ORGANIZING FOR OSINT by Frans de Ridder

I INTRODUCTION

In the next thirty minutes I shall try to give you an idea of the way in which open source intelligence bas been organised in my Service and how information from open sources fits into working procedures. In order to save you the trouble of making notes, I have my contribution available as a hand-out afterwards. In addition to the subject open sources at the (… ) , I wilI also pay some attention to the phenomenon of knowledge management. For I take the view that knowledge management is of vital importance for each organisation that creates products with and through knowledge.

II OPEN SOURCES AT THE (… )

1 History

But Ill begin by telling you how open source intelligence bas been organised at the (…. ). I shall first give you a short outline of the history of the use of open sources at our service. It is a fact that our service has always attached great value to the use of information from open sources. Until the great reorganisation in 1991 the use of publicly available information was quite normal, but it was by no means systematic and structural. It depended on the choice, the knowledge and the skills of the user, what information from open sources he selected. Until the middle of the 1980s these knowledge and skills were mostly sufficient, because the open sources market was physically restricted to printed information and geographically more or less restricted to the Netherlands.
At the time the user did not have to do it on its own, because there was also a library to lend a helping hand.
But it was a traditional type of library; the librarians primarily concentrated on building collections and only rendered assistance when a client had a specific question. By the end of the 1980s this sluggishness abruptly came to an end as a result of two big shifts.
In the first place global developments led to a change in the stable interest profile of the service, which was replaced by a wider, constantly changing range of areas for attention.
In the second place there was a massive shift from analogous to digital information in the information market, as a result of which enormous amounts of information became available.
Differences in time and place were reduced to nil. These two changes triggered an enormous increase in attention for information from open sources in the intelligence and security community, while exactly at that turning point in history the ( …) went through a drastic reorganisation.

2 The organisation in 1991

Ill spare you the details of that reorganisation, but for a good understanding of the rest of my contribution it is important to know that after the reorganisation the ( …. ) started thematic working, which implies that teams with a varying composition are working on short-term or long-term projects. Another striking detail is the very flat organisational structure of the organization. Directors and department heads have far-reaching responsibilities in the field of personnel policy and financial management.

3 The Open Sources Information Department

Apart from this big revolution in working procedures at the operational directorates, a separate department for Open Sources Information was set up and given an equal status next to traditional intelligence tools such as surveillance and technical intelligence gathering. That equal status is essential! I am emphasizing this.
For it implies that since that time open sources intelligence is formally part of the primary operational intelligence process. It means for example that the library is formally no longer a management support section. In addition to the fact that a separate open sources information department was set up, a new function was created to be included in this department, the function of information broker and those information brokers got a key position within the department.
It is true that the library, with reading room and video room, is still the tangible heart of the department, but the viability of the department depends on the function of the information broker. For that reason I will now describe this function in detail.

4 The information broker

As I said, the function of information broker is new at the (… ). It has existed since 1991. It concerns a specialism developed to realize a more effective and efficient use of the opportunities offered by the open sources market to a security service like ours.
The mere fact that before 1991 no optimal use was made of these opportunities was in itself a reason to appoint professionals, but in addition to that the revolution in the information market, which involved for instance the advent of on-line data banks, off- line databases, the computerization of libraries and the Internet, formed another reason to prevent the end-user from falling further behind.
While on paper the structure and working procedures of an organisation can be changed overnight, changing a culture is an entirely different matter. At the time the newly appointed information brokers were confronted with various problems: on the one hand they had to convince internal users of the importance of a systematic and coherent use of open sources, while on the other hand they were faced with an external market which overloaded them with new products and developments.There was no comprehensive job description for the information broker when the (…. ) introduced this function and also later it proved to be impossible to make a permanent job description. The function is still subject to constant changes. I cannot emphasize this dynamics enough. At this moment in time the primary responsibility of the information broker is the acquisition of information from open sources on the basis of manifest and latent needs for information within teams and departments of the (…. ). In addition, the information broker is in charge of exploring and disclosing new open sources of both a documentary and a human nature. In that respect the information broker at the (…. ) can even be regarded as a semi-field officer, because his duties as an open sources expert also involve developing and maintaining external relationships. At the moment the third element of the information brokers job is the provision of advice and support to internal clients in their attempts to acquire information from open sources.
We have now reached a point where most of the time is spent on acquisition, while we only have limited capacity for a systematic exploration of the information market and the development of the internal advisory function. We, as a department, would like to change this. And we succeeded in convincing the senior management of our service of the necessity of such a restructuring. Ill come back to that later. Now I first want to tell you something about the position of information broker. The fact that the function of information broker has become a success within the ( …. ) in the last few years is based upon several factors. I will mention some of these factors, which at the same time will throw light on the significance of the role of the information broker within our organisation.

