Vienna International Centre, P.O.

Box 500, 1400 Vienna, Austria

Tel: (+43-1) 26060-0, Fax: (+43-1) 26060-5866, www.unodc.org

Guidance on the preparation and use of

serious and organized
crime threat assessments

Printed in Austria
The SOCTA Handbook
V.10-54768—July 2010
 UNITED NATIONS OFFICE ON DRUGS AND CRIME
Vienna

Guidance on the preparation and

use of serious and organized
crime threat assessments
The SOCTA Handbook

UNITED NATIONS
New York, 2010
Foreword

This Handbook provides guidance to make organized crime threat assessments. It helps
practitioners identify the risk factors, crime types, perpetrators and their collaborators.
The methodology is designed to generate the information and analysis needed for
­intelligence-led policing and evidence-based policy.

Such assessments are badly needed. In the United Nations system, there are more than
100,000 “blue helmets” (peacekeepers), and more than 10,000 blue berets (police). But
there are only a handful of practitioners with expertise in dealing with organized crime.
This is a major handicap since organized crime—like the trafficking of drugs, weapons,
natural resources or people—is an impediment to almost every United Nations peace-
keeping and peace-building operation, from Haiti to Timor Leste, from Afghanistan to
the Democratic Republic of Congo.

Many national governments are also unprepared or ill-equipped to deal with organized
crime. By using this Handbook, they will create the intelligence needed to diagnose
the severity of the situation, target the necessary resources to the right areas, and take
remedial action to stop it. Furthermore, the very process of preparing such assessments
can strengthen inter-agency cooperation and raise organized crime up the political
agenda.

My thanks to the experts who have compiled this Handbook. I urge you to apply its
good practices in order to prevent and control organized crime.

Antonio Maria Costa

Executive Director
United Nations Office on Drugs and Crime
Vienna—August 2009

iii
Foreword

Every day, police chiefs throughout the world are required to make critical decisions
that directly impact upon the safety and security of the citizens they have sworn to
serve and protect. More often than not, the resources that police have at their disposal
to pursue their essential mission are outweighed by the very real dangers posed by
­serious transnational crime and terrorism.

Having a clear set of priorities and allocating resources soundly is key to effective
­policing, especially in an increasingly globalized world. As the introduction of this
Handbook points out, most forms of serious crime nowadays have a global reach and
are increasingly complex, which in turn leads to ever-advancing intelligence needs on
the part of police.

As the Secretary General of a global police organization comprising 187 member coun-
tries, I have come to understand not only the vital importance of producing professional
threat assessments to drive effective actions and deliver sustainable contributions to
security, but also the difficulty in undertaking such assessments.

The SOCTA Handbook is an excellent initiative, and will become an essential resource
for senior decision makers, managers, analysts and police chiefs worldwide.

I am very pleased, on behalf of INTERPOL, to thank the authors and experts for their
contributions to this handbook and will recommend it to police forces across
the globe.

Ronald K. Noble
INTERPOL Secretary General

v
Preface

This Handbook by the United Nations Office on Drugs and Crime (UNODC) on how
to use and prepare serious and organized crime threat assessments was made possible
thanks to the active support and contributions of dedicated professionals of Member
States of the United Nations, of international and non-governmental organizations and
academic institutions, including:

Mohammed Arshad, Transnational Crime Adviser, Standing Police Capacity Police

Division, Department of Peacekeeping Operations at the United Nations;
The Australian Federal Police;
Robert C. Fahlman, Director General, Criminal Intelligence, Royal Canadian Mounted
Police;
Jim Finckenauer, Professor, Rutgers University, United States of America;
The Australian Crime Commission;
Lo Mung-hung, Chief Superintendent, Criminal Intelligence Bureau, Hong Kong
Police;
Kate Pearce, Head of Analysis, National Policing Improvement Agency, United
Kingdom;
Georgios Raskos, Criminal Intelligence Officer, Interpol General Secretariat;
Peter Allan, Europol;
Manfred Rupp, Analyst and Head of the subdepartment for strategic analysis, Criminal
Intelligence Service, Austria;
Alexander Stoyanov, Centre for the Study of Democracy, Bulgaria;
John Abbott, Consultant.
Karen Kramer, Senior Expert, UNODC.
Mark Shaw, Chief, Integrated Programming Unit, UNODC; and
Andrea Wotjak, Crime Prevention Expert, UNODC.

vii
Contents

Foreword by Antonio Maria Costa, Executive Director, UNODC . . . . . . . . . . iii

Foreword by Ronald K. Noble, INTERPOL Secretary General . . . . . . . . . . . . v

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
A. Objectives of this Handbook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
B. How to use this Handbook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
C. Glossary of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

PART ONE
What is a serious and organized crime threat assessment (SOCTA) and
why is it an important organizational policymaking and management tool? . . . . . 5
A. Why is there a need for a SOCTA? . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
B. What is a national SOCTA? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
C. Key elements to consider when commissioning a SOCTA . . . . . . . . . 8
D. Using a SOCTA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
E. Part one—checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

PART TWO
How to prepare a SOCTA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
A. Preparing a SOCTA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
B. Planning and tasking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
C. Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
D. Processing and evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
E. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
F. Production (“and now the SOCTA“) . . . . . . . . . . . . . . . . . . . . . . . . . 33
G. Dissemination and feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
H. Part 2—checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

PART THREE
Training for preparing and using a SOCTA . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

ix
Annexes
  I.  Example SOCTA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
II.  Analytical approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
III.  Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

x
 INTRODUCTION

A. Objectives of this Handbook

The principal objective of this Handbook is to assist policymakers and managers

to make better decisions about the response to serious and organized crime by
providing a model and guidance for undertaking a national serious and organized
crime threat assessment.
The Handbook also seeks to assist government policymakers, law ­enforcement leaders
and managers, and practitioners:
"" To recognize the benefits of undertaking national serious and organized crime
threat assessments;
"" To appreciate the importance and value of establishing an ongoing system for
commissioning, reviewing and acting upon regular serious and organized crime
threat assessments—particularly to enable them to develop and deliver more
effective strategies to tackle serious and organized crime (both nationally and
locally);
"" To understand the key stages of constructing and developing a national serious
and organized crime threat assessment; and,
"" To identify the key elements of a training programme to be used to support
the development of a national serious and organized crime threat assessment.

B. How to use this Handbook

This Handbook is designed to be of assistance to policymakers in government, to leaders

and managers in law enforcement agencies and other agencies both in the public and
­private sector whose activities are affected by serious and organized crime, and by
­practitioners responsible for developing serious and organized crime threat assessments.

Part one of the Handbook is directed principally at policymakers, leaders and managers
and seeks to explain what a serious and organized crime threat assessment is, the
1
2 Guidance on the use and preparation of serious and organized crime threat assessments

rationale for undertaking a national level serious and organized crime threat assessment
and the ­implications of doing so. It also touches upon the resources and skills required.

Part two of the Handbook is aimed primarily at those charged with undertaking a
national serious and organized crime threat assessment and outlines a recommended
metho­dology to be adopted from the start point of identifying the task and agreeing
the terms of reference, through the various stages of developing the assessment to the
production of the document and its dissemination.

Part three outlines a suggested training package to assist with the undertaking of a
national serious and organized crime threat assessment. The Handbook also has a
number of ­annexes to assist readers.

A short training programme before starting is regarded as essential for reaching a

­common understanding on both terminology and expectations from all involved in the
process as well as for team building.

C. Glossary of terms

It will become apparent when working through this Handbook that certain terms­
frequently appear and some of them are noted below. It should be recognized that the
meanings attributed to these terms should not be taken as the only meaning as national
legislation, context and culture may well provide alternative meanings. They are given
for guidance only.

Term Meaning
Analysis Analysis is the process of collecting, reviewing and
interpreting a range of data and making inferences and
recommendations.

Analytical techniques Methods with which to examine information for a given

purpose.

Intelligence Information that has been assessed for a given purpose.

Intelligence cycle A model detailing the phases that drive analytical output
including: Planning and tasking—sets the objectives and
scope of the task; Collection—gathers information relevant
to the task; Processing—organizes material in a logical,
useable form; Analysis—evaluates and analyses information
to develop inferences, identify intelligence gaps and provide
recommendations; Dissemination—effectively communi-
cates the outcomes of analysis based on the initial task.
INTRODUCTION 3

Intelligence-led policing A business model where data analysis and crime intelligence
are central to an objective, decision making process that
facilitates crime and problem reduction, disruption and
prevention.1
Key findings Critical issues identified and highlighted for action.
Law enforcement All agencies with a remit to enforce any part of the law
including the police, customs, immigration, border control,
financial regulators and anti-corruption bodies.
Organized criminal group A structured group of three or more persons, existing for
a period of time and acting in concert with the aim of
­committing one or more serious crimes or offences as
defined in the United Nations Convention against Trans­
national Organized Crime, in order to obtain, directly or
indirectly, a financial or other material benefit.
Policymaker Government Ministers, politicians, officials in government
departments and leaders of organizations who have a
responsibility for setting strategy and direction, the creation
of objectives and the allocation of resources.
Private sector Persons and organizations not using government funding,
usually retaining any income for private use.
Public sector Persons and organizations working on behalf of the
­community, usually funded by government.
Recommendation Suggested course of action to address previously identified
issues.
Serious crime Conduct constituting an offence punishable by a maximum
deprivation of liberty of at least four years or a more­
serious penalty.
Situation report A product describing the current state of affairs.
Terms of reference (ToR) Terms of reference should capture the tasking and define
the scope and research methods for a piece of analysis.
Threat Some person or group of people with the intention and
capability to cause harm to the state and society.
Threat assessment A product that through an agreed methodology provides
analysis and guidance for action on tackling the issues
­identified that may cause harm to the state and society in
the future.

1
  There are many different explanations of “intelligence-led policing”. This one is based upon the one expounded in
­“Intelligence-Led Policing” by Jerry Ratcliffe (2008), page 89.
 PART ONE
What is a serious and organized
crime threat assessment (SOCTA) and
why is it an important organizational
policymaking and management tool?

A. Why is there a need for a SOCTA?

1. Serious and organized crime is a significant challenge for all governments. It is not
only a challenge in its own right by undermining personal and state security, but has
the potential to impact upon other critical areas of human security, be they social,
political, economic or environmental.2 It threatens safety, stability and development—at
the level of the individual, in local communities and nationally (and, of course,
transnationally.)

2. Many aspects of serious and organized crime have a global reach—for example,
drug and people trafficking, fraud and money-laundering. But their activities also have
a major impact on individual countries and in local communities, where the victims
and perpetrators originate and where the “goods” are made, transit, taken, sold or used.

