Looking For An Intelligence Job On Twitter? Two Handles To Follow...And One To Avoid!

My undergraduate research assistant, McKenzie Rowland, and I have been updating the series of posts I wrote a few years ago on how to get a job in intelligence and, well, let's just say that a lot of things have changed since 2009...

Like Twitter.

Twitter is used extensively by defense contractors and others looking to fill cleared positions supporting the US national security intelligence community.  

Now, several of the agencies have twitter handles dedicated solely to announcing jobs and job-related news regarding that agency.  For example NSA has @NSACareers and the Department of State has @doscareers.

A number of other agencies have Twitter handles but not specifically for job information (or if they did, they were so successfully hid that we couldn't find them).  For example, the DIA has @defenseintel, while NGA has @NGA_GEOINT and DEA has @deanews.

There were even a few scammy looking ones such as @FBIAgentCareers and @USCGCIVCareers.  The site purporting to be FBI related hadn't posted in about a year and linked to a non-governmental website.  While the FBI site should be avoided, the purported Coast Guard handle was vastly more useful, containing recent links to actual jobs.  However, this site also linked to a .com rather than a .gov or .mil address.  Use at your own risk...

Note:  The US government maintains a website where you can check the authenticity of any social media site.  This resource is called, in a moment of stark governmental clarity, "Verify U.S. Federal Government Social Media Accounts" and is available through USA.gov.  Neither the FBI nor the Coast Guard social media sites discussed above showed up in this database.

Want To Work For CIA? NSA? DIA? Don't Use USAJobs! (+ What To Do Instead!)

(My undergrad research assistant, McKenzie Rowland, and I are in the process of updating a series of posts I did back in 2009 called "How To Get A Job In Intelligence".  As part of her research, she took a detailed look at the career websites of all of the US national security intelligence organizations.  Her very useful analysis and comments are below.)

By:
McKenzie Rowland

When searching for a job in intelligence, one of the first places many people look is USAJobs.gov.  This site lists many postings for a number of agencies and features an advanced job search tool that allows you to filter and refine results.

While USAJobs makes the search process much more straightforward, it should not be the be-all and end-all for job hunting within intelligence agencies.  There are plenty of other alternative search engines and sites to consider, such as agency websites, when searching for intelligence-related careers, many of which yield more favorable results.

The matrix below displays yesterday's search results for the word “analyst” on both the websites of members of the Intelligence Community and the USAJobs section for that intelligence organization (Note: These search results are not indicative of the complete availability of jobs for either the organizations listed or for USAJobs. Furthermore, results may change over time.).

Category 1 Sites

For the following intelligence organizations, it is most beneficial to visit their respective website as opposed to USAJobs.  Note: some positions on these sites may overlap with ones already listed on USAJobs.

Defense Intelligence Agency (DIA): While the DIA’s general job postings do overlap to an extent with USAJobs, the DIA Jobs site lists several positions that USAJobs does not.  DIA’s job site also gives very detailed information for each individual posting, such as the “job family,” which allows you to quickly sort through positions relevant to you.

National Geospatial-Intelligence Agency (NGA): For the NGA, it is more advantageous to search for open positions on their website.  Similar to the DIA, many of the jobs listed here are not available on USAJobs, so it is important to visit NGA’s career page to avoid missing out on potentially relevant job postings.

National Security Agency (NSA): For the NSA, you are almost certainly better off searching for jobs through this agency’s job site, as USAJobs does not list any positions for this agency.

Category 2 Sites

For the following agencies and departments, there is some benefit to visiting their respective websites for career information, but USAJobs provides the most in terms of actual search results.  For some of these, searches can only be conducted through USAJobs, or the websites will include that organization’s section within USAJobs.

Office of the Director of National Intelligence (ODNI): The ODNI lists job vacancies directly on their page, but applicants are redirected to USAJobs for the majority of available positions.  (Investigative Analysis is an exception here, as you can only apply for this job through ODNI’s recruitment office.)  USAJobs does, however, list a couple of analyst positions that the ODNI’s job site does not.

Department of Energy (DOE), Office of Intelligence and Counterintelligence: When you search and apply for a job on DOE’s site, you’re almost immediately redirected to USAJobs.  While the DOE has a job searching page with detailed descriptions of each position, I’ve found that you are actually better off searching USAJobs for open positions.  Upon searching for “analyst” on DOE’s site, I discovered that many of the analyst jobs were already filled, and that USAJobs seems to filter these available positions better than DOE. For more information on the Office of Intelligence and Counterintelligence, you can visit their website here.

