4 Decomposition and Visualization
4.4 CHRONOLOGIES AND TIMELINES
A
chronology is a list that places events or actions in the order in which they occurred; a timeline is a graphic depiction of those events put in context of the time of the events and the time betweenevents. Both are used to identify trends or relationships among the events or actions and, in the case of a timeline, among the events and actions as well as other developments in the context of the overarching intelligence problem.
When to Use It
Chronologies and timelines aid in organizing events or actions. Whenever it is important to understand the timing and sequence of relevant events or to identify key events and gaps, these techniques can be useful. The events may or may not have a cause-and-effect relationship.
Value Added
Chronologies and timelines aid in the identification of patterns and correlations among events. These techniques also allow you to relate seemingly disconnected events to the big picture to highlight or identify significant changes or to assist in the discovery of trends, developing issues, or anomalies.
They can serve as a catch-all for raw data when the meaning of the data has not yet been identified.
Multiple-level timelines allow analysts to track concurrent events that may have an effect on each other. Although timelines may be developed at the onset of an analytic task to ascertain the context of the activity to be analyzed, timelines and chronologies also may be used in postmortem intelligence studies to break down the intelligence reporting, find the causes for intelligence failures, and highlight significant events after an intelligence surprise.
The activities on a timeline can lead an analyst to hypothesize the existence of previously
unknown events. In other words, the series of known events may make sense only if other previously unknown events had occurred. The analyst can then look for other indicators of those missing events.
Timelines and chronologies can be very useful for organizing information in a format that can be readily understood in a briefing.
Potential Pitfalls
In using timelines, analysts may assume, incorrectly, that events following earlier events were caused by the earlier events. Also, the value of this technique may be reduced if the analyst lacks imagination in identifying contextual events that relate to the information in the chronology or timeline.
The Method
Chronologies and timelines are effective yet simple ways for you to order incoming information as you go through your daily message traffic. An Excel spreadsheet or even a Word document can be used to log the results of research and marshal evidence. You can use tools such as the Excel drawing function or the Analysts’ Notebook to draw the timeline. Follow these steps.
When researching the problem, ensure that the relevant information is listed with the date or order in which it occurred. Make sure the data are properly referenced.
Review the chronology or timeline by asking the following questions.
What are the temporal distances between key events? If “lengthy,” what caused the delay?
Are there missing pieces of data that may fill those gaps that should be collected?
Did the analyst overlook piece(s) of intelligence information that may have had an impact on or be related to the events?
Conversely, if events seem to have happened more rapidly than were expected, or if not all events appear to be related, is it possible that the analyst has information related to multiple event timelines?
Does the timeline have all the critical events that are necessary for the outcome to occur?
When did the information become known to the analyst or a key player?
What are the intelligence gaps?
Are there any points along the timeline when the target is particularly vulnerable to U.S.
intelligence collection activities or countermeasures?
What events outside this timeline could have influenced the activities?
If preparing a timeline, synopsize the data along a line, usually horizontal or vertical. Use the space on both sides of the line to highlight important analytic points. For example, place facts above the line and points of analysis or commentary below the line. Alternatively, contrast the activities of different groups, organizations, or streams of information by placement above or below the line. If multiple actors are involved, you can use multiple lines, showing how and where they converge.
Look for relationships and patterns in the data connecting persons, places, organizations, and other activities. Identify gaps or unexplained time periods, and consider the implications of the absence of evidence. Prepare a summary chart detailing key events and key analytic points in an annotated timeline.
Example
A team of analysts working on strategic missile forces knows what steps are necessary to prepare for and launch a nuclear missile. (See Figure 4.4.) The analysts have been monitoring a country that is believed to be close to testing a new variant of its medium-range surface-to-surface ballistic missile.
They have seen the initial steps of a test launch in mid-February and decide to initiate a concentrated watch of the primary and secondary test launch facilities. Observed and expected activities are
placed into a timeline to gauge the potential dates of a test launch. The analysts can thus estimate when a possible missile launch may occur and make decision makers aware of indicators of possible activity.
Origins of This Technique
Chronologies and Timelines are well-established techniques used in many fields. The information here is from Defense Intelligence Agency training materials and Jones, “Sorting, Chronologies, and Timelines,” chap. 6, in The Thinker’s Toolkit.
