WARNING COURSE - III

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP91B00776R000500050005-7
• Release Decision: RIPPUB
• Original Classification: S
• Document Page Count: 15
• Document Creation Date: December 23, 2016
• Document Release Date: October 23, 2013
• Sequence Number: 5
• Publication Date: August 11, 1983
• Content Type: MISC

Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
AUG 1983
Warning Course - III
Scope Notes
I. Warning Structures and Vehicles
a. Informal Warning Structures
Warning is often accomplished and usually assisted by the
informal networks and associations that exist within and across
the agencies of the intelligence community. These constitute
the informal warning system which functions most importantly
in crossing the institutional synapses of the warning system.
The vehicles, manner of operation and strengths and weaknesses
of this system will be treated.
b. Institutional Warning Structures
The more familiar components of the warning system are
the horizontal and vertical control mechanisms within agencies,
the analytical centers and the alert centers which perform
within the system. This section will address the alerting
systems that energize the agenciesp the vehicles that convey
the warnings from institution-to, .institution; their issue
handling modes; and provide examples of operations.
The discussion of handling modes is an analysis of system
operations from an external standpoint. Mainstream handling
literally includes physical changes in work arrangments, locations
and so on, all of which send a signal to the receiver of warning.
Handling by exception sends its own signals, usually in the form
of alternatives to the mainstream point of view or assessment.
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
L6-22. 4,e tal kameI I
c. The National Warning System - 1983
This presents our latest understanding of the national
warning system, its purposes, prime directives, players and
concepts. As in the past, the national system is confederal
rather than unitary or centralized. Unlike the past, no single
analytical entity ( National Indications Center or Strategic
Warning Staff) is responsible for warning, but every agency is4
The subject matter of warning is not just war, but any threat
to the US, its persons and its interests. The targets for
monitoring potential threats are no longer the communist countries
1. The Director of Central Intelligence is the
PreSident's top warning officer. The National Intelligence Council
provides the DCI with substantive analytical support and
an ability to integrate analysis from within the various agencies.
The NIO for Warning is the system's mechanic, working on the process
of warning more than the substance.
2. 2. The component agencies are responsible for warning
their own audiences or constituencies, whereas the DCI and the NIC
,
provide the whole community outlet for warning. DOD continues to
have special responsibility for tactical warning.
3. Each alert center fits into its own agency's warning
structure. Generally alert centers provide trip wire services
and safeguard against surprise for their respective consumers.
4. The key objective of both institutional and informal
2
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
CPT
C
warning systems is to achieve a high degree of reliability.
How the systems look is less important than how well they work.
5. Current and estimative intelligence often prdVide warning,
buth they serve many other purposes as well. Warning is
exclusively devoted to coping withharm, one of many topics in
current and estimative intelligence. When they deal with
harm, they are actually providing warning. Warning also
has distinct purposes, practices, processes and concepts,
which mandate that analysts in other-fields of intelligence
receive training for effective warning.
II. Cognitive Process -- the psychology of warning
a. Definitions and Terms
These include the DCID statement about warning ( ...includes
measures taken to avoid surprise), the classical terms
strategic and tactical warning, and new terms warning of war,
warning of attack and warning of developing crisis. The
pivotal definition linking warning in all areas is,
warning is a communication of a'judgment about harm conveyed
clearly to a decision?maker in sufficient time to deteri,
avoid contain or cushion the impact of the harm.
b. Warning Phases
Psychologists have identified and defined six phases in
a warning episode. These are recognition that a harm exists;
3
CRT,
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
? ,;
4432? gym
RET
validation that it is genuine i definition of its components
(nature, gravity, probability, timing, direction, and duration
of the harm); communication of these judgments to the
persons capable or charged to cope with the harm; their
independent evaluation of the situation by means at their
disposal; finally action steps to deal with the harm.
The phases are not sequential, but actually near
simultaneous, repetitive, interactive and continuous. Additionally,
they proceed simultaneously within the intelligence and
policy/decision-making arms of the-government, which
influence each other.
c. Evidence
Most treatments of evidence deal with the collection sources.