Department of Homeland Security (DHS), Intelligence and Analysis: When searching within the DHS main site for jobs, it redirects you to their section on the USAJobs site, dhs.usajobs.gov. You do, however, have the ability to narrow down your search by skill, component, or location on DHS’ site before you are redirected to USAJobs.  For more information on the Office of Intelligence and Analysis, you can visit their website here.

Department of State (DOS), Intelligence and Research: While the DOS career page offers information about positions such as foreign and civil service officers, all actual job searches must be conducted through USAJobs.  For more information on the Bureau of Intelligence and Research, you can visit their website here.

Department of Treasury (DOT), Office of Intelligence and Analysis: For the DOT, all job searches are redirected to the USAJobs section for DOT, treasury.usajobs.gov. The site does, however, give links to the career pages of the 10 bureaus and services under the DOT.  For more information on the Office of Intelligence and Analysis, you can visit their website here.

Drug Enforcement Agency (DEA): For the DEA, all job searches and applications must be conducted through USAJobs at dea.usajobs.gov. If you’re having any trouble setting up your USAJobs account or have questions regarding careers with the DEA, this career page includes ample support and information on the application process.

Federal Bureau of Investigation (FBI):  The FBI website is useful if you’d like to learn more about careers within the FBI before you apply, and also contains a link to a page specifically for interns and college students. When applying for a job on their page, however, FBI Jobs redirects you the Bureau’s USAJobs section, fbi.usajobs.gov, which solely displays results for postings from the FBI. This is particularly convenient for when you actually want to search for a specific position within the FBI instead of just finding information about it, as FBI.gov does not have a search engine tool of its own.

U.S. Air Force (USAF), Intelligence, Surveillance, and Reconnaissance: Currently, there are no actual applications available on the Air Force’s site, but their career page does provide useful information on different jobs and duties within the Air Force. In this case, it is most beneficial to search USAJobs for openings. For more information on Air Force Intelligence, Surveillance, and Reconnaissance, you can visit their website here.

U.S. Army, Army Military Intelligence: The Army’s Career Management page is designed for both enlisted and civilian individuals searching for a job in the Army. Civilian career opportunities are posted on USAJobs, which you can search for using armycivilianservice.usajobs.gov. For more information on Army Military Intelligence, you can visit their website here.

U.S. Coast Guard (USCG), Coast Guard Intelligence: For reserve and enlisted careers within the Coast Guard, you can search within the site for recruiters and available positions near you.  When applying for civilian careers, however, the site redirects you to a page on USAJobs of results for the Coast Guard. But before applying for actual positions, you may want to take a look at the Coast Guard’s career page that gives descriptions of all job types. For more information on Coast Guard Intelligence, you can visit their website here.

U.S. Marine Corps (USMC), Marine Corps Intelligence Activity: Similar to the Army’s career page, civilian positions are not listed directly on the Marine Corps’ site, and USAJobs provides the most filtered search results for specific openings. For more information on the Marine Corps Intelligence Activity, you can visit their website here.

U.S. Navy, Naval Intelligence: While no job searching tool exists on the Navy’s career page and searches are conducted solely through USAJobs, the Navy’s career page provides very detailed information on the many different disciplines and career paths you can choose.  For information on the Office of Naval Intelligence, you can visit their website here.

Category 3 Sites

These intelligence organizations are neither listed on USAJobs, nor do they return actual job search results.  The only way one can apply to these agencies is through their agency website or through another agency.

Central Intelligence Agency (CIA): The CIA’s career site doesn’t list specific job postings and does not have any positions posted on USAJobs.  To apply for a job, you must fill out an online application through their site once you’ve found the type of job you’re interested in. You then create an account, add that job to your “job cart” (limit 4 jobs, and your account terminates within 3 days, so act fast!) and begin the application process. If you don’t really know what you’re looking for, though, the  Job Fit Tool matches you with potential career paths based on a series of questions and can provide a good starting point for searching.

National Reconnaissance Office (NRO): The NRO is an exception to the other job search tools within agency sites.  Due to the nature of this organization, the careers page only contains links to the career pages of the agencies that collectively make up the NRO; their website suggests that you take a look at those websites instead.

Last Bit Of Advice...