3. The complexity of serious and organized crime is also increasing and changing with
new opportunities for criminals constantly evolving, often assisted by developments in
society (such as globalization and advances in technology).3 New routes are being used
and new methods of operation are regularly identified and implemented. Criminal
activity is more flexible and more dynamic than before—change is a constant activity
for serious and organized criminals. And understanding how serious and organized
crime operates is made more difficult by the covert nature of most of its activities—the
criminals do not want to be caught!

4. But understanding the scale and impact of serious and organized crime (how crimi-
nals are operating and the effect of their activities on communities and government),
and identifying and implementing effective strategies to minimize their criminal
activities, is absolutely essential for there to be a national response. This is a major
challenge for all countries. In some countries there may be a shortage of information;
more frequently there is too much information but it is disorganized or inaccessible,

2
Trends in Crime and Justice, 2005 (UNODC/UNICRI)—“The evolving challenge of transnational organized crime”,
pp. 25 to 54.
3
Op. cit., p. 27

5
6 Guidance on the use and preparation of serious and organized crime threat assessments

or not “joined up”, with individuals, departments or agencies unwittingly failing to

share it with others (“do we know what we know, and what we don’t know?”). In most
countries there are usually several agencies with responsibility for preventing and investi­
gating various aspects of serious and organized crime; arranging these activities to avoid
duplication and ensure maximum coordination, impact and value for money can be a
challenge.

5. The implementation of a national threat assessment process and the production of

a national serious and organized crime threat assessment (a “SOCTA”) will provide a
better and broader understanding of the challenges posed and the modus operandi
being used by criminals at a stated period of time. It is essential to understand the
overall picture of the threats and harms posed by serious and organized crime, their
impact (internationally, nationally and locally) and how they are changing and develop-
ing. Equally importantly, it will improve the response to serious and organized crime
by helping to identify priority issues for action. It will also enable more effective and
coordinated strategies to be developed and implemented to better prevent and investigate
serious and organized crime. It will allow the government and law enforcement agencies
to get on to the front foot in tackling serious and organized crime, with a greater
opportunity to make communities safer and increase public confidence.

6. The development of serious and organized crime threat assessments is, therefore,
beneficial for a number of related reasons as they:

"" Enable the government to more effectively protect the state and its people
from the effects of serious and organized crime;
"" Institutionalize procedures in which information on serious and organized
crime can be more systematically collected, assessed and published;
"" Are a crucial government and organizational policymaking and management
tool to identify priorities and guide decisions as to the allocation of
resources;
"" Will identify effective actions in terms of better prevention, intervention and
partnerships;
"" Are excellent monitoring tools when produced regularly;
"" Provide a foundation on which other information and intelligence tools (for
example the requirements for future criminal intelligence collection) can be
built; and,
"" Make an important contribution to a higher degree of transparency and pro-
vide a forum to involve relevant stakeholders (such as, for example, business
groups and community leaders) in debates as to how serious and organized
crime can be effectively countered;
"" Provide a mechanism for promoting collaboration and cooperation across a
range of public and private sector organization stakeholders.
In short, implementing a national SOCTA process improves knowledge, assists
decision making, improves the use of limited resources and drives action.
Part one What is a SOCTA and why is it an important tool? 7

B. What is a national SOCTA?

Figure 1. The SOCTA pyramid

SOCTA

Analysis

Situation report

Relevant data in national context

7. Conducting a national serious and organized crime threat assessment is a process

to help decision making. It will describe and assess the threats posed to a country now
and in the future from the whole range of serious and organized crime activity, identify
gaps in knowledge and the intelligence requirements to fill those gaps, and make
recommendations about the threats identified.4

8. So a serious and organized crime threat assessment establishes a better understand-

ing of the picture of serious and organized crime in a country and how it may develop
in the future. This includes understanding the impact within the country of serious
and organized crime activity occurring or initiating outside the country. It covers the
whole range of serious and organized crime activity, not just a particular commodity.5
It is about various criminal markets and sectors—the activities of serious and organized
crime—and about the membership and structure of criminal groups involved in such
activities. It is about using and interpreting both quantitative and qualitative data to
describe serious and organized crime activities, and to assess their threat to the country,
the extent of the risk they pose and the level of harm they cause both now and poten-
tially in the future. This is the “big picture” and is forward looking. It will, of course,
draw upon information identified in operational reports but will not usually go into
the detail of individual suspects (a SOCTA is usually described as a “strategic” product,
rather than a “tactical” product).

9. A serious and organized crime threat assessment is more than a situation report.
A situation report is the drawing together of various data without the subsequent analysis

4
Different examples of SOCTAs OCTAs and other law enforcement reporting can be found by visiting the following
websites. www.europol.europa.eu/index.asp?page=publications&language= {Europol} www.soca.gov.uk/assessPublications/UKTA0809.html
{Serious Organized Crime Agency, UK} www.page2007.com/dni_2008.pdf {Central Intelligence Agency, USA} www.rcmp-grc.gc.ca/
es-ae/2007/enviro-scan-analyse-2007-eng.pdf {Royal Canadian Mounted Police, Canada}.
5
It should be noted that although the intention is to have one national assessment of the total organized crime environment
this process can be used to address particular organized crime issues including markets, sectors and groups. These assessments could
still support the production of the national SOCTA.
8 Guidance on the use and preparation of serious and organized crime threat assessments

and interpretation. It will provide an overview of what has happened but does not
include the forward look. A situation report is helpful but not as valuable to policy-
makers and managers as a serious and organized crime threat assessment.

10. This Handbook is focusing upon the development of a SOCTA at national level.
In many countries such threat assessments are also developed regionally and/or locally
(perhaps focusing upon a city, region or other defined geographical area), by individual
agencies for internal use and on a “commodity” basis (for example examining the impact
of drugs trafficking or corruption in a country). These more specific assessments are
extremely valuable when putting together the bigger picture in a national serious and
organized crime threat assessment.

C. Key elements to consider when commissioning a SOCTA

11. Of prime importance when commissioning a SOCTA is to decide who is actually

going to produce the document. There are a variety of options. In some countries there
may be a specific agency with such a responsibility (for the collection and analysis of
criminal intelligence), or an existing agency which can be identified and tasked to
undertake this work because of its role in preventing or investigating serious and organ-
ized crime. It has been suggested that an “external” agency, apart from traditional law
enforcement may be well placed to undertake this work, such as an independent “watch-
dog” authority or an academic institution. Ultimately, this is a matter for national
choice.

12. There are some other key elements that have to be considered when a SOCTA
is being commissioned. One of those is the resources that will be required. Ideally there
will be a small team including a supervisor and two or three analysts or researchers.
This team should have easy access to—and work in close cooperation with—operational
law enforcement officers. Preferably the team members will be trained criminal ana-
lysts—but if not they need to be individuals who are objective, with creative minds,
critical thinkers and good writers. It is an excellent idea to have a “champion” for the
SOCTA whose crucial role is to promote the SOCTA. A good SOCTA will take time
to produce and six months should be set aside to allow for its completion.

13. The physical location of this team should be considered and appropriate office
space, with meeting rooms that are regularly available, should be supplied. The type of
office equipment including computers, card systems, secure storage, etc. has to be agreed
along with a small budget for travel.

14. The need for training, both for managers and analysts should not be overlooked
and part three of this handbook lays out a possible training programme that could
assist in filling any training gaps. This training highlights how to construct a SOCTA
but also why it’s a useful tool and how policymakers, leaders and managers can get the
most from a national SOCTA.
Part one What is a SOCTA and why is it an important tool? 9

D. Using a SOCTA

15. The principal reason for undertaking a national serious and organized crime threat
assessment is to provide valuable, accurate and timely information to policymakers and
managers about the nature and scale of the challenges and how they may develop, to
help them make better decisions about how to tackle serious and organized crime. This
includes making decisions about priorities for action, identifying preventive and inves-
tigative opportunities and allocating resources. So a SOCTA is something to be acted
upon.

16. The production of the serious and organized crime threat assessment needs to fit
into the business planning cycle adopted by government and law enforcement agencies
so that decisions about priorities, activities and resourcing emanating from the SOCTA
can be implemented. The implementation of these decisions also needs to be reviewed
and monitored.

17. Each country will need to decide who owns the SOCTA process and ensure that
there is a clear understanding amongst all the partner organizations. Membership of
the commissioning body needs to be as broad and inclusive as possible—many agencies
have information about serious and organized crime, and have a role in preventing and
investigating it. All partners to the process should be encouraged to remain active par-
ticipants throughout the production of the SOCTA thereby maintaining meaningful
stakeholder involvement.

18. In some countries this is achieved by a high-level, government-led, committee

(often chaired by the Prime Minister or Minister of the Interior) which is responsible
for bringing together the key players, commissioning and receiving the SOCTA, acting
upon it and subsequently reviewing progress. These key players will usually include
leaders from all law enforcement agencies, from various government departments, and
possibly from private sector bodies such as the financial sector and academia.

19. So, it is suggested that undertaking a national serious and organized crime threat
assessment needs a clearly defined and well managed process:

"" To commission it (agree the terms of reference and identify the resources
needed to undertake the socta);

"" To assist with and support its production (to help the collection of data and
unblock “blockages”);

"" To receive, consider and accept the completed document and, most
importantly;

"" To act upon the socta (to identify priority activities that should be under-
taken to increase the prevention and investigation of serious and organized
crime, to allocate resources and to assess progress).
10 Guidance on the use and preparation of serious and organized crime threat assessments

20. This high level government committee is likely to be supported by additional

sub-committees, consisting of working level managers from all agencies, to ensure
progress with the threat assessment process is maintained. It will also help in the
development of a culture which encourages information sharing, and inter-agency and
multidisciplinary partnership approaches to tackling serious and organized crime.

21. In some countries the national serious and organized crime threat assessment is
used by government as the initial building block for the identification of objectives and
allocation of resources at the national level. Consequently, it is also important that
leaders and managers within law enforcement agencies understand the value and impor-
tance of a national serious and organized crime threat assessment.

22. Additionally, a national SOCTA is an extremely valuable tool for law enforcement
(and other public and private sector organizations) leaders and managers because it
informs them about the latest trends, and how they may develop. This assists in defin-
ing their selection of priorities and identifies the best means of operating (what works,
and what does not work). In some countries this has contributed to the development
of what is known as “intelligence-led policing” where the importance and value of
timely and accurate criminal information and intelligence is recognized as essential to
effectively tackling serious and organized crime.6 A key element of intelligence-led polic-
ing is about improving the understanding of how criminals operate to enable the most
effective means of prevention and investigation to be adopted. Thus the importance of
threat assessments is central to making these choices.

