Instructor Materials
KEY TAKEAWAYS
▸Who else besides the Russians could be interested in poisoning Moskalenko?
▸
▸Where else could the mercury have come from?
▸
▸When could the mercury have been placed in the car?
▸
▸Why was there a lapse between the discovery of the mercury and the onset of symptoms?
This process raises the overall issue that there is no direct evidence to answer the Starburst questions for many of the key points on the star, including Who? Where? When? and Why? This should cause analysts to reassess their confi-dence in the overall assessment that the Russians poisoned Moskalenko with mercury because of her work as a human rights lawyer.
CONCLUSION
On 22 October 2008, only eight days after the case broke in the news media and ten days after Moskalenko and her
husband discovered mercury in their car, media outlets reported that Karinna Moskalenko’s poisoning was accidental.3 The New York Times reported that “French investigators have concluded that the mercury found in the car of a prominent Russian human rights lawyer had been accidentally spilled from a thermometer that had been broken in the car before the lawyer bought the vehicle.”4 The assistant prosecutor in the case said that the amount of mercury in the car was not toxic and that the amount of mercury in Moskalenko’s blood was “insignificant.”5 He added that mercury must be ingested or injected to be toxic.
KEY TAKEAWAYS
▸
▸ Avoid a rush to judgment, even if what is happening seems obvious. Slow down the momentum in a crisis situation by always asking why a judgment could be incorrect.
▸
▸ Ensure that the line of analysis is underpinned by a strong evidentiary base. Track down key gaps to avoid potentially catastrophic analytic vulnerabilities.
▸
▸ Always be alert to the analytic trap of “satisficing,”
especially when under pressure to confirm a popular viewpoint or generate an analysis rapidly.
Figure 1.4 ▸▸Starbursting the Karinna Moskalenko Case
• What was the substance?
• What was the location?
• In what form was it?
• What is the toxicity of this amount?
• When was it found?
• When could it have been put there?
• Where was the mercury found?
• Where could it have come from?
• How did the family find the substance?
• How did they know it was mercury?
• Why was Moskalenko a target?
• Why was there a lapse between the discovery and the onset of symptoms?
• Why would the Russians employ an indirect method to poison her?
• Who poisoned Moskalenko?
• Who else besides the Russians?
• Wh
• Wh
• In
• Wh
• When was it found?
• Ho
• Ho e
ms?
n
• Who else besides the Russians?
WHERE?
WHEN?
HOW?
WHA T?
WHO?
WHY?
NOTES
1. “More Poison: Another Prominent Adversary of Vladimir Putin Is Mysteriously Exposed to Toxins [editorial],” Washington Post, October 22, 2008, http://www.washingtonpost.com/wp-dyn/
content/article/2008/10/21/AR2008102102342.html.
2. The steps as outlined in this case combine the processes for a Premortem Analysis and Structured Self-Critique. This combina-tion is particularly helpful in cases that require analysts to think broadly, imaginatively, and exhaustively about how they might have been wrong. The Premortem Analysis taps the creative brainstorm-ing process, and the Structured Self-Critique provides a step-by-step assessment of each analytic element. To aid students’ learning pro-cess, the questions in this case have already been narrowed from the fuller set of Structured Self-Critique questions found in Richards J.
Heuer Jr. and Randolph H. Pherson, Structured Analytic Techniques for Intelligence Analysis, 2nd ed. (Washington, DC: CQ Press, 2015).
3. Cyrille Louis, “L’avocate de Politkovskaïa n’aurait pas été empoisonnée [Attorney for Politkovskaya was not poisoned],” Le Figaro (France), October 22, 2008, http://www.lefigaro.fr/actualite- france/2008/10/22/01016–20081022ARTFIG00605-l-avocate-de-politkovskaia-n-aurait-pas-ete-empoisonnee-.php.
4. Alan Cowell, “France: Mercury in Lawyer’s Car Is Ruled Accidental,” New York Times, October 27, 2008, http://www .nytimes.com/2008/10/28/world/europe/28briefs-MERCURYIN LAW_BRF.html.
5. Mark Ames, “Editorial Malpractice,” Nation, December 10, 2008, http://www.thenationa.com/article/editorial-malpractice.
11
2 The Anthrax Killer
Cases in Intelligence Analysis: Structured Analytic Techniques in Action
Instructor Materials
I
n the following exercises, students put themselves in the shoes of an FBI analyst who must unravel how events in the anthrax case unfolded, present the information to a senior policy maker in a succinct and effective format, and troubleshoot the judgment that Steven Hatfill is most likely the anthrax killer prior to the announcement that he is the FBI’s person of interest.Analysts are often called upon to support government task force investigations in which the fast pace of events, scrutiny by high-level officials, and sheer quantity of information can be overwhelming. In the face of this kind of challenge, Chronologies frame the problem and bring order to the jumble of data points, helping analysts identify assumptions and gaps that form the case. Combined with Timelines, this ordering puts key facts and events in context so that individual analysts can easily track large amounts of data and multiperson task forces can maintain a common understanding of developments, day or night. Timelines and Chronologies can also be the basis for tailored products or graphics such as Maps that can be used to bring senior officials up to speed efficiently and effectively. The Premortem Analysis and Structured Self-Critique help analysts avoid a rush to judgment and illuminate important areas for further consideration by challenging assumptions, identifying biases, and closely examining the evidentiary base.
TECHNIQUES 1, 2, & 3: CHRONOLOGY, TIMELINE, AND MAP
Chronologies are a simple but useful tool that helps order events sequentially; display the information graphically;
and identify possible gaps, anomalies, and correlations. The
technique pulls the analyst out of the evidentiary weeds to view a data set from a more strategic vantage point. A Chronology places events or actions in the order in which they occurred. A Timeline is a visual depiction of those events, showing both the time of events and the time between events. Chronologies can be paired with Timeline and mapping software to create geospatial products that display multiple layers of information such as time, location, and multiple parallel events. The geographic scope and many details of this case make a Chronology, Timeline, and Map particularly useful in understanding how the case unfolded both temporally and spatially.
In the case narrative, students pick up the case on 15 October, well after the anthrax letters are sent. By creating the Chronology, the analyst develops a deeper understanding of each relevant event or piece of data. The Timeline, in turn, illustrates different temporal aspects of the case. In the following exercise, the key is to correlate the timing of the onset of illness with the letters themselves.
By using the Timeline, it becomes apparent that the timing of the onset of illness overlapped significantly in New York, New Jersey, and Florida, which corresponded with the first mailing, while a separate grouping of New Jersey and Washington, D.C., cases emerges around the time of the second mailing. Also, the cutaneous cases emerged more rapidly after known exposure than the inhalation cases, which is consistent with the clinical descriptions provided by the Centers for Disease Control. The use of these techniques also highlights the importance of arranging the data by date of information, not the date of acquisition or the date of reporting. For example, the anthrax cases are tracked by date of illness onset or by date Table 2.1 ▸ Case Snapshot: The Anthrax Killer
Structured Analytic Technique Used Heuer and Pherson Page Number Analytic Family
Chronologies and Timelines p. 56 Decomposition and Visualization
Premortem Analysis p. 240 Challenge Analysis
Structured Self-Critique p. 245 Challenge Analysis
that treatment was sought, not by the date the case was reported in the press. In fact, the FBI used a similar chronology to illustrate this point in the official Amerithrax Investigative Summary, noting, “the evidence supports the conclusions that the mail attacks occurred on two separate occasions.”1
Task 1.
Create a Chronology of the anthrax attacks and investigation.
Step 1: Identify the relevant information from the case