When first looking for a career in intelligence, it is best to begin your search on the websites of members of the Intelligence Community. These websites oftentimes provide valuable career information and allow you to broaden your search within a specific search term. However, if you’re searching for a specific discipline not within one particular agency or department, such as "domestic counterterrorism", USAJobs will retrieve such positions.

All in all, USAJobs can be highly useful for many intelligence job searches, but it shouldn’t always be used as the primary job search engine--explore your other options!  

The Best Job In Intelligence (That You’ve Probably Never Heard Of)

“Here’s the deal…”

“I’m all ears.”

“On any given day you are as likely to be working on a terrorism case as you are on a drug smuggling ring.  Everything from chop shops in major cities to gangs that traffic prostitutes across the border are all going to come across your desk.”

“Really?”

“Really.  The work is fast and furious, though, and the emphasis is on bottom line up front, clarity and concision.”

“All the things they taught us...’

“Exactly.  That’s why we are so good at this job.  The specialty stuff you need to know you can learn on the job – it’s the basic skill set that they need.”

“What about the pay?”

“Good to great.  The lowest number I heard was in the 40’s and that doesn’t include health benefits and 401K stuff.  The highest number I heard…well, let’s just say, it’s real good.  I even heard from one guy who gets all Federal holidays and four weeks of paid vacay a year…”

“Holy…”

“Yeah.  Best part is you can work in any major city.  You don’t have to be stuck in DC.”

“You’re kidding!”

“Nope.  One more thing…”

“What?”

“You don’t need a clearance.”

“Damn.  What’s this job called again?”

“Well, every organization seems to have their own name for it but most places I have seen call it a ‘Compliance analyst’.”

*************

https://flic.kr/p/9VDebQ

Compliance Analyst, Know your Customer (KYC) Analyst, Anti-Money Laundering (AML) analyst – all of these are titles that banks give to analysts they hire to stay in compliance with US federal laws such as the Banking Secrecy Act and the US PATRIOT Act.

Banks have a responsibility under these laws to take a hard look at any transactions that are “suspicious” and all transactions over $10,000 or pay hefty fines.  This means that every bank has to have at least some of these positions on its payroll and that these positions can be found wherever the banks are.

After the transaction is analyzed, if it appears to be illegal, it and all of the evidence supporting the assessment has to be reported to the appropriate local, state or federal agencies.  Oftentimes these are law enforcement agencies but occasionally, as in the case of terrorist financing activities, intelligence agencies (US and international) get involved.

The job is, according to the working compliance analysts I spoke with to compile this post, less about the numbers and more about “whether applicants can think in an independent / logical / creative way” and about “pattern recognition skills, bottom-line-up-front writing, and the ability to gauge the reliability and value of various sources.”  The estimates these analysts make on a day to day basis can help law enforcement, intelligence agencies and the military stop crime, break up gangs and counter terrorism.

A quick look on Glassdoor.com under "compliance analyst" and it becomes obvious that starting salaries are quite good with regional banks averaging in the 40’s and multinational banks averaging in the 60’s for qualified entry-level analysts.

To get a better handle on the job and what it entailed, I reached out to a number of Mercyhurst alums working in the compliance arena to get some answers to my questions.  Here, in a lightly edited format is what they said:

Note:  Mercyhurst’s applied focus on intelligence studies coupled with its emphasis on not only national security but also law enforcement intelligence and intelligence in business seems to create a near perfect candidate for these kinds of jobs.  Certainly, many of our alumni have gravitated to these positions over the years and have typically done very well in them (I have heard from several “Vice-presidents for Anti-money Laundering” from various regional and multinational banks in the course of putting this post together…).   

Readers coming from academic programs that focus only on national security or analysts transitioning from the government to the private sector will likely find the answers below to be relevant but you might also find that these answers highlight gaps you might need to fill in order to compete successfully for these jobs.

Q:  Why do Mercyhurst intel studies grads make such good AML analysts? 

From a Vice President-AML Compliance at a large multinational bank:  Good entry level AML Analysts need to have three skills: critical thinking, writing, and data analysis. The Mercyhurst grads we hire walk in the door with very well developed critical thinking and writing skills. Data crunching/analysis (at least how it relates to AML) is the easiest of those three skills to develop on the job. 

The type of analytic product AML analysts usually produce is called a Suspicious Activity Report. It’s a short summary of suspicious transactional activity - usually 1 -2 pages in length. Being able to identify suspicious patterns and clearly write about them in concise manner is not easy. Mercyhurst grads are primed to produce that type of product and they do it extremely well. 

