Intelligence-Driven Incident Response

Chapter 9. Disseminate

“People tend to do one of two things with data: they hoard it, or they dump it on people.”

General Stanley McChrystal

“Tell me what you know. Tell me what you don’t know. And then…tell me what you think…I will hold you accountable.”

Secretary of State Colin Powell, September 13, 2004, Intelligence Reform Hearing

At some point, the investigation needs to end, or at least pause, long enough to create outputs useful to other teams or organizations. We call the process of organizing, publishing, and sharing developed intelligence dissemination. This is a skill set unto itself and, just like any other skill, has processes and takes time to develop. Good intelligence can be ruined by poor dissemination. Although writing up something after hours of analysis may seem unimportant, it’s worth the time for any intelligence team to focus and build their skills disseminating information.

Dissemination is such an important skill that in larger intelligence teams, resources may be dedicated just to the dissemination phase. These dissemination-focused analysts need the following:

• A strong understanding of the overall process and importance of the information they’re sharing.
• A firm grasp of the types and needs of stakeholders that the intelligence will be going to.
• A disciplined and clear writing style. (Intelligence writing is a little different from typical narrative writing; we’ll get into that later in this chapter.)
• An eye toward operational security to protect ...