23. Thought needs to be given to who the document is for. In some countries the
document is a public document. Advantages are that it can be widely circulated to
encourage public, business and media to understand risks of serious and organized crime
and therefore enhance prevention and public safety. A public document will have more
people able to contribute to it as it is not likely to contain any secrets. Some countries
do a wholly confidential document, just for the senior personnel in law enforcement
and the Ministry; others do a confidential version and a public version. Ultimately this
is a matter for national choice but an open version for public consumption is highly
recommended.

24. The SOCTA should not be viewed as a once only document. The process should
be ongoing and the document should be produced on a regular basis—at least every
two years—as the environment changes and criminals develop and deploy new
tactics.

6
Essential because of the covert activity of professional criminals, difficulty in securing evidence and catching the major
criminals.
Part one What is a SOCTA and why is it an important tool? 11

E. Part one—checklist

"" Why create a SOCTA?

"" What are the advantages?
Why

"" How is a SOCTA created?

"" What is needed to produce a good SOCTA?
How

"" What is done with the SOCTA upon completion?

"" H
 ow is the implementation of the SOCTA
What monitored?

1. Does everyone understand the terminology?

2. Do we have the picture of serious and organized crime in our country?

3. Does a SOCTA or its constituent parts already exist?

4. Who is responsible for tackling serious and organized crime?

5. What systems and structures are in place for tackling serious and organized crime,
for example a strategic direction committee or tasking and coordination group?

6. Have SOCTAs from other countries or regions been examined?

7. Who is going to commission the SOCTA?

8. Who will undertake the production of the SOCTA?

9. What resources are required to produce the SOCTA?

10. How will it be used after production?

11. How will the value of the SOCTA be measured, in terms of actionable
outcomes?
 PART TWO
How to prepare a SOCTA

A. Preparing a SOCTA

25. Part two is intended to equip the individual(s) tasked with completing a national
SOCTA with a methodology and step-by-step practical guidance to enable them to
create a useful product. The methodology has to be flexible enough to cope with the
many different needs of each user of the Handbook yet rigid enough to provide a
structured, homogeneous approach. It should be noted that although this Handbook
will supply the background and some detail for undertaking a national SOCTA it
should be accompanied by a training programme ensuring requisite skills are
developed.

26. The methodology promulgated within this Handbook is a synthesis and simpli-
fication of several broadly similar methodologies used within law enforcement woven
into the “intelligence cycle”.

Figure 2. The intelligence cycle7

Planning
and tasking

Disseminate Collection

Analysis and Processing

production

7
www.armedforces-int.com/images/companies/667/infoterra1.jpg

13
14 Guidance on the use and preparation of serious and organized crime threat assessments

The traditional intelligence cycle has five main stages which are used as the basis
for the step-by-step approach in this Handbook for constructing a SOCTA.

Subsequent sections within part two of this handbook will explain each stage of
the intelligence cycle and take the practitioner through the methodology to be
applied to achieve the successful completion of the SOCTA. Planning and tasking
is contained within steps 1 to 3, with Collection covered in step 4. Step 5 examines
Processing with Analysis and Production encompassed by steps 6 to 9. ­Dissemination
is dealt with in steps 10 and 11.

27. The model shown below which has been distilled from various similar approaches
is designed to allow each user of the Handbook the flexibility to utilize different
elements of the model dependent upon the resources available for completion of the
SOCTA.

Figure 3. The SOCTA pyramid

SOCTA

Analysis

Situation report

Relevant data in national context

As highlighted in part one there are many advantages in producing a SOCTA. It is

not, however, easily achieved and requires the compiler to follow a process that puts
the relevant data in a national context. From this understanding a situation report can
be compiled and further analysis with the application of appropriate analytical approaches
will lead to the final SOCTA.

B. Planning and tasking

28. The decision to commission a SOCTA has been taken at a national level and
ideally those who will be involved in the actual production of the SOCTA will have
been party to these discussions. The duty of producing it has been passed on to the
most appropriate agencies/organizations etc. and the most appropriate individuals within
those agencies. It is at this stage that those required to produce the SOCTA begin the
process of defining the task in line with the aims and objectives of the client who
requested the SOCTA. The final wording of the tasking should be agreed to in
Part TWO How to prepare a SOCTA 15

conjunction with the client and this will include agreement on the terms of reference
(ToR) of the SOCTA. The ToR should critically assess the objectives and the environ-
ment within which the SOCTA is being produced. For example, what relevant legisla-
tion exists, who are or should be the main stakeholders, what are the political priorities
and imperatives, what government policy already exists in the area, what management
structures and organizations are involved, what are the community expectations?
Consideration of all these different factors will assist in developing a good ToR.

29. A well defined task leading to a similarly well understood and agreed ToR is a
crucial ingredient of a successful SOCTA. The following gives some guidance on a
method to help ensure these prerequisites are met.

Defining the task, agreeing on the ToR

This should not be conducted in isolation by one individual. It requires a team effort
involving both creative and critical thinking skills. This can be accomplished through
brainstorming.

Step 1—Brainstorming8

30. To assist in task definition one method is to gather a small group of individuals,
with diverse backgrounds, to generate ideas on the given topic. As a minimum this group
should include the analysts, subject matter experts (SMEs) and appropriate
members of the tasking body who commissioned the SOCTA. In this instance the
brainstorming group is “to consider the content for a national SOCTA for country X”.

Requirements for an effective brainstorming are:

"" A room with a flip-chart or whiteboard etc.
"" Approximately 10 people
"" Duration of brainstorming usually limited to no more than 30 minutes

Guidelines for a good brainstorming are:

"" Encourage all ideas, say whatever comes to mind
"" Write down everything
"" Quantity rather than quality
"" Save criticisms for a later stage
"" Keep it fast, furious and short

31. The session involves all participants contributing their thoughts and ideas in order
to generate as wide a range of ideas as possible. An example of what a brainstorming
on the task of “the content for a national SOCTA for country X” might contain is
given below.

8
www.unc.edu/depts/wcweb/handouts/brainstorming.html
16 Guidance on the use and preparation of serious and organized crime threat assessments

Step 1—Brainstorming—example

Heroin Terrorism Human trafficking Arms smuggling

Money laundering Fraud Crime groups Communication

Cybercrime Violence Regions Corruption

Borders Smuggling Car theft Hi-jacking

Kidnap Drug trafficking Homicide Law enforcement

Transportation Politics Cooperation International links

Transit country Identity fraud Migration Synthetic drugs

32. Naturally this list of ideas will be different for every country given their own
particular circumstances and environment. The next step in the process is to discuss
the points raised and to begin grouping them together in a logical fashion. This is done
to bring structure to what has been a deliberately unstructured approach so far. During
this phase some ideas may be discarded and others expanded as the discussions evolve.
The grouped brainstorming data may look like this:

Crime types Facilitating factors Perpetrators National response

Car theft Communication Individuals L aw enforcement
agencies
Drug trafficking Cybercrime Crime groups (national)  ther agencies (gos,
O
ngos, ios, etc.)
Human trafficking Corruption Crime groups Resources
(international)
Homicide Weak borders Regional gangs Cooperation (national)
Smuggling (esp. arms) Money laundering Ethnic groups Cooperation
(international)
Kidnap/extortion Transportation Legislation
Fraud/tax Internet

Step 2—Defining the task

33. At this stage an attempt should now be made to draft an initial task definition
and terms of reference (ToR). This requires the individual(s) charged with producing
the SOCTA to consider the original request from the person or group commissioning
the SOCTA in conjunction with the information and opinions generated by the brain-
storming session. The ToR should include:

"" Who commissioned the report and for what purpose

"" The parameters of the report
"" The methodology and sources used
"" Timescale and any constraints or limiting factors
An example of a tasking definition, including a brief ToR, is given below.
Part TWO How to prepare a SOCTA 17

Step 2—Defining the task—example

34. The objective of this report is to provide a document which details the current
and future major threats posed to {insert country} from serious and organized crime.9
In addition the report intends to give guidance to policy makers on possible courses
of action to be taken to reduce the impact of these threats. It will not cover the area
of terrorism nor the links between terrorism and serious and organized crime. Further-
more the report does not consider crimes against persons or property unless linked to
serious and organized crime.
35. This report was commissioned by {insert client} to allow him / her and his / her
office to enact policies, procedures and—where appropriate—suggest changes in legisla-
tion to improve the national response to the fight against serious and organized
crime.
36. The tasking was delivered to {insert individual/organization} on the 1 January
with a deadline of 30 June. The methodological approach taken was to produce a situ-
ation report by using information obtained from {insert sources}. Interviews were also
conducted with various officials currently involved in the fight against serious and
organized crime. Upon creating a situation report more analysis {explain approach}
provided the final SOCTA.

Step 3—Agreeing on the ToR

37. Once the initial tasking definition and ToR has been written this should be com-
municated to the person or group commissioning the SOCTA. Naturally there may be
some renegotiation required if the definition and ToR does not cover expectations.
Written agreement should be sought to ensure all parties understand all the
expectations.

C. Collection
38. Analysis requires information. One of the key skills in analysis is identifying and
retrieving the right kind of information i.e. information that will contribute to assessing
the scale and impact of serious and organized crime on society, and this can be loosely
termed data collection. In creating a SOCTA it is important to acknowledge that data
collection is driven by the recently agreed tasking definition and terms of reference.
This provides the framework within which is created a data collection plan.

Step 4—Data collection plan

39. In the first instance the data collection plan should be broad, looking to obtain
primarily general information across the spectrum of the task and ToR. The type of
information and the sources available to provide that information will differ from
country to country however some broad source areas can be defined:

9
National definition of “serious and organized crime” inserted here.
18 Guidance on the use and preparation of serious and organized crime threat assessments

"" Law enforcement and associated agencies

"" National and local government information
"" Open sources
"" Academia
"" Private industry
"" Non-governmental organizations (NGOs)
"" International organizations (IOs)
"" Subject matter experts

40. Dependent upon the national situation there may be other sources or groups of
sources available. This is by no means an exhaustive list and should be viewed as a
springboard to generating further possible sources for information. The collection plan
should identify the information required and potential sources that could be approached
to obtain that information. Great care should be taken when considering how the
information should be gathered. For example constructing and distributing a question-
naire may be the best method for retrieving similar types of information from a number
of different sources. Perhaps an in-depth interview with a subject matter expert (SME)
would be more beneficial in another situation. In other words consider the issues of
quantitative and qualitative data. And remember that some sources will have their
own reasons for supplying the information one of which may be to increase their own
profile. This is an important reason to gather information from as wide a selection of
sources as possible to ward against potential bias.