A. I believe that the quality of an information broker mainly depends upon its ability to analyse a question for information through communication with the client and to reduce this question to a solvable, simple problem. So an information broker is not a person who provides information, but a person who solves problems. In my opinion, and I want to underline this, the time spent on communications between the client,- e.g. an analyst – and the supplier, in this case the information broker, can never be too much. For that reason the information broker is expected to have excellent communication and human relations skills. A good information broker should be able to ask his client specific relevant questions in order to find out what exactly it is that he wants to know, in other words what his problem is.
Therefore, the narrowing-down principle, which implies that a clients primary undefined need for information is reduced to a concrete question in a logical and systematic way, is of vital importance, at least when you want to protect your client from an information overload and alI kinds of information and data that can be ranged under the nice-to-know category. You will understand that these skills are given ample attention in the selection of potential information brokers. No matter how much an applicant knows about the information market, data banks, libraries etc., without a good share of communication skills I will not take such a person on.

B. A second crucial second factor for an information broker is his ability to anticipate information needs. This implies that an information broker should be in close touch with present and future clients, in order to anticipate their needs. This is very difficult in an environment in which compartmentalization and the need-to-know principle have become a way of life and where involvement is easily branded as nosiness. It is important, though, that the information broker is well aware of what is going on in the various areas of work of the departments and teams. But an information broker with good communication skills can achieve much. When he has had a chance to demonstrate how fast and complete he can provide reliable open sources information, his position is guaranteed for a long time and he will automatically be asked to attend operational consultations and to express his views and ideas. I can assure you that this has already led to an improvement of many team results, because it proved to be unnecessary to deploy special intelligence tools or because information from open sources confirmed earlier acquired information from secret sources, which made it easier to exploit the findings.

C. A third important factor for the success of an information broker is the ability to be “just” in time. In other words, to have knowledge about something that others are not yet aware of. The information broker should for example be able to consult the latest and best on-line databases, to read an important book before the reviews appear in the press and to lay hands on reports, reviews, papers, etc., before others have it. These are all examples of features that distinguish the information broker at the (…. ) from the traditional, more passive information suppliers as can be found in more conservative institutions, like some libraries.

5 The other side of the coin

However, the success of the information broker at the (…. ) also has its drawbacks. I told you before that the information broker in our service spends most of his time just on solving problems, in fact on acquisition, and that he tends to have increasingly less time left for exploration of the market and advisory functions. But in my opinion exactly these areas will give the open sources department its added value in the coming years. In such a situation there are two options. Either you appoint a larger number of information brokers in order to meet the demand, or you teach your clients how they themselves can improve acquisition.
I do not favour the appointment of more information brokers unless it is absolutely necessary. Every extension of the production chain in the form of more links causes delay and complications anyway. For that reason one should not unnecessarily cultivate specialisms. The integration of as much knowledge and skills as possible into as less job categories as possible reduces the production time of an intelligence product and therefore I have a preference for that option.
The growing technological possibilities of the last few years have made it possible to give the end-user access to various on-line databases. It has removed major obstacles such as the need to go to distant reading rooms, libraries and other institutions holding useful open information. So why would an end-user involve an information broker if he can largely acquire the information himself. The advantage is that the number of information brokers does not have to be increased and that the present information brokers have more time to devote themselves to tasks like exploration of the market, including finding and disclosing new sources, evaluation of known sources and testing out new ideas and methods. It also enables them to pay more attention to an intensification of the cooperation with colleagues at home and abroad.