This is often misleading as to the probity and diagnostic
value of the information conveyed by the collection source.
This treatment establishes the standard of evidence as that
required in Tort Law: evidence sufficient to induce a
reasonable person to take prudent-precautions under the
circumstances. The circumstances. include ambiguity of the
information, risks, costs, time and opportunities for action,
action choices available and situational considerations.
The Law of Evidence contains rich examples of the kinds
of inferences that may be drawn safely from particular kinds of
evidence. For the purposes of analysis, as opposed to system
management, these examples are instructive, if not enlightening.
An important rule is that the more filtered or handled the
4
Ar'-76E7M
LS:441
Fl
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7 ?,
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Ltizi ,Ibarr.. Atm; ?
information is, the less reliable are the inferences that
may be drawn from it.
d. Probabilities
This portion of the course must TEACH (not familiarize)
the difference between impact and likelihood.
Types of events--independent, dependent or mutually.
exclusive--must be defined and illustrated so a person can
identify the appropriate probabilistic rule (formula) to
apply in calculations. Marginal probability of a single
event must also be mastered, followed by joint probability of
MP.
more than a single event. This is in two forms: the and
form as well as the or form. After these forms have been
mastered, conditional probability is undertaken.
The relationship between logic, math and probability
diagrams (tress) must be used throughout. Finally, the
implications of new information and how the news changes
a priori probabilities must be mastered. (Bayesian
probability)
e. Uncertainty and False Alarms
e
The following probability matrixmust be developed in terms of
the sixv factors listed under "Phases".: gravity, probability,
nature, duration,timing,direction of ham. It is important to
distinguish which factors failed in a warning assessment because
the warning is no longer a false alarm but a near or remote miss.
The important message Of a warning is vigilance not reassurance.
5
rs'n F7).
?10 LMIST
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Mixing the signal leads to a breakdown in credibility which
is reinforced by failure to distinguish between false alarms
and misses.
REAL WORLD EVENT
; .HAPPENS : DOESN'T HAPPEN:
........
?
:Analyst says it:
HERO CRYs FOX
:will happen
:Analyst says it:
:will NOT happen:
... .
DUMMY OK BUT NO
CIGAR
When warnings are early, usually information is ambiguous.
This does not mean that no action is possible or desirable.
Quite the contrary. At this point thearray of harm-handling
measures is broad, the costs of action low, margin for
error is large and so on. Once information becomes unambig-
uous, the costs rise, opportunities diminish and many are already
lost, and the margin for error is very, small. Harm is not
avoided even though surprise may be. Early harm-handling actions
are reasonable when they reflect the circumstances of
ambiguity, are intended to clarify that and also deal with
the harm as it is known at the time. The tradeoffs must be
6
C:Zt
RET
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
fr 17F4Y"'K-4)
4,4,0
understood.
III. Analytical Techniques
a. Traditional analysis approaches
The analysis of intelligence problems is approached from
the perspective of the amount of information available to
reach the correct conclusion. The methodology to be used by
the analyst must match the degree of uncertainty, in the avail-
able information.
Case 1 -- Complete information is extant.
The proper technique to be used involves logical processes.
This is essentially a series of structured facts.
Case 2 -- Incomplete information exists,
but what is extant is sufficient to be treated with probabil-
istic techniques. This involves understanding the probabilities
for both discrete and for continuous events, and the application
of some form of parametric or nonparametric hypothesis testing.
Case 3 -- Sparse information exists, but it
treat with probabilistic techniques. This
is insufficient to
requires the analyst to rely on,individual or group expertise
and the way probability diagrams can help focus on outcomes.
b. Role of assumptions and biases
This section draws on the work done,by:Heuer, Jervis
and others pointing out that analysis may be faulty owing
to problems in cognition -- how mental processes work;
7
C
ET
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
conception what they work on abstractly; perception --
what they work on as reflected from reality; and expectations --
what a person thinks will occur before it occurs. Eaph of
these factors are in turn influenced by group and organizational
dynamics, cultural factors and so on. In so far as these
create for a person a system that predicts reality well
and provides meaning to it, they are in stable balance.