41. From our earlier example using the brainstorming data, the tasking definition and
ToR, part of the collection plan may look like the following;

Step 4—Data collection plan—example

Figure 4. Example of a data collection plan

Collection plan Sources

Information Open Private

requirement LEAs Govt. source Academia industry NGOs IOs Experts
Human YES YES NO NO NO YES YES YES
trafficking
Drug trafficking YES YES YES YES NO YES YES YES
Organized YES YES YES NO NO YES YES YES
crime groups
Corruption YES YES NO NO NO YES NO YES
Fraud/tax NO YES YES YES YES NO NO YES
Criminal YES NO NO NO YES NO NO YES
communication
Smuggling YES YES YES NO NO YES YES YES
of people
Part TWO How to prepare a SOCTA 19

Collection plan Sources

Information Open Private

requirement LEAs Govt. source Academia industry NGOs IOs Experts
Car theft YES YES YES NO YES NO NO YES
Immigration NO YES NO YES NO YES YES YES
legislation
Other x x x x x x x x

42. Once the broad source areas have been established then the analyst—or the agreed
individual(s) in charge of data collection—should begin the process of obtaining the
information. Within each of these areas certain information may be identified as being
of particular value. The specific information requirement will then be formulated. For
example:

Trafficking in human beings

Q1. How many victims of trafficking (VoT) arrive in the country each year?

Q2. What are the source and transit countries of VoT?

Q3. How many rescued VoT give evidence against their traffickers?

Q4. How is control exercised over the VoT?

Q5. What are the nationalities/place of origin of the traffickers?

Q6. Are the traffickers involved in other forms of criminality?

Q7. How much money is generated from the VoT?

Q8. Does the money generated from VoT remain in the country?

Drug trafficking
Q1. How many drug addicts are there in the country?

Q2. What are the main types of drugs being used and abused?

Q3. What is the mortality rate of drug users?

Q4. What are the source and transit countries in the trafficking of drugs?

Q5. What are the nationalities/place of origin of the traffickers?

Q6. How are the drugs smuggled into the country?

Q7. How much money is generated from drug trafficking?

Q8. Does the money generated from drug trafficking remain in the country?
20 Guidance on the use and preparation of serious and organized crime threat assessments

Organized crime groups

Q1. How many organized crime groups (OCGs) are active in the country?

Q2. How many of the OCGs are wholly indigenous?

Q3. W
 hich OCGs operate wholly independently and which have links to other
OCGs?

Q4. What is the nationality/place of origin of the OCGs leaders?

Q5. What is the structure of the OCG (loose network, strictly hierarchical)?

Q6. How international is the scope of the OCG?

Q7. How does the OCG gain and retain power?10

The analyst may be able to get this information directly through personal access to
open source data, criminal records, interviewing experts, etc. Otherwise they may
have to rely on others being able to access and supply the information on their behalf.
In this case more detailed records should be kept in order to keep track of the data
collection process.
Figure 5. Record sheet for the data collection process

Collection plan Source tasking

Information Date Date

requirement Name Address Tel No. E-mail Agency tasked received Deadline
Human
trafficking
Drug trafficking
Organized
crime groups
Other

43. It should be recognized that this is a preliminary data collection plan. As the
information comes in, is processed and evaluated (stage 3 of the intelligence cycle) and
analysed (stage 4 of the intelligence cycle) then further data collection needs will be
identified and become hypothesis driven. Thus the data collection plan should be viewed
as a living document, adjusted as the process of fulfilling the task of producing a
SOCTA is applied.

44. There are many elements to consider in constructing a data collection plan. In
particular the breadth, depth and reliability of the sources used will have a major impact
upon the quality and usefulness of the information received. Be careful if only one

10
It is emphasized that these questions are examples—there will be more questions to be answered and they may vary accord-
ing to the circumstances of the country.
Part TWO How to prepare a SOCTA 21

source is being used to supply crucial information that forms the basis of some critical
part of the report. Further guidance on the evaluation of information can be found at
paragraph 56.

45. Sometimes it is not a lack of information that is the difficulty rather too much
information. For example trend analysis requires historical data to be gathered and this
may require the data to cover five years or even more. A structured data collection plan
can assist in maintaining focus and reducing the amount of non-essential information
gathered. It can also act as an easy reference guide when referencing items in the report
as well as providing an excellent audit trail.

D. Processing and evaluation

46. Having begun collecting information there is a requirement to store it in such a

way that it can be easily retrieved and analysed. Documents, pictures, video, informa-
tion in any possible format needs to be quickly retrievable for use. Information
management is designed to support the handling and arranging of information.

Step 5—Information management

47. The following definition captures the key elements of information management:
"Information management describes the means by which an organization efficiently
plans, collects, organises, uses, controls, disseminates and disposes of its information,
and through which it ensures that the value of that information is identified and
exploited to the fullest extent.11"

48. There are some inherent difficulties when managing information which generally
revolve around the issues of standardization and volume. Some data that is received
may be “structured” in some fashion. It could be an electronic database of health records
containing details on the numbers of people who have died from heroin, cocaine,
MDMA abuse, etc. This type of data can be more easily processed and cross-referenced
within an information management system than “unstructured” information. This could
be a 100 page hard copy document on the harm caused to society by individuals
abusing illegal/controlled drugs. Nevertheless the unstructured data—if assessed to be
worthwhile to retain—should be recorded and cross-referenced within the information
management system. Volume of data, in particular open source information, can pose
difficulties regarding its management. This is where the use of a well crafted data
collection plan can assist in acting as a first level filter for information gathering.

49. There are many different types of information management systems from hard
copy, index card filing methods to sophisticated electronic document management tech-
niques but all have some key components.

11
Queensland Information Planning Branch (IPB) Information Standards. Information Standard No. 24 is titled “Policies
for the management of information within government”.
22 Guidance on the use and preparation of serious and organized crime threat assessments

A method for registering information when received

50. Regardless of the system used each piece of information received should be given
a unique reference number (URN) which is logged in some form of register or database.
It should then be cross-referenced against the appropriate subject matter which is driven
by the methodology being employed to produce the SOCTA.

A method for storing information

51. This can be some form of electronic database, or even several databases linked to
each other. It can be a filing cabinet/safe in which to store all the hard copy material.
Regardless of the form it takes, all the information should be recorded and stored in
a secure manner. As the process for developing and producing a national SOCTA evolves
it will become apparent that some form of standardized, electronic method of data
retrieval and storage would be preferable.

A method for retrieving relevant information

52. This is a key element of any information management system. The objective is
to ensure that all the relevant information can be retrieved quickly to assist in the
analysis and production of the SOCTA. This requires logical cross-referencing capabili-
ties to be developed which should be driven by the methodology employed in the
production of the SOCTA. In our example the information should be retrievable against
the main categories identified e.g. human trafficking, corruption, legislation, etc. It is
quite possible that one document could and should be referenced against several
categories.

53. The resources available to create and maintain an information system will dictate
the type of system deployed. Even if resources are scarce, time and effort must be
dedicated to ensuring proper information management takes place. It will reduce the
time spent on data retrieval and increase the quality of information available for analysis
at the same time.

A method for recording the classification12 and dissemination of information

54. It is important within a law enforcement environment that all information received
is correctly handled in accordance with the relevant, national data protection legislation.
This will vary from country to country however any information management system
should record the classification of the information received and any dissemination of
that information should be recorded and observe the restrictions that the classification
or handling codes (see paragraph 55) might impose.

55. A further aspect on the handling of information is the use of handling codes.
They are additional elements for protecting the source of the information by providing
detailed instructions on the use of the information. Handling codes can be used

12
For example: restricted, confidential, secret, top secret, etc.
Part TWO How to prepare a SOCTA 23

independently from the classification of the document and are imposed by the provider
of the information. Some commonly used handling codes are: “for police use only;
not to be used in court proceedings; not for further dissemination without reference
to the provider; not for dissemination outside national law enforcement agencies.”
Naturally very restrictive handling codes can make the dissemination of the information
problematical for the analyst. Thus, when obtaining information from sources that
have placed restrictions upon its use, the data collector should make the provider aware
of the difficulties this may cause. It should be highlighted that handling codes can
also be used to give permission in order to avoid that restrictions are adopted when
they are unnecessary. The use of handling codes in the exchange of intelligence related
to law enforcement activity is essential in international cooperation, as rules and
procedures, which are common practice in one country, may differ dramatically in
another country.

A method for evaluating information

56. Also contained within the information management system is an evaluation of
the source supplying the information and the validity of the information itself. Again
there are different methods used to evaluate these elements13 however the most com-
monly applied and understood is the 4 x 4 (four by four) system. It should be noted
that this system works best when applied to intelligence and care should be taken when
using this system to evaluate, for example, open source reporting.

57. Upon receipt of information that is going to be accepted into the information
management system it must be evaluated. In the first instance the source of the infor-
mation is considered and a letter is attached to the source. The conventions applied
are as follows:
Figure 6. Conventions for evaluating the source of information

SOURCE
Where there is no doubt of the authenticy, trustworthiness and competence of the
A source, or if the information is supplied by a source who, in the past, has proved
to be reliable in all instances.
Sources from whom information received has in most instances proved to be
B reliable.
Sources from whom information received has in most instances proved to be
C unreliable.
X The reliability of the source cannot be assessed.

After the source has been evaluated the actual information itself is evaluated and a
number is attached to the information. The conventions applied are as follows:

13
There are other systems including 5 x 5 x 5 (five by five by five) where the third “5” refers to whom the information can
be disseminated. The 6 x 6 (six by six) is used by some military organizations.
24 Guidance on the use and preparation of serious and organized crime threat assessments

Figure 7. Conventions for evaluating the information

INFORMATION
1 This is information where the accuracy is not in doubt.
This is information which is known personally to the source but not known
2 personally by the official passing it on.
This is information not known personally to the source but corroborated by other
3 information already recorded.
This is information which is not known personally to the source and cannot be
4 corroborated.

Some examples:

Information: I saw John Smith take a package handed to him from someone in a
BMW car.
Source: Police Officer A. N. Other
Evaluation: A1. The source is reliable (a police officer) and the information was
gained from direct observation by the source.

Information: Opium production in Afghanistan reached record levels in 2008.

Source: Turkish Newspaper Taraf
Evaluation: X3. It comes from an open source that cannot be easily assessed. The
information can be corroborated from other sources.

Information: This criminal gang is using encrypted e-mails to communicate with other
gang members. I know because I have seen them sending these e-mails.
Source: Mr. A. Fraud (a usually unreliable source)
Evaluation: C2. Source is unreliable. The information is known personally to the
source.

Information: This criminal gang is using encrypted e-mails to communicate with other
gang members. I know because I have seen them sending these e-mails.
Source: Mr. A Truth (a usually reliable source)
Evaluation: B2. Source is reliable. The information is known personally to the source.