6 Decentralization of open sources

However, the introduction of such a change is not easy. End- users find it a lot easier to use the services of an information broker and they often use the argument Ive got no time for that, just to avoid having to sit behind a computer themselves. But still, the number of people in favour of increasing independent searching in information bases by end-users is growing.
Consequently, Iast year it was decided to start a gradual decentralization of the facilities and to enable end-users to handle the acquisition of digital open information themselves, in so far as possible. Access to digital open sources, in fact work stations with an on-line connection with various commercial data banks and the Internet, will be placed in the neighbourhood of each end-user.
Last year we tested this system by placing some on-line open sources work stations in other places of the building, while we authorized several job categories for the use of certain databases such as Reuters and Lexis Nexis.
It appeared that, with a proper mental preparation, specific training and constant guidance by information brokers, much acquisition work can be taken off the hands of the open sources information department. Consequently, this year we will start a large-scale training programme for (…) officers for on-line activities and we will actually decentralize physical access by setting up on-line work stations in several places in the office.
Especially if this proves to lead to less time-consuming and better results, resistance will soon die down, and our purpose, a more effective and efficient use of open information in the primary operational process, has been achieved.

III KNOWLEDGE MANAGEMENT

I have now come to the moment where I would like to tell you something about a subject that is closely related to our work and that, as a result of the interaction between open sources and information and communication technology has attracted our attention. I am referring to knowledge management. If you check out the international newspapers and renowned news magazines of roughly the past year, you will undoubtedly find a number of articles about this phenomenon. The subject has evidently become of such an importance that it deserves that attention. A head of an open sources information department is obviously confronted with various questions in the field of information and knowledge. You keep asking yourself questions such as: how to get enormous amounts of data under control, how to prevent an information overload, how to approach new technologies in your organisation, what opportunities offer matters such as data warehousing and data mining, what to do with neural agents?
All in all, there is much to think about in order to ensure that your organisation can use the opportunities in the field of information, now and in the future, while at the same time protecting that organisation from the pitfalls. In that connection I have become more and more interested in the phenomenon of knowledge management in the past year. I even started to follow a post-graduate course in Tilburg with the aim to let my organisation eventually benefit from the application of this specialism in working procedures.
Knowledge management. Already in the 1980s the term emerged in specialist literature, but a breakthrough did not materialize until the early 1990s, with the spectacular boom in information and communication technology.
If you try to find a generally accepted sound definition of knowledge management, you will not find it. In that respect knowledge management is a container term. It has evident relations with several arts and sciences such as sociology, psychology, linguistics, technics, economic sciences and the traditional library and documentation disciplines. For that reason the definitions you find are often biased because the writer is from one of the disciplines I mentioned. It is generally accepted, though, that knowledge management is based upon the idea that organisations are no longer dependent on just the three traditional production factors: ground, capital and work, but also – and sometimes especially – on a new fourth factor, namely knowledge. For that reason it is as logical for an organisation to pay attention to knowledge management as to economic, financial and personnel policy. It has become of vital importance to an organisation to know what knowledge potential it has, where this knowledge is stored, what knowledge is lacking, how knowledge is disseminated and shared and what knowledge the organisation will need in order to survive. And the more knowledge an organisation has, the greater the importance to manage that knowledge. Intelligence and security services are knowledge-intensive organisations which do not differ from commercial companies in that respect.
Knowledge management has evolved into a separate discipline. In the Netherlands it is part of business administration studies at the university of Groningen, and, as I said, there is a post-graduate course of this subject in Tilburg.
This is not the time to go into this phenomenon in detail. I want to restrict myself to mentioning its existence and the fact that it may be approached from a perspective of open sources, although it has a wider scope and it is actually relevant to the whole organisation. However, I would like to point out the difference between information management and knowledge management. In specialist literature these terms are often confused.
The current view is that information management concerns the registration of administrative procedures, the arrangement of structural procedures covering the professional use of information held by the organisation. Knowledge management, however, does not relate to structured procedures, it relates to knowledge and experiences in peoples minds, so-called tacit knowledge versus explicit knowledge laid down in regulations and guidelines. Knowledge management concerns learning and the use that an organisation makes of knowledge of individuals.
At the moment it is difficult to say where to all this will eventually lead. But it is practically certain to become an area for permanent concern and attention for most organisations. And in my opinion, the intelligence and security community should not lag behind. For that reason I rather emphatically demanded your attention for this phenomenon in this context.