A system that fails to incorporate reality-checks is flawed
for intelligence work.
c. Indications analysis
The US intelligence community has developed an inferential,
indirect technique which it dignifies withe the name, "indications
intelligence." This technique attempts to ascertain the nature
and timing of hostile intentions and capabilities from the
observed actions whibh.have as their common purpose the
readying of a hostile country for hostilities. Its basic
assumptions are that national behavior ultimately must
disclose both intentions and capabilities, manifest in observable forms.
A key tool in indications analysis is the indicators list.
- ,
This represents a synthesis of learning about the behavior of
a nation, usually its armed forces, as well as a check list
of the types of behavior to expect in a 'crisis or prior to
a war. It is an essential tool of inductive analysis based
on indications. Indicators tend to be abstractions from the real;
indications are their real counterpart. A good analogous type
of analysis is performed'by doctors assessing symptoms.
8
rcpETj
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23 : CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
.17
DIA,CIA and NSA1 have each developed their own variations
of this analysis technique.
d. Looking for Decision points
This is essentially a combination of influence diagramming
and decision theory. The analyst must be taught to construct
a series of cause-event inluential relationships and to display
them graphically. An analysis of the known events and of
inferred events will permit some form of reasoning, either
Bayesian or Treeing, and the sensitivity testing for guessing
(used to fill gaps in the diagram). This will disclose
certain decision points that must be reached for some activity
to transpire. The decision nodes are then treated inferrentially.
e. New Frontiers
Among the new frontiers in warning research, either
in predicting outcomes or intentions and capabilities before
outcomes, are Expected Utility Theory from the University of
Rochester; Catastrophy Theory; and Tree Analysis, usually
Bayesian. Some attempt to employ.these techniques will be
,
offered. Additionally some exposure to Expert Systems in
the field of artificial intelligence will be presented.
An initial effort at Fault Tree Analysis, akin to automotive
or medical diagnostic procedures, will be available for review.
The theme of this section of course work is to open an
analyst or mid-level decision-maker to the variety of
9
ram gpV,
4641 1.111.M
ET
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
(-5 r-7-1777,171
.1 -I LI= I
-
techniques and the richness of research now available
for application to real world problems. Facility in moving
among these techniques as well as in incorporating them
into routine analytical habits will improve the credibility
of the intelligence product.
IV. Warning Lore -- the lessons of US experience in warning
a. Deception and Security
Deception is a distortion of reality as perceived. It may
be divided into dissimulation -- hiding what is real; and
simulation -- presenting what is not real. In each rsubdivision
are physical and conceptual branches. The most sophisticated
deceptions are those that are simple enough to be believed;
mounted when the deceiver holds the initiative; are well-
prepared over a long period of time; and aim to achieve a
large measure of surprise. The aim of all deceptions
is to induce the wrong decisions by the top leadership of
the target. Lesser but acceptable-aims are to mislead or
confuse that leadership. All successful deceptions require
a feedback channel, either human,or technical. The most
reliable safeguard against deception is a reality check for
consistency and congruence between words' and actions. Such
tests are more easily spoken of than applied.
b. Other Lessons Learned
This is a compendium of the US warning experience as
10
ttai, LLIM!
ET
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
SECRET
influenced by crises. For example,
-- nations plan early and prepare carefully for
???
41.
hostilities; wars hardly ever happen by chance, accident
or drift;
-- military actions are usually the latest of the actions
a nation takes to prepare for war. They come well along in
the decision-making process;
-- measurements of capabilities are not especially valuable
either as measurements of true capabllities, or as reflectors
of intentions. Capabilities are not as self-evident and "concrete"
as most analysts presume;
-- failures in warning have almost never occurred because
of technical failures or the absence of information owing
to poor collection. Invariably they have been failures of
judgment. -
-- Others
b. Decision-making
Decision-making has been analyzed from many vantage points.
Among analysts there is a tendency to assume conscious
value optimizing choices. This is a Greek model reinforced by
Euclidian logic and mathematics. An alternative, equally
'predictive approach is that optimizing choices flow after
action has begun and initial consequences weighed. The
fotmer is intentional or premeditative. The latter includes
negligent behavior and contingent intentions.