Information: Fifty six people were prosecuted for trafficking in human beings offences
in 2008, an increase of 25 per cent on 2007 figures.
Source: Police National Computer
Part TWO How to prepare a SOCTA 25

Evaluation: A1 or B2. The source is a police computer database which some argue
is a wholly accurate source (A) while others argue it is a usually accurate source (B).
The information given, therefore, can be viewed as accurate without doubt (1) or known
personally to the source but not by the official—the computer operator—passing it on
(2).

This last example is provided to demonstrate that the evaluation of the source and the
information provided is not an exact science. The analyst’s judgement will always play
a large part when assigning an evaluation to a piece of information.

58. One of the main advantages of going through this evaluation process is the insight
it gives the analyst when it comes to reviewing areas where further data collection may
be required. There is a general convention that any information evaluated as A1, B1,
A2 or B2 does not have to be further corroborated i.e. it is viewed as “true and accu-
rate”. All other grades C1 to X4 require additional information to prove or disprove
its validity.

59. These then are the key elements that should be considered when implementing
an information management system:

"" The registering of information for storage and audit purposes;

"" The cross referencing of information for retrieval purposes;
"" The evaluation of information and source for analysis purposes; and
"" The recording of classification and handling codes of information for dissemi-
nation purposes.

The data in the following tables are used in the information management system.
The URN, cross reference and date received are all created by the recipient. If the
information has not been evaluated this should also be created. Each piece or
segment of information should be separately evaluated. If classification and han-
dling codes have been supplied these should be recorded.

Step 5—Information management—example

URN Classification Cross reference Date Revd

01/001 Restricted Arms smuggling AS01 21/01/09

Corruption CR01

Organized crime OC01

Country X CX01

Country Y CY01

Country Z CZ01
26 Guidance on the use and preparation of serious and organized crime threat assessments

Date of report Reporting officer and Report ref. no. Handling code
organization
14/01/09 A N Other BP/5234/ANO LE use only

Border Police

Report

On 1 January 2009 at the land border crossing point “Anywhere“ between country X and country
Y a Volkswagen car registration plate ABC123 was stopped and searched. Found in a concealed
space under the rear seat were four AK-47 assault rifles with 10,000 rounds of ammunition. A1

Checks on the car revealed that it is registered to an associate of a known drugs smuggler who
is a member of an organized crime group (OCG) that operates from country Z. B2

This OCG is suspected of having corrupt law enforcement officers under their control in country
Z. X4

60. The need for efficient and effective information management when conducting
an analysis as in-depth as required to complete a SOCTA is of paramount importance.
It allows the analyst the confidence to apply their skills to information that they know
has been properly managed. How this analysis is conducted is the subject of the next
stage of the intelligence cycle and the next section of this Handbook.

E. Analysis

61. The terms “analysis” and “criminal intelligence analysis” have been defined in
many different ways, however most definitions contain words such as information,
interpretation and pro-active. Within the remit of this Handbook a suitable definition
is "criminal intelligence analysis provides information that allows law enforcement
authorities to establish a pro-active response to crime."14

62. Stage 4 in the intelligence cycle is termed “analysis” and it should be clear from
the work done through the previous three stages of planning, collection and processing/
evaluating that the groundwork has been set to allow this analysis to take place. In
effect some analysis has already been conducted during the process of defining the task,
agreeing to the terms of reference and beginning the data collection, processing and
evaluation. However, it is during this fourth stage of the intelligence cycle that the
application of the analysis methodology is fully implemented.

14
Aumond 1998: 35-36.
Part TWO How to prepare a SOCTA 27

Figure 8. The SOCTA pyramid

SOCTA

Analysis

Situation report

Relevant data in national context

The model shown above provides a framework within which those tasked with
producing a SOCTA can build their own, specific methodology. This will be
­determined by the resources and skills available for the task.

The subsequent analytical techniques detailed in this section (and others

­summarized in annex II) will assist in the compilation of a SOCTA. However if the
individuals using these techniques are new to criminal intelligence analysis and
have no (or little) experience in applying these techniques then further training
is essential.

63. The model requires that a situation report is compiled ahead of any attempt to
provide a SOCTA. The situation report is a descriptive document which is orientated
towards the current serious and organized crime situation. It is a necessary step towards
providing the SOCTA which—being a threat assessment—is analytically more ambi-
tious. The situation report provides the platform of current understanding from which
various analytical techniques can be applied to assist in the production of the SOCTA.
It should answer the so-called 5W1H questions of who, what, when, where, why and
how. It is important to know what you know and to identify intelligence gaps before
embarking upon a full, national threat assessment.

Step 6—Environmental scanning

64. Having defined the task, begun implementing the data collection plan and started
populating the information management system it is now time to begin the analysis of
the data. The SOCTA methodology requires that the information being collected is
placed in a national, environmental context as law enforcement operates “in the real
world”. This requires a regular environmental scan to be completed to identify the key
environmental factors that have an impact on law enforcement and its response to
serious and organized crime. Environmental scanning is a process of gathering, analys-
ing, and dispensing information for tactical or strategic purposes. The environmental
scanning process entails obtaining both factual and subjective information on the
­environment in which law enforcement is operating.
28 Guidance on the use and preparation of serious and organized crime threat assessments

There are three ways of scanning the environment:

Ad-hoc scanning–Short term, infrequent examinations usually initiated by a

crisis;

Regular scanning–Studies done on a regular schedule (say, once a year);

Continuous scanning–(also called continuous learning)–continuous structured

data collection and processing on a broad range of environmental factors.

65. In today’s turbulent environment the best scanning method available is continuous
scanning. This allows action to be taken quickly and respond to environmental threats
before significant damage is done. This is resource intensive and a more practical option
may be to complete an environmental scan as part of the annual or bi-annual SOCTA
process. Again each country will have its own key environmental factors but one tool
to assist in identifying these is PESTEL analysis.

66. PESTEL is an aide memoire to trigger analysis on certain environmental factors

that may have an impact on crime and law enforcement. The individual letters stand
for Political, Economic, Social, Technological, Environmental and Legislation. The
technique is to consider each of these areas and identify elements within them that
may have an impact on law enforcement.

Step 6—Environmental scanning—example

Political factors to be considered may include:
"" The stability of the present government.
"" The ideology of the present government.
"" Corruption within the political system.
"" Relationship with the international community.
"" Structure of the political system.

Economic factors to be considered may include:

"" The amount of regulation within the economy.
"" The inflation rate.
"" The type of economic system.
"" The average earnings of the population.
"" The currency exchange rate.

Social factors to be considered may include:

"" The demographics of the society.
"" The extent of social inclusiveness.
"" The health of the population.
Part TWO How to prepare a SOCTA 29

"" Any population shifts.

"" The ethnic diversity of the population.

Technological factors to be considered may include:

"" The use of transportation.
"" New communication methods.
"" The use of technology in money transfer.
"" Technology that may have a dual use.
"" Advances in the manufacturing of key technology.

Environmental factors to be considered may include:

"" Global environmental factors such as availability of water, global warming,
etc.
"" The use and re-use of resources.
"" The impact of the local environment on crime such as housing, security etc.
"" The impact of environmental legislation.

Legislative factors to be considered may include:

"" The strength of legislation in combating serious and organized crime.
"" Any loopholes within current legislation.
"" The ease with which new legislation can be passed.
"" The review process for current legislation.
"" International legislation and standards and their impact on national issues.

67. It should be recognized and remembered that this is simply a method to help
structure thinking when identifying key environmental factors. They will differ from
country to country and as a result it may make more sense to combine some elements,
drop others and introduce new ones. Having identified those key factors they should
then be woven into the situation report where the analyst deems relevant. Thus a key
law enforcement issue may be the trafficking in human beings and a key social issue
the demographics and a key economic issue average earnings of the population.

68. Once again the analyst should not attempt this environmental scan in isolation.
Another brainstorming session may be required, or certainly discussion with others who
can bring a different perspective to bear. As every analyst is an individual they each
bring their own perspective and bias into their analysis. Thus it is important to try
and reduce the effect of these by acknowledging their existence and introducing strate-
gies to control them. These strategies include seeking opinions other than the analysts’
own, designing and deploying a valid methodology and introducing as much structure
and rigour to the analytical process as possible. For example, if the analyst charged with
producing the SOCTA has a background in drug trafficking investigations it is possible
30 Guidance on the use and preparation of serious and organized crime threat assessments

there could be a bias towards drug trafficking. Introducing other opinions and a struc-
tured approach helps mitigate these inherent difficulties.15 If possible the original brain-
storming group and appropriate subject matter experts (SMEs) should be included.
69. At this stage in the analysis and production of the SOCTA the analyst should be
looking to identify the key interdependencies between these broad areas previously
identified from the initial brainstorming. For example drug trafficking (broad area) may
be increasing due to better communication (interdependency) between national and
international organized crime groups (broad area). How the information from the envi-
ronmental scan impacts upon these interdependencies should then be analysed. For
example, new technology (PESTEL) has introduced greater cell phone coverage allowing
easier communication between organized crime groups.

70. This will assist in bringing focus to the analysis and highlight areas where further
data collection may be required. For example close cooperation between two different
organized crime groups in country X, one involved in drug supply within country X
and the other in people smuggling through country X to country Y, has been identi-
fied. The environmental scan has identified weak legislation and lack of resources
deployed to tackle illegal migration where country X is only a transit country and not
the country of final destination. The analyst will be focusing on gathering further
information in these specific areas.
71. This process of gathering information on the broad areas, assessing the national
environment and its impact on the broad areas and the interdependencies between these
areas continues. Further data collection is undertaken on the critical areas identified
and where more information is required, these are termed intelligence gaps. Intelligence
gaps will always exist as it is virtually impossible to get all the information required.
The true skill is in being able to identify the critical intelligence gaps and to narrow
them as much as possible. The analyst will continue to examine the information as it
arrives, describing the situation as it is reported to them and looking for inconsistencies
within the data that require clarification or areas where more information is required.
This is the full analytical ambition of the situation report. It does not attempt to meas-
ure or assess current or future threat but simply states the current serious and organized
crime situation which exists in this national environment and to understand more we
need to narrow these intelligence gaps.
72. In order to produce a forward looking SOCTA designed to provide a nation
State with the right information to pro-actively tackle future threats from serious
and organized crime then further and much deeper analysis has to be applied. The
following paragraphs outline one possible methodology. However, there are several other
possible alternatives given the number of different analytical tools and techniques
available. Some of these are given in annex II but to ensure the best methodology is
developed for each country—and the correct tools and techniques are properly applied—
the training that complements this Handbook should be followed.

