Building Knowledge among Intelligence Analysts (Intel Shop in a Box — Part 2)

In part one of this series I discussed a new way to select and hire intelligence analysts in a way to maximize the chances you’ll get good raw material from which to build your intelligence shop. Now, hopefully, there are a set of eager faces staring at you and chomping at the bit to dive into your mission.

Ok, hopefully not THIS eager.

The question you now have to face is how to proceed.

Analysts are often organized in one of two ways:

Specialization: Give analysts (either individually or in groups) a fixed portfolio with clear parameters. This has the advantage of allowing them to develop a deep understanding of a specific topic and build subject matter expertise in the quickest, most efficient way possible. In the terrorism field this might mean an analyst is assigned to the al-Qaeda portfolio or the Europe desk. If you’re working crime it might be narcotics or a particular geographic area.

This method has two key disadvantages:

  • Prioritizing individual knowledge over institutional knowledge. If your key analyst is away on vacation and things go pear shaped you’re going to struggle to replicate that expertise.
  • Information gets ‘stovepiped’. And yes, I do apologize for using that cliche but bear with me. As your analyst(s) dive deep into a particular subject it becomes very easy for them to restrict their vision to only their subject and not see how it impacts other portfolios and programs.

If you have enough people you can build working groups, liaisons, etc., but many shops don’t have that kind of population to work with.

Generalization: Alternately, you could not assign analysts any portfolio and, instead, just assign specific products when they come up. This addresses the two disadvantages of the specialization path by building institutional knowledge (Analyst A will get an al-Qaeda case today and Analyst B will get the next one so if one person is out of commission someone else will have familiarity with the topic) and eliminating the need/ability of analysts to focus on any one thing to the exclusion of other topics.

But, of course, this has problems too.

  • Give up on subject matter expertise. Developing familiarity with a topic is pretty easy with this system. Developing expertise is almost impossible. This system is just too inefficient and nobody gets to work on a topic enough to build up enough knowledge to do any deep analysis.
  • It’s hard to give a damn. If analysts are tasked with wildfires today, Hizbollah leadership changes tomorrow and gun deaths next week it’s hard to get invested in any of these topics. Being given responsibility for a topic fosters a sense of ownership. They care.

So, how should you handle this Solomon-worthy question? Just like he did…cut that darned baby down the middle (Wait…that’s not what happened. eds.)

I suggest that a hybrid approach is the best way to proceed by minimizing the shortfalls of each method while retaining the capabilities of both. Here’s what that would look like:

Analysts need portfolios. There’s no way around that. You need to give your folks something they can call their own and for which you will hold them responsible.

Those portfolios should overlap. Here’s where you get into some synthesis. Structure portfolios in such a way that analysts will have mutual, overlapping interests that are essential for both to be experts in their individual portfolios.

For example: Let’s assign one analyst as the al-Qaeda Core expert and one as the al-Qaeda in the Arabian Peninsula expert. Both have clearly defined groups that they’ll be expected to develop expertise in. BUT, in order to develop that expertise, they’ll have to be familiar with the other account. This also means analysts will really be forced to interact with each other (Tear down that silo!) in order to achieve competence in their portfolio.

In my experience, analysts have a disproportionate number of introverts who really would prefer to minimize human interaction. This helps minimize that tendency (of which I am among the most guilty).

Those portfolios should be diversified. Analysts should be assigned portfolio subjects which are substantially different from each other. Our al-Qaeda analyst? Let’s also give her white supremacists. If you have a crime shop, give them narcotics and a white collar crime.

This suggestion gets the most questions and confused looks when I make it.

Those shops that go in for specialization that I mentioned early on often think that the way to go is to keep analyst portfolios internally consistent (al-Qaeda and their affiliates, domestic terrorism groups, etc.,) in order to build their subject matter expertise as quickly as possible. We, however, have done that through assigning analysts overlapping portfolios (see above) so we don’t need to do it again.

While al-Qaeda and the KKK may seem very different, remember, they’re both organizations. While their ideologies may have nothing in common they both have to recruit, communicate, organize build structure, etc. This allows analysts to compare organizations and apply models and lessons learned from one to the other. Additionally, it allows the analyst to develop a broader social network (they can now engage with the al-Qaeda experts and the white supremacist experts).


Now your analysts have portfolios that navigate the troubled waters between being too specialized and too generalist. You’ve diversified the knowledge tasks so that you don’t have a single point of failure in the event your key analyst is out on vacation AND you’re building subject matter expertise among individual analysts. You’re still not done yet.

First, working this system requires active leadership. Leaders need to push analysts to spend time in those areas where their portfolios overlap with each other. Al-Qaeda making a leadership change? That fits squarely within the portfolio of the al-Qaeda analyst. But why not also task the ISIS analyst to write or brief (or just have a chat with you) about the implications for her portfolio. How about the AQAP analyst? Before you know it you’re pretty close to having a 360 degree view and you’re training your analysts to consider context and consequence.

Secondly, you still haven’t beaten the problem of institutional knowledge. What your analysts know is still stuck between their ears and while more of that knowledge is spread out between more sets of ears, every time there’s a retirement, parental leave or job change your organization’s knowledge will take a dip until a new person can get develop their own expertise .

We want to minimize the time it takes for a new analyst to become that subject matter expert and that means we have to take that knowledge hiding in the heads of analysts and make it accessible to others.

Here I’d recommend the use of wiki technology. This certainly isn’t new but within an intelligence shop it can be an extremely powerful tool. The software is free and easy to use. For each portfolio item, task the analyst to create and update a wiki page for internal use only. That can be hardwired into their job expectations and, if they keep up with it, will be the place from which they will draw information when writing their products and developing their briefings.

Rather than a free wheeling wiki like wikipedia, I suggest coming up with a template that would contain the minimum information you think you want to capture institutionally. Analysts can always add more but figure out what is essential to keep up to date. For example, if you were looking at a terrorist group you might have:

  • Group names
  • History
  • Ideology
  • Leadership
  • Tactics and Targets
  • Financing
  • Propaganda
  • Relationships with other actors (friends and enemies)
  • Future analysis

This also allows analysts to link to each others work (another opportunity to emphasize the importance of overlapping portfolios).

One final word on wikis: If you’re looking at criminal or terrorism issues (and you’re a government agency) you’ll need to make sure you abide fully by 28 CFR Part 23. The best way to do that is NOT to use the wiki as any sort of intelligence database to store the particulars of suspects or ongoing investigations.


How intelligence shops should break down their mission into digestible chunks for analysts to handle is one of the most overlooked aspects of managing such organizations. The world can seem just too fast paced — with new threats, technologies and deadlines — to ‘waste’ time on a question so basic. A bit of thought on this question can lead to real improvements in institutional knowledge, analyst skill and collaboration within your shop.

One clap, two clap, three clap, forty?

By clapping more or less, you can signal to us which stories really stand out.