From a KYC Analyst at a large multinational bank:  In my position as a KYC Analyst, I'm constantly synthesizing information from a variety of sources (including our internal databases, transactional analysis done by another analyst, client responses from a questionnaire, previous reviews of the clients, and external research online). I think that Mercyhurst's program produces effective KYC/AML analysts because it arms its students with pattern recognition skills, bottom-line-up-front writing skills, and the ability to gauge the reliability and value of various sources. Instead of accepting everything we find at face value, we dig deeper to find the underlying trends in play. We've learned how to write without bells and whistles to distract from the topic at hand. While some folks might be content with a single source, we seek out corroborating information. The goal of my job is to perform due diligence in order to establish a money laundering risk level for the clients. This involves a risk-based approach that in my opinion plays well into Mercyhurst's emphasis on Words of Estimative Probability and confidence levels.

From a Senior Associate in AML/Due Diligence at a large commercial bank:  From my experience, most AML jobs typically involve the core basic skills currently being taught at the Intelligence Studies program, research, analysis and dissemination…I have been working in customer due diligence/KYC for close to eight years. Resourcefulness is key for these types of jobs. Those that are successful know how to quickly obtain customer information via open-sources or subscription databases. I say "quickly" because the workload is typically fast-paced and high-volume. 

From an AML Compliance Officer/Analyst with a large multinational bank:   As I was told upon hiring, "We can always teach you the banking terms, procedures, typologies, and show you the programs, but we can't teach you to think, understand, and analyze the data you see." …Being able to "see" trends and patterns through analysis is crucial for my role. 

To expand upon that, our operational knowledge of Microsoft Excel (and mine with Access and other database design programs) was an extreme advantage. Open source analysis is also fundamental. Optimizing Google searches to identify entities or using Lexis Nexis is crucial for transactional understanding. Furthermore, we are able to evaluate reputable sites from those that are not. Our teachings in understanding risks around the globe and generally keeping up with the news and events of today are useful… (as is being able to) follow the money or the "story" and verifying it makes business sense…A notable advantage is I2 Analyst’s Notebook, which helps to portray the relationships of entities. In a way, when I investigate transactions, I too am looking for the linkage between the parties. Lastly, being able to see (and understand) suspicious or unusual patterns. 

From an AML investigator with a large multinational bank:  It is my feeling that Mercyhurst intel grads make good AML analysts because we have been taught to identify the gaps during an investigation… In addition to being able to successfully identify the blind spots in an investigation, I feel that a strong organizational background and concision helps Intel grads be so successful. 

From a Compliance Analyst at a regional bank:  In a nutshell, Mercyhurst students make excellent AML analysts because we have been taught how to conduct our investigations in an orderly manner. We have been taught how to properly and thoroughly collect information, what information matters, and how to put the puzzle together. We have been taught how to prioritize items. We have been taught how to work under intense pressure and get the mission done. But most importantly, we have been taught how to work as a team…

Q:  What advice would you give a student interested in a career in AML?

From a KYC Analyst at a large multinational bank:  This will probably sound obvious, but it will behoove you to learn about how financial institutions operate and, if you go into business banking like I did, to learn about various business models. This knowledge isn't necessary right off the bat, but having background knowledge in the nuts and bolts of it all can only be a boon…At an interview, a Mercyhurst student might consider speaking highly of the program's ability to turn out strong analytic writers with solid research skills.

From a Compliance Analyst at a regional bank:  I would say to pay attention in the writing class and strategic, because of all the classes those two have helped me deal with the pressure and prioritizing of items. In terms of looking for jobs, AML is a growing field, and all our students will have to do is go into an interview knowing a little bit about AML and the BSA. Our program will speak for itself during the interview process. 

From an AML Compliance officer/Analyst with a large multinational bank:  For recent grads, if they are interested in this field, my best advice is to send as many resumes to as many different banks as possible…A lot of times, if you apply to a position and the person reviewing doesn't think you will fit there, they can refer you to a more appropriate job vacancy. So apply to everything! It is unlikely a hiring manager that knows what they are doing will dismiss your education. Focus on the worldly projects and internships analyzing large data-sets. 

Also, use your social networking to reach out to established grads. I had a couple different people reach out to me in the past and I'm pretty sure they are working (as AML analysts) now.  I can't say them reaching out to me directly helped, but perhaps them mentioning me helped to validate their education or helped them use the right vocabulary. 