15
Psychology of Intelligence Analysis, Richards J. Heuer Jr, Centre for the Study of Intelligence, Central Intelligence Agency,
1999.
Part TWO How to prepare a SOCTA 31

73. There are many elements and issues to consider when producing a threat assess-
ment and of supreme importance is to define “threat”. There is no, one, simple defini-
tion of threat that can be applied across all environments. However there are certain
elements to the concept of threat that tend to remain constant. These include terms
such as capability, intention, risk, harm, vulnerability and probability. It is important
to recognize—once again—the necessity of having a properly understood and agreed
on ToR as this will include a definition of threat and the methodology will detail how
analysing this threat will be achieved. The model below gives one example of how these
elements are inter-linked.16

Figure 9. Example model of the concept of threat

Desire

Intent Harm
R
Success
I
Threat Vulnerability
S
Knowledge
K

Capability Control

Resources

Probability

74. In the model a threat will only exist if there is “intent” and “capability” to carry
out the threat. If neither the intention nor the capability exists then the threat does
not exist. Intention consists of the expectation of “success” and a “desire” to carry out
the threat. If there is a perception that the threat will not succeed or there is no desire
to carry out the threat then there is no intention and, therefore, no threat. Capability
consists of the “knowledge” and “resources” to carry out the threat. Again, if either of
those is missing there is no threat. In assuming that all four elements of success, desire,
knowledge and resources exist then there is a threat. The probability of the threat
occurring will be dependent upon the extent to which each of these elements has been
developed. A 100 per cent expectation of success, desire, knowledge and resources results
in a 100 per cent probability that the threat will occur.

16
As noted in the body of the text there are many different models linking these elements together, for example capability
and capacity could be argued as better indicators of vulnerability than harm and control and that “harm” should sit on the “threat”
side of the equation.
32 Guidance on the use and preparation of serious and organized crime threat assessments

75. Simply because there is a 100 per cent chance of the threat occurring does not
mean that there is a 100 per cent chance of it succeeding. The success will depend
upon the “vulnerability” of that which is threatened. This, in turn, is determined by
the “harm” (or impact) caused by the threat and the “control” mechanisms in place to
reduce the vulnerability. Where there is no harm caused by the threat, or the control
mechanisms are 100 per cent effective, then there is no vulnerability.

76. In the real world of serious and organized crime these absolutes of 100 per cent
or 0 per cent seldom exist. As a result there often exists a situation where threat and
vulnerability meet. When this occurs there is “risk”. In defining threat for a national
SOCTA the needs of the client will have to be very well understood. Do they want
the elements of risk considered as well i.e. the possible harms from the threat and the
control mechanisms in place to reduce the vulnerability? Ultimately it is a matter of
preference whether it’s called a risk or threat assessment, what is important is that the
client and the analyst agree on what is to be provided and how it will be achieved.
Once again the issue of a properly negotiated and understood ToR including the meth-
odological approach is vital. This will include definitions on each of the elements of
the model.

77. Once the ToR and, by extension therefore, the aims and objectives of the SOCTA
has been agreed to and the situation report constructed, there are various analytical
tools and techniques that can be applied to the information to provide the required
SOCTA outcome(s). Before examining these however there are some elements to stra-
tegic analysis which are common regardless of the type of analytical approach taken.
These are the “human” elements and their influence on the analysis has to be recognized.
Previously noted in this section (paragraph 68) is perception and linked to this is the
concept of rationality. The analyst has to be aware when conducting their analysis that
what may appear as an irrational decision taken by an individual is—from that indi-
vidual’s perspective—wholly rational. It is incumbent upon the analyst to recognize that
rationality is relative to the individual and to factor this into their analysis. It requires
the analyst to put themselves in the position of the person or group they are analysing.
For example, it may not make any rational sense from the analyst’s perspective for a
person to randomly select and kill a law enforcement officer. The individual committing
that act though may have done it to prove his worthiness in joining a particular crime
group.

78. Also linked to perspectives and rationality are assumptions. These are short-cuts
that analysts have to take in a world of too much information. Assumptions are
necessary to move analysis forward, what is crucial is that the analyst recognizes the
assumption and—where it is important to the analysis itself—highlights this in the
methodology. For example there may be a particular group of individuals involved in
people smuggling. A key assumption may be that this group is involved in this activity
for financial gain and this will affect the analytical approach. If the assumption is made
that the group is actually involved in people smuggling because they want to help
others to find a better life and that profit is not a motive then this would change the
analytical approach.
Part TWO How to prepare a SOCTA 33

79. All of these human factors with regard to analysis come under the umbrella of
meta-cognition, in other words thinking about thinking. The analyst has to appreciate
the influence that perspectives, rationality and assumptions can have on their analysis
and to take what steps they can to reduce that impact.

F. Production (“and now the SOCTA“)

80. Once an acceptable situation report has been produced this acts as the baseline
for producing the SOCTA. As identified previously it is important to know what you
know and to identify intelligence gaps before embarking upon a full, national threat
assessment. The added value of the threat assessment is the ability to go beyond describ-
ing the environment and conducting a risk analysis to prioritize threats. The compli-
mentary process to achieve this is the SWOT analysis and argument building that
underpins the SOCTA recommendations.
81. There are a number of analytical approaches that can be taken to assist in the
production of the SOCTA. The tasking and ToR will determine which of these
approaches, or which combination of approaches, should be used (the methodology).
Thus the approaches shown below are provided to allow the analyst creating the SOCTA
the opportunity to choose the approach(es) that will best fit their own clients’ needs
and provide the greatest added value.

Step 7—SWOT analysis

82. Within the law enforcement environment SWOT analysis is often used as a
­logical compliment to PESTEL analysis. The term SWOT stands for Strengths,
­Weaknesses, Opportunities and Threats. Having conducted the PESTEL analysis the
analyst will have identified some of the key “drivers” for serious and organized crime
within their particular law enforcement environment. SWOT analysis can now be
applied to help in assessing how serious and organized crime might exploit these drivers
and what barriers may exist in reducing their capability to exploit them. The Strength
and Weakness part of the analysis concentrates on the strengths and weaknesses of the
organized crime group (OCG) and the Opportunity and Threat part focuses on the
opportunities and threats that the market place (the environment) offers.

Step 7—SWOT analysis—example

The following may be some key elements to consider in a SWOT analysis of an OCG
involved in heroin trafficking in country X.

Strengths:
"" Internal organization and structure.
"" Resources and skills available to the group.
"" Large, closely knit criminals providing support nationally and internationally.
34 Guidance on the use and preparation of serious and organized crime threat assessments

Weaknesses:
"" Lack of trust within group members.
"" Unwillingness to cooperate with other OCGs.
"" High profile of OCG attracting law enforcement attention.

Opportunities:
"" Relaxing border controls offering entry to new market places.
"" Change of political priorities away from drug trafficking.
"" Removal or reduction in state funded drug addiction centres.

Threats:
"" Expansion of a rival OCG into the market place.
"" Legislative change introducing harsher punishment for OCG membership.
"" National social awareness campaign on drug abuse.

83. This SWOT analysis technique can also be used on other types of organizations.
For example it could be conducted on a law enforcement agency, examining its own
internal strengths and weaknesses and the opportunities and threats that exist in its
environment, in the fight against serious and organized crime.

Building arguments
84. Using the above techniques of PESTEL and SWOT the analyst will now be
building arguments. The analyst has to demonstrate why their explanation is valid and
includes various elements such as facts, statements, inductive and deductive reasoning.
The SOCTA should encompass the ethos of good inductive analysis which is taking
the information available and going “beyond the facts” to provide in-sight and
illumination.

85. The analyst will take the facts (individual items of knowledge) and from related
facts will build a statement reflecting a key point. These statements will then be taken
and a hypothesis will be developed; a hypothesis being a reasoned argument. For
example;

Fact: Socrates is a man.

Fact: All men are mortal.
Statement: Socrates is mortal (deductive reasoning).

This is known as deductive reasoning where the statement must be true, given the facts
from which it is derived.

Fact: John Smith associates with known criminals.

Fact: John Smith has no visible income.
Part TWO How to prepare a SOCTA 35

Fact: John Smith lives a very expensive lifestyle.

Statement: John Smith makes his money from criminality (inductive reasoning).

This is known as inductive reasoning where the statement may be true, given the facts
from which it is derived. It is possible that John Smith won the state lottery or has
rich parents. A series of related statements are then used to produce the heart of analysis,
the hypothesis.

Statement: John Smith makes his money from criminality.

Statement: The majority of John Smith’s associates have links to drug trafficking.
Statement: John Smith owns a small yacht which his son pilots regularly.
Hypothesis: John Smith organizes drug importations using a yacht piloted by his son.

86. The hypothesis should now be tested in an attempt to prove or disprove its valid-
ity and this may require further data collection. The analyst should also try and identify
alternative hypotheses from the same information. This helps ensure that no undue bias
is placed upon the analysis by only considering one option. This is known as the
analysis of competing hypotheses (ACH). The building and testing of hypotheses is
the central theme of analysis and ultimately any recommendations will be constructed
around the hypotheses provided by the analyst.

Figure 10. From information to intelligence

INFORMATION + ANALYSIS = INTELLIGENCE

87. As noted previously the person commissioning the SOCTA may wish it consider
the vulnerability of society and the state to a threat from serious and organized crime.
When assessing vulnerability one of the component parts is harm. The analyst should
consider not just the obvious and immediate harm caused by the threat such as the
loss of life but the further after-effects and ramifications. For example, drug trafficking
brings obvious harm to the health of the drug addict however there could be secondary
harm to society. The addict may steal money or goods to pay for their drugs, the state
may end up paying medical treatment costs. There could even be further, wider impli-
cations if the country is viewed by others as one where there is a large drug abuse
problem. This could affect tourism, inward investment etc.

88. The other component part of vulnerability is the control mechanism in place to
counteract the threat. This is simply the existing counter-measures already in place to
reduce the vulnerability of whatever is being threatened. This could be the physical
protection of buildings, people, etc, or could be the processes and procedures that are
in place to help reduce the vulnerability. For example the existence of an anti-drug
trafficking law enforcement department.
36 Guidance on the use and preparation of serious and organized crime threat assessments

89. There are many analytical tools and techniques for helping identify the drivers of
threat and creators of vulnerability. Market profiling and criminal business analysis
are two such techniques using the 5W1H approach (see paragraph 63) and can be
extremely useful in producing a SOCTA. More detail on these and other techniques is
given in annex II.

90. A useful analytical tool for identifying vulnerability is to use a flow chart. The
flow chart is a diagrammatical representation of any process where there is a flow. In
the law enforcement environment this could be a flow of drugs, money, weapons, com-
munication etc. The flow chart can assist in identifying areas of vulnerability within
the process, improve organizational knowledge of a particular process by examining the
modus operandi, reveal opportunities for law enforcement disruption and highlight
intelligence gaps.

