Matthew Burton

The Value of Open Source Information: Two Military Intelligence Coups by the Web

Recently, I was a panelist at the Director of National Intelligence’s Open Source Conference. The title of my panel was “Young Analysts Talk About the Value of Open Source.” The intelligence field’s definition of “open source” is different from what you might think: all it means is “information derived from public sources”: newspaper articles, television broadcasts, Web sites, etc.

To outsiders, it might seem odd to have a conference about this: doesn’t everyone understand the value of information? But when your desk has piles of secrets stolen from the enemy, it’s understandably difficult to spend time reading about things the whole world already knows. And because network security is extremely important, many intelligence analysts do not have easy access to the Web. So the Intelligence Community is slow to realize the power of publicly available information in anticipating threats.

Many of the product booths in the exhibit hall showcased products that harvest Web content en masse so that it can be delivered to analysts on a non-Web network. (This is an important point to emphasize to readers outside the intelligence world. Analysts have access to infinite stores of foreign newspapers and news broadcasts, but this content is stored privately, copied from a public medium to a private data store, with an interface that looks like a card catalog rather than the Web sites where the content was originally found.)

What to do with all of that information? Is open source intelligence somehow special or different from classified sources? The title of the panel implied that it is different; it also implied that I would have a unique take. I do.

I think it’s wrong to think of “open source” as a type of information. Instead, we should view it as a manner of analysis: even if your original source is public, you can’t do anything special with the information if you treat it just like all your other classified sources. There are open networks and closed networks, and when public information is placed on a closed network, it is no longer possible to do open source analysis. Whether classified or unclassified, your network is the only thing that can make a piece of information more or less valuable.

Let’s take an old piece of satellite imagery as an example. Imagine it’s been gathering dust in an analyst’s file cabinet for years. Originally classified SECRET, it is declassified today: someone removes it from the file cabinet, slaps “UNCLASSIFIED” on it, and puts it back into the filing cabinet. The image is not qualitatively different. As long as it’s sitting in that file cabinet behind a vault door, it might as well be classified. Yet that is what we do to public information: it’s unclassified, but it’s stored in a vault where few people can get to it.

Instead of putting that image back into the file cabinet, scan it and put it on the Web. Now you’ve got something interesting: the content of the image is the same, but you have given it new life by allowing billions of people to see it. This is where the value of open source information lies: these people will see the image, talk about it, post it in other places, compare it with other images, and even alter it. All of these activities will make that image much more valuable than it ever was sitting in the file cabinet. The more open your information network is, the more valuable your information will become.

We do the opposite to open source information: when we take a video from YouTube and put it onto JWICS, the video it instantly loses lots of value. Because it wasn’t just the video itself that made it worth capturing: it was the creator’s profile and past videos, the video’s comment thread, and the list of related videos along the sidebar. Those things are either gone or hard to find on JWICS. In terms of analytic value, the only thing that distinguishes open source information from classified information is the value created by the network that houses the information. The Intelligence Community is used to thinking that limited access makes information more valuable. In many cases, this is still true. But when it comes to open source information, the whole world’s ability to access it is what makes it so precious. When analysts are forced to consume such information on a closed network, they lose lots of value.

What constitutes an “open” network? Here are two stories that demonstrate how the Web’s openness adds value to information. I picked these stories precisely because they have clear military intelligence applications.

Singularity: The Iran Missile Photoshop Snafu

There is only one Web. All Web users are in the same place, and so is all of the Web’s data. But that’s not the case in the Intelligence Community: many CIA analysts work on one network, NSA analysts on another, etc. So if an NSA analyst posts a comment in response to an intelligence assessment (this is not always possible, but that’s another matter), their CIA counterpart probably won’t see it. This fractures the community, and it needs to stop. It’s as if your city’s phone network only allowed you to speak with people in the same area code. (For more about this, read about Metcalfe’s Law.) Here’s a real-world example of how multiple, fractured communities can keep you from making the most of information:

On July 9, 2008, the Iranian military test-fired some missiles. Then they posted photos of the test on their Web site:

fourmissiles

Agence France-Presse distributed this photo, and the next morning, it ran above the fold all over the world:

latimes

saopaulo

About the same time, TV networks were showing video of the launch:

bbc

It’s easy to spot the difference when I put them right next to each other: the photo was altered to show four missiles, when only three were launched. The Web caught the mistake on Wednesday evening, long before the photo was on newsstands the next morning. Why didn’t the press catch their mistake in time? Because “The Press”–which we refer to as a single community–was instead acting like multiple, disconnected communities relying on mutually exclusive information. The newspapers were paying attention to photos, the broadcasters were paying attention to video, and neither of them were watching the Web. Had all the journalists been working with all of the available information (just like that Web user who caught the error), the newspapers would have run a different photo. Maybe this:

threemissiles

Or maybe even this, which was posted on the blog Little Green Footballs at 6pm Pacific. The Times had not even settled on its incorrect front page, and the Web had already found the real story and done a full analysis:

via Little Green Footballs

via Little Green Footballs

The behavior of the journalists in this case is more or less how intelligence analysts work: some people have access to some documents, and other people have access to other documents. The behavior of Web users, on the other hand, exemplifies open source analysis. Their achievement should teach us that when people work as a single community and share access to the same information, good things happen. People feed off of one another’s insights, and the information becomes more valuable. By sharing your data, you learn things you never would have learned by hiding it.

Freedom: The Jim Gray Rescue Effort

The Web is fast and free: fast, in the sense that you can make things happen overnight; and free, in the sense that you don’t need the boss’s permission to implement new ideas. This was no more apparent than in the case of Jim Gray.