From a Senior Associate in AML/Due Diligence at a large commercial bank:  Not all AML jobs are created equally. There are different positions for monitoring transactions and reporting suspicious activity, conducting due diligence on customers before account opening and positions for writing AML/KYC policy. 

I would recommend getting extremely familiar with Excel and manipulating databases. AML/KYC is completely metric driven. Senior management and the regulators don't want novels on the status of AML/KYC efforts. They are looking for a quick report with Key Risk Indicators based on data extrapolated from whatever database/case management system is being utilized. Employees that get promoted faster than others were assigned to special reporting projects because they know how to gather that data, analyze it and package it in a clean, easy to use format. 

Lastly, I would recommend that students serious about entering into the field pursue the Certified Anti-Money Laundering Specialist (CAMS) certification. It's an industry standard and is often a prerequisite for employment. It's somewhat expensive, but students do get a discount. 

From a Vice President-AML Compliance at a large multinational bank:  Not all AML jobs are the same. There are very different levels of focus / responsibility / and potential career growth between different organizations and within different departments. Know what you’re getting into in terms of the work and apply to a position that aligns with your interests. 

Interviewers are very interested in whether applicants can think in an independent / logical / creative way. When I was interviewed, the last question I was asked was “how many toasters are there in Phoenix?” (Ed. Note:  See Fermi Questions) I ask similar questions when I interview people (although they’re directly related to the job and not household appliances). When you get these types of questions – do not answer them immediately, ask your interviewer questions or tell them about what you're assuming about the question before you answer it. It buys you time and you will give a better overall answer. In every answer that you give stress critical thinking and walk people through your thought process. Develop financial analysis skills in school. Even if you’re not interested in AML work – financial analysis skills are HIGHLY marketable and will help you land a job. 

From an AML investigator with a large multinational bank:   I feel that a class that provides a good comparison to how investigations are approached by successful AML investigators would be Professor Grabelski’s Into to Law Enforcement Intelligence. I’m sure I am not alone in remembering him drive this investigative notion home: “Tell a story!”

Q:  There seem to be many different names for this job (depending on the institution).  What are some of the search terms people should use to find these jobs?

• AML Investigator/Analyst, Compliance Officer, BSA/KYC Analyst, Global Financial Crimes Analyst/Investigator, Financial Investigative Unit (FIU) Analyst/Investigator 
• Look for jobs that include alphabet soup acronyms such as KYC, AML, BSA, OFAC, USA PATRIOT Act, and other topics such as fraud and compliance.
• The search terms I would utilize the most (it can change between banks) would be "Compliance Officer", "AML/BSA Officer", and "Analyst". Trying different combinations of those terms should help, but naturally read the job descriptions to make sure your credentials apply. 
• Students should use the following search terms when trying to find these types of jobs: AML, KYC, due diligence, OFAC, SAR (a lot of job descriptions involve suspicious activity reporting), BSA and PATRIOT Act. Some AML investigator positions are also called "Compliance Analysts.”
• Search terms for AML jobs:  ‘money laundering’, ‘AML’, ‘BSA’, ‘compliance’, ‘investigations’, ‘suspicious activity report’, ‘SAR’, ‘bank secrecy’, ‘OFAC’, ‘fraud’, ‘typology’ 

Q:  What are the opportunities for hiring right now?  What about for promotion and for movement within and between institutions in the future?  Is there anything else we should know?

From a Vice President-AML Compliance at a large multinational bank:  I think there are a couple reasons people have gravitated toward AML: 1) The market is very hot right now. There are more AML jobs out there than there have been at any point in the past. 2). Because there are more open vacancies it’s becoming tougher for organizations to find qualified people and that’s led to a significant increase in overall salaries in the past couple years. 3) You can get an AML job in virtually any city in America. That’s an attractive option for people who don’t want to live in DC or other areas where intel jobs are traditionally clustered. 

From an AML Compliance officer/Analyst with a large multinational bank:  As the demand for these positions increases, banks and related financial institutions will give away some of the negotiating power to the candidates, which is good for recent grads. I'd advise NOT to low-ball your worth. Many of the open positions will list a salary range. 