91. Flow charting requires the analyst to break the process down into the key sequen-
tial, dependent and parallel events for a particular flow. The example shown below is
a simplified flow chart for the smuggling of migrants into the European Union.
Figure 11. Flow chart for smuggling of migrants into the EU

MIGRATE INTO
THE EU

3rd Party exploits and CONTRACT Knowledge to

NO
controls individual 3RD PARTY complete task

YES
YES

THB NO ARRANGE
TRANSPORTATION AND
OBTAIN PAPER WORK

LAND SEA AIR

ROUTE CHOSEN

BORDER
CROSSING POINT

TRICKERY/
CONCEALMENT AVOIDANCE
FALSIFIED DOCS

Arrival in EU? CONTINUE

NO
JOURNEY

YES

SUCCESS
Part TWO How to prepare a SOCTA 37

This flow chart identifies some of the key elements in the process and the order
in which they occur. From the chart we can discern that at some point there has
to be a successful border crossing. This may take different forms but the chart
highlights this as a key vulnerability in the process. It also highlights the supply
of transportation and documentation as key components. These in-sights could
form the basis for areas in which to focus law enforcement counter measures.

92. Having now used a series of analytical tools and techniques to identify and assess
the component parts of threat and vulnerability we are now in the position to assess
the risk. Where threat (a person or a group of individuals with the desire, expectation
of success, knowledge and resources to execute an illegal act) and vulnerability (possible
harm and inadequate control) meet, then a risk exists. These risks can then be analysed
to determine prioritisation and control strategies.

Step 8—Risk analysis17

93. There are three discrete stages within the risk analysis process:

Identification
The identification of the risk may come from the client during stage 1 of the intelli-
gence cycle i.e. from the direction, planning and tasking. It may also be analytically
driven i.e. analysis of a certain subject highlights hitherto unidentified potential risks.

Analysis
The analysis of risk is inherently difficult within a law enforcement environment as it
usually requires some form of quantitative judgement to be made using data that does
not easily lend itself to be used in such a fashion. Remembering that risk is a culmina-
tion of all component parts of threat and vulnerability it follows that a risk analysis is
a combination of all previous analysis undertaken to determine threat and vulnerability.
Risk analysis attempts to measure and then prioritise the identified risks and this is
usually done through the use of a matrix.

Figure 12. Risk analysis matrix

High
Deal with as soon as Immediate action
possible required
Impact

Monitor Deal with in due course

Low
0 Probability 100%

17
Although not strictly part of a threat assessment, risk analysis allows the threats identified through the SOCTA process to
be prioritized and it assists in the recommendation writing phase. As such it was decided to include risk analysis within this
Handbook.
38 Guidance on the use and preparation of serious and organized crime threat assessments

94. The matrix shown above is a simple two-by-two matrix which can be used to
help determine priorities for action to be taken against identified risks. Therefore if
previous analysis has identified one threat as having a high probability of happening
and a high impact should it occur then the risk falls into the ‘immediate action required”
box. If a threat is measured as having a low probability and high impact then that risk
should be dealt with “as soon as possible” i.e. directly after the “immediate action
required” risks have been managed. High probability and low impact should be dealt
with “in due course” and low probability and low impact should be “monitored” to
ensure they remain low probability and low risk.

95. This approach is very simplified and many organizations use a more complex
three-by-three matrix.18 It also does not take account of one other issue, namely time.
For example virtually all scientists are agreed that in approximately 5-7 billion years
our sun will either explode or implode and destroy the Earth. Using the matrix that
means there is a high probability of it happening and an exceptionally high impact!
Does that mean there is “immediate action required”? Obviously not since the risk is
so far into the future as to make planning for it just now meaningless.

Control
96. Having assessed and prioritized the risks consideration should be given to how
those risks can be controlled. There are five traditional risk control methods.

(i) Prevention. This means the complete elimination of the risk by reducing
either the vulnerability or threat to 0 per cent. As previously discussed this is almost
impossible to achieve.

(ii) Reduction. This is the more likely outcome from any attempt to prevent the
risk. It involves considering all elements of the risk and identifying in which area(s)
effort should be made to reduce the risk. Can the threat be best reduced by targeting
the resources available to the individual or group creating the threat? Can the vulnerabil-
ity be reduced by introducing new and more frequent border control checks?

(iii) Transference. This requires that the risk is transferred to someone or some-
thing else. In the world of private business this usually entails buying insurance. Within
law enforcement it may not be acceptable to transfer criminal activity from one region
to another or from one state to another although some policing strategies may have
this effect. For example the introduction of closed circuit television (CCTV) in a city
centre may displace crime to surrounding areas not covered by CCTV.

(iv) Acceptance. This is an acknowledgement that it is not worth the cost of

controlling the risk. These will most probably be the low impact risks as identified
within the impact/probability matrix.

18
National Policing Improvement Agency (2008) “Practice Advice on Analysis”.
Part TWO How to prepare a SOCTA 39

(v) Contingency. This accepts that the risk exists but also provides a plan of
action should the risk materialize. Many local and state governments have contingency
plans in the case of natural disaster etc.

Step 9—Recommendation writing

97. Having conducted the risk analysis the analyst should now be writing recom-
mendations that the client may wish to consider. These will be based around the
hypotheses that the analyst has constructed during their analysis and those key intel-
ligence gaps that have emerged. At this stage there will be value in consulting with
others, in particular subject matter experts (SMEs), as they may have greater in-sight
into the type of recommendations that will have the greatest impact. This input, how-
ever, should not compromise the analysts’ integrity in developing unbiased recommen-
dations since many SMEs and other stakeholders could have their own reasons for
supplying certain suggestions for recommendations. The analytical process in construct-
ing the SOCTA should have already supplied the analyst with enough information to
formulate sensible, unbiased recommendations. When writing recommendations the
analyst should try and make them S.M.A.R.T. This means they should be:

Specific: General recommendations such as “improving international cooperation”

should be avoided. Make them specific and detailed.
Measurable: The success of the recommendation should be capable of being judged.
Attainable: They should be realistic.
Relevant: They should reflect the outcome of the analysis.
Timely: They should be time relevant.

Step 9—Recommendation writing—example

It is recommended that the government change the penalties for membership in an
organized crime group (as defined under current legislation) from 5 years to 25 years
imprisonment. This change should occur as soon as possible and certainly within the
next 24 months.

This is a SMART recommendation as:

"" It provides enough detail for it to be accomplished (specific);

"" Organized crime group membership can be monitored (measurable);
"" Change in national legislation is something the state can control (attainable);
"" A hypothesis states; there is no effective deterrent for OCG membership
(relevant);
"" A suggested timescale given (timely).
40 Guidance on the use and preparation of serious and organized crime threat assessments

98. Providing a SOCTA requires the analyst to take a large subject area and find
some method of breaking it down into manageable pieces and examining the threat
before reconstructing it with a forward looking perspective. The process developed
through this Handbook has described some methods for achieving this breakdown and
reconstruction, for example; brainstorming the task, PESTEL, SWOT, flow and risk
analysis along with the additional tools and techniques given in annex II.

99. The analysis stage of the intelligence cycle is now complete. The tasking has been
agreed, the relevant information has been collected, collated, evaluated, the appropriate
analytical methodology identified and the relevant analytical tools and techniques applied
and suitable recommendations written. As this process has advanced the report writing
will have been progressing. It is now time to pull all the elements together to provide
the completed product.

G. Dissemination and feedback

100. The dissemination stage completes the intelligence cycle and is marked by the
delivery of the final product to the client. In the case of a national SOCTA this will
take the form of a written report. The provider of the report may also be asked to
present and defend the product orally with the client and other interested parties.

Step 10—Disseminating the results

101. There are a number of elements to consider with regard to the production of
the written report but of crucial importance is to recognize and remember that the
report is written to assist the client in their understanding. The report should be a
vehicle for comprehension. To assist in this objective the following points should be
addressed:

The structure of the report–An example of a report structure is given in this section
(paragraph 104). To summarize, the report should have:

"" A beginning. This includes an introduction and will highlight the tasking,
terms of reference and also the methodology.
"" The middle. This is the bulk of the report, including the analysis and
demonstrates that the task defined in the beginning has been achieved.
"" An end. This is the conclusion which summarizes the key judgements,
intelligence gaps and provides recommendations where required.

The format of the report–The report should be consistent throughout using the same
font. Consider breaking up blocks of text with pictures, diagrams, bullet points, side
bars, etc. New chapters should be started on a new page and headings should not start
at the bottom of a page. Issues such as the production of hard copies and electronic
copies in various formats such as .pdf files should be addressed.
Part TWO How to prepare a SOCTA 41

The style of the report–Consider the language and style of the report and remember it
should be tailored to the needs of the client. Take care when using abbreviations or
“jargon” (professional slang) as this may not be readily understood by the reader of the
report. Consider having a glossary of important terms and abbreviations. When sources
are referenced within the report there should be sufficient detail to allow the reader to
assess the validity of the source, unless the source has specifically asked not to be revealed
(see classification paragraph 54 and handling codes paragraph 55).

The content of the report–The report should make quite clear the following elements:

"" Key judgements supported by logical arguments i.e. the culmination of the
analysis.
"" Intelligence gaps identified through the analysis.
"" Recommendations which are S.M.A.R.T. (see paragraph 97) and developed
from the analysis.

102. It is important when conducting the analysis to constantly review the work
undertaken to ensure it remains focussed on the task. Similarly it is important upon
completion of the first draft of the report to have it critically reviewed by a peer group
and, if possible, by external parties which may include some of those involved in the
initial brainstorming. The draft report should be proof read from a hard copy and be
marked as “draft”.

103. Once the report has been reviewed, proof read and approved it is ready for dis-
semination. At this point the classification and handling codes of the document should
be verified and a distribution list of those receiving the report should be created. Each
copy should be individually numbered and referenced to each recipient. This audit trail
is essential should there be further, unauthorized dissemination of the report.

104. As identified earlier the written report may be accompanied by an oral presenta-
tion. This is a further opportunity for the message contained within the report to be
disseminated. The presenter should consider the following elements:

Before the presentation

Understand the purpose of the briefing. Is it to highlight key judgements, discuss

recommendations, explain the methodology or is it to summarize the entire report?
Know the audience, how long is available for the presentation, the style of presentation
(use of visual aids etc.) and rehearse the briefing.

During the presentation­

Decide whether the briefing should be read from a prepared script or if the use of
“prompt” notes is sufficient. Are questions to be taken during the briefing or held until
its conclusion?
42 Guidance on the use and preparation of serious and organized crime threat assessments

After the presentation

Is any follow-up required if promises were made to clarify some issues or rework some
elements of the report?

Step 10—Report structure—example

Foreword

This section is usually written by the Head of the organization/department commis-

sioned to produce the document. It will cover why it’s been done and what it hopes
to achieve as well as thanking the various contributors to the document.