Jim Gray was a database pioneer based in San Francisco. He disappeared while sailing in the Bay area last January. He was never found.

But his friends, many of whom were Silicon Valley magnates, did their best to try. One of these friends retasked DigitalGlobe imagery satellites to shoot fresh photos over 3,500 square miles of sea. The result was 1400 gigantic images. So coders automatically split the images up into 560,000 smaller ones that could be easily reviewed; someone else contributed a computer program that automatically sharpened all of the images.

Now that they had over a half million pictures, they needed a way to solicit volunteers to look at them. Amazon.com already had a ready-made solution, so the images were posted on a special page that let virtual volunteers cull through these images in search of Gray’s sailboat. 12,000 volunteers reviewed all 560,000 images three times each.

All of that happened in three days. They didn’t find Gray’s sailboat. But it was the largest search party in history, on top of being simply amazing.

The Web’s speed and freedom made it possible. Had this job been given to an organization with a closed network, this never would have happened.

What about your organization’s intranet? Could your IT team split up those images into easy-to-consume portions? Could they write a script that automatically sharpened all 560,000 images? Could they create a tool that lets the rest of your workforce review the images from their own desks? Could your servers handle the load? And could all of that be accomplished in three days? In order to do that, you need to have the technical talent on hand.

Once you have the talent, those people need permission to work freely and create solutions on the fly; improvisation is essential during emergencies. Do they have that permission? Or would your org have to submit justification statements, get contract managers to approve personnel reassignments, and run each line of code past the infosec people before finally getting something live?

On the Web, if you have an idea, you just do it. This is a philosophy and capability the Intelligence Community (and any large, data-driven organization) should keep in mind if it wants to fully exploit its data. Analysts will always have too much information to process and too little time in which to do it (and focusing the “open source intelligence” conversation on culling Web content contributes to that problem). To have any hope, they need an IT and bureaucratic infrastructure that will accommodate improvised solutions.

Again: if you want to make the most of open source, get an open network that lets analysts contribute their own material. Put all of your analysts onto one large network instead of letting them work on lots of small ones. Hire some developers and familiarize them with the analysts’ information problems. Then, set them free and let them experiment.

Thanks to DanF for the pointer on the Iran story.

Categories: Essays, Featured

DC’s Apps for Democracy: Helping Coders Help the Man (with one small complaint) » « Who Is This Biden Character?

12 Comments

  1. This is one of the best blog posts I have ever read about the reasoning behind and process of OSINT.

  2. “The newspapers were paying attention to photos, the broadcasters were paying attention to video, and neither of them were watching the Web.”

    The real strength of new media will be exactly what you point out: Open, fast, cooperative. And these are exactly the things that are keeping old media from changing. The old way is systems running humans. The new way is the opposite.

    I found your post via Jay Rosen. Glad I did.

  3. Nice post. I agree that anything that can be crowdsourced by the public, should be. I guess the problem is that no one wants to admit what they are looking at and so won’t publish proof that something is of interest (even though in some cases it should be obvious).

    The example about the old classified imagery – declassifying and slapping an unclassified sticker on it does not make it open source, it just makes it unclassified. Putting it in a public library or on the web would make it open source.

    Cheers!

    You are right, Kirby. I’ve modified that part a bit to emphasize the distinction between unclass and OSINT. –Matt

  4. I am looking for some idea and stumble upon your posting :) decide to wish you Thanks. Eugene

  5. Good article, thanks. On another note, is anyone here familiar with a good “Talent Pool” source whereby I can find and review resumes of current Open Source Intelligence Analyst talent who are seeking work? I would be elated to know of such a source. Please feel free to contact me directly at scott.bruno@intrawork.com.

    V/R

    S. Bruno

  6. magnificent submit, very informative. I wonder why the
    other experts of this sector do not realize this. You must continue your writing.
    I’m sure, you have a huge readers’ base already!

  7. It’s amazing for me to have a site, which is useful in support
    of my experience. thanks admin

  8. That is a really good tip particularly to those fresh
    to the blogosphere. Simple but very accurate info… Appreciate your sharing
    this one. A must read article!

  9. I don’t know whether it’s just me or if everybody else experiencing issues with your site.
    It seems like some of the written text in your posts are running
    off the screen. Can someone else please provide feedback and let
    me know if this is happening to them too? This might be
    a issue with my web browser because I’ve had this happen previously.
    Kudos

  10. I think you would enjoy reading “Human Intelligence: All Minds, All the Time” Robert Steele, Strategic studies institute. He discusses tasking the National Gaurd to operate local intelligence fusion centers that promote public participation.

    I think harnessing the collective intelligence of the public is going to be crucial for national security from here on out, We’ve entered the 7th generation of warfare, 24/7 engagment with primarily non-state groups in 183 languages. One does not need to get a team together in which experts from every domain of human endeavor is present. There is already one, our species.

    I am interested to see how the clunking machine of public administration is going to adapt. The world changes at breakneck speed now, and it makes changing item policy almost pointless. By the time anything is finally ok’ed, the issue that the change was to address is either no longer relevant, or it has evolved. I think for the US, very ‘radical’ infrastructre level policy must be adopted, and put into place.

    This reason above, I believe, is a major contributing factor to what the QICR 2009, 2015 refered to as “a shrinking talent pool”. The IC is competing against Google for talent. There is nothing exciting, nor excusable, about bureaucratic delay.

  11. You should be a part of a contest for one of the most useful blogs on the internet.
    I’m going to highly recommend this web site!

Leave a Reply to Eric Mathis Cancel reply

Your email address will not be published.

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Copyright © 2017 Matthew Burton

Theme by Anders NorenUp ↑