There is A LOT of poaching that takes place. Many people from our team have left to go to X, where they are getting paid more than what they would have gotten if they stayed here (from what I was told). And it seems we hire from X, probably offering more then what they would have got if they stayed! Location does matter, so evaluate the cost of living too. It is a bit odd to me, but it seems to be the status quo. People usually stay in a position for 2-3 years and move internally or externally. So, job mobility is definitely a plus, but it may be required (or encouraged). Once you have been at a bank for a bit your marketability increases as well if you want to go to a different bank, which is good job security. 

I created an entry-level Intel focused group here on LinkedIn back when I started out. With minimal effort on my part, there are now 1,216 members, many asking the right questions and even job postings from myself or others. It is called "Entry Level Intelligence Analysts".

From an AML investigator with a large multinational bank:  I feel that Mercyhurst’s reputation is growing in the private analysis/investigative sector at a fast rate. A lot of investigators and management come from public sector jobs in DC, where I feel that our reputation was already strongly solidified. Now that reputation is transferring over to the private sector…I know that within my organization Mercyhurst’s reputation for producing good analysts was already established when I got here…recent Intel grads have been so successful within the past year and a half many of us have been selected for managerial roles overseeing investigation teams. 

From a KYC Analyst at a large multinational bank:  There is, in my opinion, a significant opportunity for mobility within the organization, including internal hires from and to other departments. 

From a Compliance Analyst at a regional bank:  Even if there are no upward promotions available right now (as teams and supervisors are set for the time being), there is the opportunity to do other roles, and thus gain more experience to be more competitive for promotions.

That's it!  Lots of good advice and insights into what could be an interesting (and well-paid) career in intelligence in business.  I am certain there are many more readers who have their own tips or ideas concerning such a career choice.  Please do not hesitate to leave a comment!

Intelligence Assessment And Unpredictability (Follow Up To: How To Analyze Black Swans)

(Note:  I have known Greg Fyffe, former Executive Director of the Intelligence Assessment Secretariat in the Privy Council Office in Canada for a number of years.  His long experience in intelligence and specifically in intelligence analysis places him in a unique position with respect to the Black Swan issue.  He took his time to share some of his thoughts with me and others in the International Association For Intelligence Education Forum recently.  I asked him if he would allow me to re-print his comments here and he agreed.)

By Greg Fyffe
(Executive Director, Intelligence Assessment Secretariat, Privy Council Office, Ottawa, 2000-2008)

Kris Wheaton’s reflection on his class discussion (How to Analyze Black Swans) is useful in understanding the challenge of elaborating future possibilities in intelligence assessments. Mark Lowenthal’s comment on Black Swans also illuminates an important aspect of uncertainty—while a situation may be completely mysterious to some observers, others may be very familiar with every aspect of it. Their knowledge, however, may not be transferable to intelligence analysts. 

While many assessments provide useful contextual background, the most helpful to clients are those which are insightful in forecasting what will happen next. This is obviously not always easy. These are my observations based on eight years as the head of an intelligence analysis unit. 

Some events are high impact and high probability. Analysts may not be alone in seeing the significance of a developing situation, but if they can add evidence to the estimate, that is helpful; additional evidence that an event may well occur justifies more definite action to prepare for it.  

Analysts frequently need to look at possibilities which are low probability but high impact.  There are many ways of doing this, including scenario-building, or other speculative techniques, but since there are many significant but low probability possibilities, there are obvious risks in taking expensive preventative action.

Kris uses the pile of sand metaphor to describe a situation which appears increasingly volatile. For analysts this is a very common analytical challenge. The possible event is high impact, high probability but also unpredictable. Even though a possible outcome appears highly probable, it may never occur, or it may be triggered by random events, so even though analysts should have seen it coming, they could not. A common example of this is an authoritarian regime. Rulers are unpopular, the economy is distorted, security services are cruel and hated, and the population is unable to express dissent. If something triggers a revolt a mass uprising can quickly overturn a regime which seemed in complete control. But, sometimes the trigger event never happens and an authoritarian regime is able to stay in power for a very long period. The fall of the Soviet Union is an example of this. Analysts could describe the vulnerabilities of the regime, but the regime’s ability to contain those vulnerabilities was effective for decades. 

Maybe the eventual outcome is truly inevitable in the long run, but if the time possibilities range over many years, then analysts cannot offer much useful anticipation to clients. In these cases the role of analysis is “building block” assessments, elaborating the reasons why the underlying trends in a political system are potentially explosive, describing possible warning signs for the explosion, and paying close attention to intelligence or diplomatic reporting that may suggest the explosion is an imminent possibility. In the end, the trigger may be something that was not foreseen, because it could not be foreseen. 

