Developing Threat Intelligence, Early Warning, and Situational Awareness by SAMUEL CULPER

For several years, I’ve impressed upon readers the importance of three things: threat intelligence, early warning, and situational awareness.

Today I’m going to expound a bit about these three things and the types of activities they involve. Think of them as ‘phases’ of SHTF Intelligence development.

My hope is that you take me up on learning this stuff because knowing it will make a difference when you need it.

Threat Intelligence

Before an event, we need to understand what’s in our operating environment. That’s why we build an Area Study.

Once we know what’s it in our operating environment, we can look at area threats: who or what are the known or potential threats and how will they affect us?

Each threat will operate in the same environment you do. Hills, valley, roads, bridges, people, critical infrastructure, police, politics, economics — each of these elements will bear their own influences on what happens in the area.

If we fail to understand these elements, then we’re likely to fail at reducing uncertainty about the future.

By completing an Area Study and examining local threats, we can begin to deduce what’s more likely to happen, and therefore be better prepared to face these conditions and events.

I’ll be running another Area Study Live course later this spring. Join the Dispatchemail list (below) for more information or sign up for the Area Study email training series here.

Early Warning

Once we’ve completed our Area Study and examined local threats, we can look ahead to potential triggers. Just knowing what could go wrong in your own area will give you a leg up on early warning.

For some events, we may have no warning. A cyber attack, for instance, could happen out of the blue with no warning. But there are ‘indicators’ that we can watch for that may give us a sense of elevated risk.

For other events, we can absolutely gain an indication if an event may be imminent. And we can describe the impact of those events by looking at second- and third-order effects. Once a trigger event or condition occurs (the ’cause’), we can follow a logical path of reaction events or conditions.

Understanding these cause-and-effect chain reactions is going to heighten our level of preparedness because a) we’re already well-informed consumers of information (thanks to our Area Study) and b) because we’ll have realistic expectations for follow-on events after a trigger event.

This stuff isn’t rocket science. But most people have never been exposed to this type of methodical and systematic approach to understanding complex environments. Once you hurtle a short learning curve, this type of thinking can become second-nature. You may even find that you become an accurate thinker.

Reducing uncertainty about the future and being able to develop realistic expectations moves us into a much better category of preparedness: one in which we can anticipate events instead of solely react to them.

Situational Awareness

Finally, once an event does occur, we’ll need to achieve and maintain situational awareness on what’s happening. Most “preppers” are going to find that they’ve not done enough to prepare to manage information during an event.

Good decisions are made on good information or, in our case, good intelligence. Without this intelligence, your decisions are at risk of being poorly informed. And we want to make well-informed decisions.

Prior to this phase, we’ve focused on developing intelligence that can be done slowly. For instance, you could have an 50-80 percent solution for an Area Study over a weekend. Or it could be done a few hours a week over the course of a month.

Similarly, developing early warning indicators can take some time, but your world probably won’t end if it’s not done tomorrow.

Situational Awareness during an emergency, however, is an enduring and immediate need. We’ll have to monitor various communications channels — via online, signals, and human sources — and make sense of what’s happening in real time.

In 2015, we battled tracked the Ferguson riots. By consuming lots of real-time information through the night, we were able to build out a very good security picture for the area. We knew which areas were experiencing unrest, where riot officers were patrolling or forming skirmish lines, and which areas weren’t being affected.

In short, we were able to develop real-time intelligence through our efforts. And I teach students how to build their own intelligence capacity for similar scenarios.

Threat intelligence, early warning, and situational awareness are three vital areas that are unfortunately often overlooked in preparedness.

Later this Spring, I’ll be introducing a new training pipeline that prepares students for SHTF scenarios by learning the tasks and responsibilities involved. The end goal is to prepare students to manage intelligence during their own real-time emergencies, whether that’s a natural disaster, civil unrest, or something worse.

If you want more information, be sure to sign up for the Dispatch email list below.

Always Out Front,
Samuel Culper