11
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
There are many analysts who also assume the primacy
of individual rational actors. This minimizes the role
of large bureaucracies in mitigating decision-making and
mediating decision-making's contact with reality.
Finally decision-makers are often spoken of and
written about as if unitary role players. In fact, the roles
and information needs of decision-makers are as complicated
and manifold as people working in intelligence. Warnings
may stray when they ignore the role diversity of the
decision-maker.
?
AP
V. Sources of Information
a. What to expect from each collection discipline
Reliable and accurate human source reporting remains
the most vulnerable to deception yet the most valuable source
of information as to intentions,plans, and resolve to act, etc.
Signals Intelligence has the advantages of its technical medium
as a safeguard against error, but'is still subject to
human manipulation of the information conveyed . The more
technical branches of SIGINT provide more reliable information
about their specialties but become far removed from motivation ,
intentions and other peculiarly human characteristics of action.
Imagery is invaluable but subject to four inferences:
what is observed has been observed surreptitiously and is accurate;
that which is imaged was deliberately permitted to be imaged;
12
1 (r.i v'' ? #' ' '''
-'7,-:.... s'-'1 .s. Aqi la, isil
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
r.'"616's
dxA !"4
zoom I
the item was too large or extensive to be hidden; the item
was such that the target didn't care whether it was imaged
?
or not.
Analysts need to learn the advantages and disadvantages
of each collection source andhow to read the product of each.
b. Quo vadis technology?
Technology is rapidly leading towards an era of instant
and disposable analysis. Machines don't make better warning;
they make better analysts, who make better warning.
This section would also treat the tremendous, mind-expanding
increases in analytical capability that new machines make
possible. This expanded capability imposes its own demands
and burdens on analysts and on the intelligence community.
On the Other hand, decision-makers can become ensnared by
the information potential machines provide. The balance
is delicate, evolving and often far from clear.
VI. History of US Warning
This portion of the course would build upon materials
already compiled around the training institutions of the
community. NSA has some films on the history of cryptanalysis.
NWS has some films on the history of the warning community
itself, featuring
of the NIC. DIC has 25X1
other materials. One portion of this topic would inalude
dicussion of community performance in recent crises --
13
?;?1'.;:1"..;
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7
AP
- crr'n r":773
r.-73 fr"4' . t;
U
VII. Discussion of General Warning Subjects
a. Past Viewpoints
This topic deals with what has been tried by the US Government
to achieve reliable and responsive warning. False starts
include organizations, substantive areas of concentration and
gimmicks.
b. Current Theories
These rapge from Betts' "intelligence failures are inevitable"
to DCI's "no surprise." The better theories stress that
understanding how we know that we know provides a hopeful
vision of warning analysis.
Each agency in the community has its own characterization
of warning, including who does it within that agency and
what the warning element will do. These variances constitute
the poles of operational theory in intelligence.
Specific issues include the need for and role of
community warning products; the need for coordination;
the role of alert centers, the roles and' actions of mid-level
managers and the effects of products.
The community, for example, does not control its behavioral
signals which tend to contradict its substantive messages.
The volume and repetition of production destroys the
vigilance message which is the substance of warning.
Community treatment and discussion of false alarm erodes
confidence in the customers of intelligence warning.
(-
14
e ,
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91600776R000500050005-7
25X1
25X6
Declassified in Part - Sanitized Copy Approved for Release,2013/10/23 : CIA-RDP91B00776R000500050005-7
'?7t:1; V,,,m21 Ls!: eitaza g
There remains a need for a community warning vehicle.
One aspect of such a vehicle is to avoid making every problem
so familiar as to frustrate warning, because of conditioning.
Finally, our systems need to be conscious of the need for
consistency and congruence, even on a day-to-day basis.
c. The DCI's views
This is a forum for the DCI or the NIO/W to present
the viewpoint of the DCI.
15
fr.77-fr"r-.:1
Declassified in Part - Sanitized Copy Approved for Release 2013/10/23: CIA-RDP91B00776R000500050005-7