A Tunisian vendor burns himself alive, and suddenly becomes the symbol and rallying point for a suppressed population.  

The classic challenge for intelligence systems is the surprise planned by a few. An event seems unlikely or illogical, but a few do know, and intelligence about their knowledge could make a difference. This category could be broken down into the monitored and unmonitored. In the former possible perpetrators are being watched (as in 911) but their actions are still a surprise. In the unmonitored situation the actors were not being tracked and their actions were therefore not anticipated. A new terrorist group, in a region not considered at risk, is only seen after its first attack. Events in these two categories are at least potential knowable, since there are people with knowledge and they are probably communicating. However, intelligence systems, unless blessed by luck, do not have the resources to look everywhere with intensity, and if they do, the amount of information produced may simply lead to another type of assessment dilemma—unmanageable volume. 

Some events with high impact are completely unpredictable. These might include the early death of an important leader, some types of natural disasters, an act by someone who was mentally disturbed, or more frequently, the third and fourth order consequences of an event which were not foreseen because the possible combinations after the initial event were simply too numerous or hidden to comprehend. The possibilities extend beyond imagination. 

What do these variations mean for intelligence systems and particularly for intelligence assessment? 

• First, attempts to guess, ask “what if” questions, and other speculative techniques, are necessary to identify possibilities, particularly those worth further analysis.
• Second, background pieces which identify curious combinations of circumstances, inexplicable course of action by key actors, or updated contextual information, are necessary to track pressures which may be building to a critical point.
• Third, background and speculative pieces need to be widely shared so that the possibility increases that someone will have additional insight into what they mean.
• Fourth, there will always be events that were not foreseen. The challenge for the analyst is to quickly assess their significance and describe them vividly. 
• Fifth, we cannot foresee all the possible consequences of an event, but if analysts are alert to possibilities they can forecast as events develop. As one possibility becomes a reality and others are eliminated, analysts can then predict another set of possibilities. It is very difficult to see third and fourth order consequences, but it is helpful to clients if the running forecast can see the immediate and secondary consequences of a developing story. 
• Sixth, some high probability events will never occur, despite all the evidence that they should. Analysis typically describes pressures that are building, but also the counter-forces that may contain them. A prediction can be made on the balance of probabilities or apparent trends, but in the end the pressures for change do not produce change. A volatile unstable situation continues to be volatile and unstable. 

We often refer to “noise” in intelligence as the reason for not seeing what was about to happen—there are so many bits of information about future developments that the truly significant pieces are only seen clearly after events have taken place. The other dimension of this dilemma is that the analyst faces a very large number of future possibilities, whatever their level of probability, and whether or not there is supportive evidence. 

When an assessment failure is reviewed we seen a sequence of events that did occur, and look at the information that the analyst could have used, and the possibilities that could have been taken more seriously. 


The analyst asking important questions often faces a vast amount of information of marginal utility or reliability, not enough high relevance and high quality intelligence, and a large number of plausible futures. The truly gifted individual, or the truly functional assessment process, is still able to assess likely outcomes often enough to be indispensable to decision-makers. 

How To Analyze Black Swans

Black swans, we are told, are both rare and dramatic.  They exist but they are so uncommon that no one would predict that the next swan they would see would be a black one.  

The black swan has become a metaphor for the limits of the forecasting sciences.  At its best, it is a warning against overconfidence in intelligence analysis.  At its worst (and far too often it is at its worst), the black swan is an excuse for not having wrung every last bit of uncertainty out of an estimate before we make it.

One thing does seem clear, though:  We can have all the information and structured analytic techniques we want but we can’t do a damn thing in advance about true black swan events.  They are, by definition, unpredictable.

Or are they?

Imagine a single grain of sand falling on a table.

And then another.  And then another.  While it would take quite some time, eventually you would have… well… a pile of sand.

Now, imagine this pile of sand growing higher and higher as each single grain falls.  The grains balance precariously against each other, their uneven edges forming an unsteady network of weight and weaknesses, of strengths and stored energy, a network of near immeasurable complexity.  

Finally, the sandpile reaches a point where every time a single grain falls it triggers an avalanche.  The vast majority of times the avalanches are small, a few grains rolling down the side of the sandpile.  Occasionally, the avalanches are larger, a side of the pile collapsing, shearing off as if it had been cut away with a knife.

