing them to challenge one another, shift position, or fall apart completely as new evidence is introduced. This isn’t an abstract concept. It is the actual shape of how real analysis works.

To do this properly, we also need to consider the entirety of each piece of information that comes our way. Not just the part that seems to matter, or the headline claim. Take an article, for example—it might appear to be driving home one key point, but in reality, it could be slipping in three or four smaller, less obvious points alongside it. All of it must be dealt with. Selective processing—whether conscious or subconscious—is one of the fastest ways to fall into inaccuracy or bias. Of course, some balance is needed. We cannot follow every thread endlessly. But as a general rule, we should not treat certain details as beneath our attention. Precision is not just about what we notice, but what we refuse to ignore.

In the next part, we will develop a framework—step by step—for consuming information for the purpose of producing truthful reports and conclusions—or at least, as close as we can reasonably get to the truth.