Figure 4.4 Timeline Estimate of Missile Launch Date
4.5 SORTING
S
orting is a basic technique for organizing a large body of data in a manner that often yields new insights.When to Use It
Sorting is effective when information elements can be broken out into categories or subcategories for comparison with each other, most often by using a computer program, such as a spreadsheet. This technique is particularly effective during the initial data gathering and hypothesis generation phases of analysis, but you may also find sorting useful at other times.
Value Added
Sorting large amounts of data into relevant categories that are compared with each other can provide
analysts with insights into trends, similarities, differences, or abnormalities of intelligence interest that otherwise would go unnoticed. When you are dealing with transactions data in particular (for example, communications intercepts or transfers of goods or money), it is very helpful to sort the data first.
Potential Pitfalls
Improper sorting can hide valuable insights as easily as it can illuminate them. Standardizing the data being sorted is imperative. Working with an analyst who has experience in sorting can help you avoid this pitfall in most cases.
The Method Follow these steps:
* Review the categories of information to determine which category or combination of
categories might show trends or an abnormality that would provide insight into the problem you are studying. Place the data into a spreadsheet or a database using as many fields (columns) as necessary to differentiate among the data types (dates, times, locations, people, activities, amounts, etc.). List each of the facts, pieces of information, or hypotheses involved in the problem that are relevant to your sorting schema. (Use paper, whiteboard, movable sticky notes, or other means for this.)
* Review the listed facts, information, or hypotheses in the database or spreadsheet to identify key fields that may allow you to uncover possible patterns or groupings. Those patterns or groupings then illustrate the schema categories and can be listed as header categories. For example, if an
examination of terrorist activity shows that most attacks occur in hotels and restaurants but that the times of the attacks vary, “Location” is the main category; while “Date” and “Time” are secondary categories.
* Group those items according to the sorting schema in the categories that were defined in step 1.
* Choose a category and sort the data within that category. Look for any insights, trends, or oddities. Good analysts notice trends; great analysts notice anomalies.
* Review (or ask others to review) the sorted facts, information, or hypotheses to see if there are alternative ways to sort them. List any alternative sorting schema for your problem. One of the most useful applications for this technique is to sort according to multiple schemas and examine results for correlations between data and categories. But remember that correlation is not the same as causation.
Examples
Example 1: Are a foreign adversary’s military leaders pro-U.S., anti-U.S., or neutral on their
attitudes toward U.S. policy in the Middle East? To answer this question, analysts sort the leaders by various factors determined to give insight into the issue, such as birthplace, native language, religion, level of professional education, foreign military or civilian/university exchange training
(where/when), field/command assignments by parent service, political influences in life, and political
decisions made. Then they review the information to see if any parallels exist among the categories.
Example 2: Analysts review the data from cell phone communications among five conspirators to determine the frequency of calls, patterns that show who is calling whom, changes in patterns of frequency of calls prior to a planned activity, dates and times of calls, subjects discussed, and so forth.
Example 3: Analysts are reviewing all information related to an adversary’s Weapons of Mass Destruction (WMD) program. Electronic intelligence reporting shows more than 300,000 emitter collections over the past year alone. The analysts’ sorting of the data by type of emitter, dates of emission, and location shows varying increases and decreases of emitter activity with some minor trends identifiable. The analysts filter out all collections except those related to air defense. The unfiltered information is sorted by type of air defense system, location, and dates of activity. Of note is a period when there is an unexpectedly large increase of activity in the air defense surveillance and early warning systems. The analysts review relevant external events and find that a major opposition movement outside the country held a news conference where it detailed the adversary’s WMD
activities, including locations of the activity within the country. The air defense emitters for all suspected locations of WMD activity, including several not included in the press conference, increased to a war level of surveillance within four hours of the press conference. The analysts
reviewed all air defense activity locations that showed the increase assumed to be related to the press conference and the WMD programs and found two locations showing increased activity but not
previously listed as WMD related. These new locations were added to collection planning to determine what relationship, if any, they had to the WMD program.
Origins of This Technique
Sorting is a long-established procedure for organizing data. The description here is from Defense Intelligence Agency training materials.