Every once in a while – every once in a long while – the falling of a single grain triggers a catastrophe and the entire pile collapses, spilling sand off the edge of the table and onto the floor.

The sandpile analogy is a classic in complexity science but I think it holds some deep lessons for intelligence analysts trying to understand black swan events.

Just as we cannot predict black swan events, we cannot predict which precise grain of sand will bring the whole sandpile down.

Yet, much of modern intelligence focuses almost exclusively on collecting and analyzing the grains of sand – the information stream that makes up all modern intelligence problems.  In essence, we spend millions, even billions, of dollars examining each grain, each piece of information, in detail, trying to figure out what it will likely do to the pile of sand, the crisis of the day.  We forecast modest changes, increased tensions, countless small avalanches and most of the time we are right (or right enough).

Yet, we still miss the fall of the Soviet Union in 1991, the Arab Spring of 2010, and the collapse of the sandpile that began with a single grain.

What can we do?  It seems as though intelligence analysts are locked in an intractable cycle, constant victim to the black swan.

What we can do is to move our focus away from the incessant drumbeat of events as they happen (i.e. the grains of sand) and re-focus our attention on the thing we can assess:  The sandpile. 

It turns out that “understanding the sandpile” is something that complexity scientists have been doing for quite some time.  We know more about it than you might think and what is known has real consequences for intelligence.

An example of a power law, or long-tail, distribution

In the first place, for the sandpile to exhibit this bizarre behavior where a single grain of sand can cause it to collapse or a single small incident can trigger a crisis, the pile has to be very steep.  Scientists call this being in the critical state or having a critical point.  More importantly, it is possible to know when a system such as our imaginary sandpile is in this critical state – the avalanches follow something called a “power law distribution”.

Remember how I described the avalanches earlier?  The vast majority were quite small, a few were of moderate size but only rarely, very rarely, did the pile completely collapse.  This is actually a pretty good description of a power law distribution.  

Lots of natural phenomena follow power laws.  Earthquakes are the best example.  There are many small earthquakes every day.  Every once in a while there is a moderate sized tremor but only rarely, fortunately, are there extremely large earthquakes.

The internet follows a power law (many websites with few links to them but only a few like Google or Amazon).  Wars, if we think about casualties, also follow a power law (There are a thousand Anglo-Zanzibar Wars or Wars of Julich Succession for every World War 2).  Even acts of terrorism follow a power law.

And the consequences of all this for intelligence analysts?  It fundamentally changes the question we ask ourselves.  It suggests we should focus less on the grains of sand and what impact they will have on the sandpile and spend more resources trying to understand the sandpile itself.

Consider the current crisis in Crimea.  It is tempting to watch each news report as it rolls in and to speculate on the effect of that piece of news on the crisis.  Will it make it worse or better?  And to what degree?  

But what of the sandpile?  Is the Crimean crisis in a critical state or not?  If it is, then it is also in a state where a black swan event could arise but the piece of news (i.e. particular grain of sand) that will cause it to appear is unpredictable.  If not, then perhaps there is more time (and maybe less to worry about).  

We may not be able to tell decisionmakers when the pile will collapse but we might be able to say that the sandpile is so carefully balanced that a single grain of sand will, eventually, cause it to collapse.  Efforts to alleviate the crisis, such as negotiated ceasefires and diplomatic talks, can be seen as ways of trying to take the system out of the critical state, of draining sand from the pile.

Modeling crises in this way puts a premium on context and not just collection.  What is more important is that senior decisionmakers know that this is what they need.  As then MG Michael Flynn noted in his 2010 report, Fixing Intel: 

"Ignorant of local economics and landowners, hazy about who the powerbrokers are and how they might be influenced, incurious about the correlations between various development projects and the levels of cooperation among villagers, and disengaged from people in the best position to find answers – whether aid workers or Afghan soldiers – U.S. intelligence officers and analysts can do little but shrug in response to high level decision-makers seeking the knowledge, analysis, and information they need to wage a successful counterinsurgency."

The bad news is that the science of complexity has not, to the best of my knowledge, been able to successfully model anything as complicated as a real-time political crisis.  That doesn't erase the value of the research so far, it only means that there is more research left to do.

In the meantime, analysts and decisionmakers should start to think more aggressively about what it really means to model the sandpile of real-world intelligence problems, comforted by the idea that there might finally be a useful way to analyze black swans.