Executive summary

This section is optional and is only included if the document is particularly long or is
aimed at those unlikely to read the full document. If included it will contain the key
judgements, intelligence gaps and recommendations of the report and will be relatively
short (1 to 2 pages).

Introduction

This section will set the scene in a little more detail than the foreword, putting the
document in the context of national law enforcement tasking and coordination. It will
expand on the background to, and development of, the report highlighting some of
the key difficulties faced and the major advances made.

Aims and objectives (alternatively terms of reference)

This section provides the reader with a thorough knowledge of what was required, by
whom and how it was produced. It will include the tasking definition and terms of
reference, highlighting the methodology used to produce the report.

The main body of the report

This section contains the actual analysis and will be broken down into logical sub-
sections dependent upon the methodology and analytical approaches used. It forms the
largest part of the report and contains all the information the reader requires to validate
the analysis made within the entire document. It will highlight key judgements and
intelligence gaps.

Conclusions

This section briefly reviews the document highlighting the key judgements and intel-
ligence gaps. All information in the conclusions should be contained elsewhere within
the report. Nothing new should be introduced in this section.
Part TWO How to prepare a SOCTA 43

Recommendations

This section will provide recommendations to combat the threats identified within the
SOCTA. Not all clients request recommendations and this should be agreed during the
negotiation of the ToR. These recommendations should be S.M.A.R.T.

105. Having committed time, effort and various other resources into completing the
SOCTA feedback on the value of the SOCTA should be obtained. This is undertaken
to assess the impact of the SOCTA and to help improve the process and methodology
for subsequent, similar reporting.

Step 11—Feedback
106. The feedback could be generated from providing a feedback form along with
the report which asks the recipients for their critical comments around the key areas
of usefulness, timeliness and accuracy. It should be noted that the usual return rate of
feedback questionnaires is around 10 per cent so a pro-active approach to encourage
their completion and return may be required.

107. It may be possible to arrange a meeting with the key stakeholders to discuss in
a semi-structured format the value of the SOCTA and how it could be improved. This
meeting should be moderated by an impartial chair and built around a set of questions
and areas for discussion linked to the SOCTA content and previously circulated to the
participants ahead of the meeting.

108. The value of the SOCTA may also become apparent from the monitoring of
suitable indicators linked to the SOCTA outcomes. For example a recommendation
that the length of prison sentencing for synthetic drug production be increased could
be monitored, or if an intelligence gap that existed around knowledge of arms traffick-
ing is narrowed.

Figure 13. The intelligence cycle

Planning
and tasking

Disseminate Collection

Analysis and Processing

production
44 Guidance on the use and preparation of serious and organized crime threat assessments

The dissemination of the SOCTA to the client, coupled with managing the
­feedback, completes the intelligence cycle. The SOCTA—by fulfilling the tasking
set and agreed by those commissioning the document—delivers the right
­information to allow for intelligence-led decisions to be taken by the appropriate
policymakers. The key findings, intelligence gaps and recommendations from the
SOCTA also help form the next cycle of planning, direction and tasking. This
­continuous process ensures a cohesive, effective and improving national response
to the threat from serious and organized crime.

H. Part Two—checklist

"" Brainstorming
"" Defining the task
Planning "" Agreeing the terms of reference

"" Data collection plan

"" Information management
Sit Rep "" Environmental scanning

"" SWOT analysis

"" Risk analysis
SOCTA "" Recommendation writing
"" Feedback

1. Are the resources in place for a SOCTA?

2. Have the appropriate training needs been identified and provided?

3. Who will participate in the brainstorming sessions? e.g. law enforcement agencies,
government departments, international organizations, academia, private/public
sector.

4. Do we have a clear terms of reference?

5. Have we identified the broad areas for data collection?

6. Have we established a data collection plan and identified suitable sources?

7. Where and how will we store and secure the information?

Part TWO How to prepare a SOCTA 45

8. What system are we using for evaluating the information?

9. Have we completed an environmental scan?

10. Have we identified intelligence gaps?

11. Have we applied the relevant analytical techniques?

12. Is the style of the report logical?

13. How was the report used?

 PART THREE
Training for preparing and using a SOCTA

109. This Handbook attempts to provide enough generic information and guidance
to allow the user to develop a basic national SOCTA. However the subject area is so
broad, national differences so unique and the analytical skills required so specialized
that no generic handbook could cover all that is required in enough depth to provide
a tailored national SOCTA. Therefore it is envisaged that training should be provided
to those expected to use and complete a national SOCTA.

110. The training will supply a suitable skill set to the appropriate individual(s) identi-
fied to prepare a SOCTA while recognizing their own national environment and avail-
able resources. The training should last for one working week of 40 (forty) hours and
build upon the methodology promulgated within this Handbook.

111. The first day of the training is also aimed at the managers of the SOCTA proc-
ess and the persons commissioning the SOCTA—the users. It is strongly recommended
that as many of these individuals as possible attend the first day of the training. This
will help cement the relationship between the different parties involved in the entire
SOCTA project. It will also provide an opportunity to discuss possible problems and
have them resolved quickly.

112. A potential timetable is provided below along with brief learning objectives for
each element.

113. The training is split into five core modules (CM) and is aimed at ensuring the
theory can be usefully applied.

47
48 Guidance on the use and preparation of serious and organized crime threat assessments

Figure 14. Proposed timetable for the SOCTA training

1 2 3 4 5
1 08.30 - 09.20 Course Creative Collection Analytical Risk
introduction thinking planning approaches
2 09.30 - 10.20 Intelligence Exercise 1a; Information Exercise 9;
and law brainstorming management Risk
enforcement

10.20 - 10.40 Morning break

3 10.40 - 11.20 What is a Exercise 1b; Environmental Threat Indicators and

SOCTA? Mind mapping scanning warnings
(PESTEL)
4 11.30 - 12.20 Planning a Exercise 1c; Exercise 3; Exercise 6; Exercise 10;
SOCTA The six hats PESTEL Threat Indicators and
warnings

12.20 - 13.30 Lunch break

5 13.30 - 14.20 Commissioning Terms of Logic Vulnerability Scenario

a SOCTA reference writing
(defining the
task)
6 14.30 - 15.20 Discussion; Exercise 4; Exercise 7; Exercise 11;
How to make Logic Vulnerability Scenario
a SOCTA work writing
15.20 - 15.40 Afternoon Afternoon Afternoon Afternoon Afternoon
break break break break break
7 15.40 - 16.30 Psychology of Exercise 2; Building SWOT analysis Dissemination
analysis terms of arguments
reference
8 16.40 - 17.30 Terms of Exercise 5; Exercise 8; Case study
reference hypothesis SWOT analysis
—presentation development

End

Day 1

Course introduction
Introduce the participants to each other and the trainer
Introduce the main elements of the course
Determine what the participants expect from the course

Intelligence and law enforcement

Difference between information and intelligence
Intelligence-led policing, what it is and why it’s a good idea
How a national SOCTA fits into an intelligence-led approach
Part THREE Training for using a SOCTA 49

What is a SOCTA?
Reviewing part 1 of the Handbook; Why we need it, what it is, key elements to
consider

Planning a SOCTA
Elements to consider when planning a large project
Tying those elements (people, time, interdependencies etc.) into a SOCTA

Commissioning a SOCTA
What those commissioning the SOCTA want (the tasking)
The different demands made—and pressures brought to bear—of the analyst and how
to cope with those demands and pressures
Followed by open floor discussion on the issues raised so far concentrating on good
practice vs. organizational culture i.e. what will work, what won’t work, why and how
it might be resolved

Psychology of analysis
Considering the “human” elements of analysis concentrating on perception, rationality
and assumptions and how they affect our analysis
Looking at coping mechanisms for dealing with these human elements, the marriage
of art and science.

Day 2

Creative thinking
Highlighting the need for creative thinking in analysis
Considering different creative thinking techniques
Combining three of these techniques, brainstorming, mind mapping and the six hats
in practical exercises.

Terms of reference (defining the task)

Considering the importance of proper task definition
What is a conceptual model and how it can assist in determining scope
Writing a methodology
Practical exercise using all elements learned to date to produce a completed terms of
reference
50 Guidance on the use and preparation of serious and organized crime threat assessments

Day 3

Collection planning
The need for a collection plan
Different types of collection plan
Elements of a collection plan including sources, resources, third party collection

Information management
The elements of a good IM system
Evaluation of information focussing on the use of the 4 x 4 (four by four) system

Environmental scanning (PESTEL)

What is an environmental scan
Why does it need to be done
Identifying some environmental scanning techniques focussing on PESTEL analysis
followed by a practical exercise using PESTEL analysis

Logic
Critical thinking
Going beyond the facts; inductive and deductive reasoning

Building Arguments
Key elements to building an argument
Using models to build arguments

Day 4

Analytical approaches
Examining some other analytical tools and techniques for possible use in a SOCTA
The value of the 5W1H (who, what, when, where, why and how questions)

Threat
The elements of threat; intention, capability etc.
How can we “measure” threat; probability
Practical exercise on assessing threat

Vulnerability
The elements of a vulnerability; harm and control
Considering primary, secondary and tertiary harm
Practical exercise on assessing vulnerability
Part THREE Training for using a SOCTA 51

SWOT analysis
The elements of SWOT; strengths, weaknesses, opportunities and threats
When and to what to apply SWOT analysis
Practical exercise in applying SWOT technique

Day 5
Risk analysis
The elements of risk; identification, analysis and control
Recommendation writing including SMART recommendations
Practical exercise in risk comparison

Indicators and warnings

What are indicators and how do they provide warnings
The art of identifying good indicators
Practical exercise in developing indicators and warnings

Scenario writing
What are scenarios and how might they assist law enforcement
How are they constructed, the key elements of the process
Practical exercise on writing scenarios

Dissemination
The final product; the message and the messenger
Oral and written dissemination

Case study
Reviewing an already completed SOCTA against the training delivered
Final discussion on training. Has it met the expectations of the participants?

114. The need for complementary training of some description for any person or
group of people charged with constructing a SOCTA cannot be overstated. Many of
the concepts, tools and techniques explained throughout this handbook will only be
successfully applied with tuition and “hands-on” experience. Throughout the body of
this Handbook several key words are highlighted in bold. These are elements that
require close attention and will be more fully explained within the training.

115. This training should be tailored to suit the participants taking cognisance of any
existing analytical ability and the environment in which they operate. Thus no two
training courses will ever be exactly the same as the practical exercises throughout the
training should be written with these factors taken into consideration. Upon completion
of this week of training the participant should have enough confidence and competence
to produce a worthwhile SOCTA.
 ANNEX I
Example SOCTA

The following is provided as an abridged example of a SOCTA that might be produced

by using the approach detailed in this Handbook. It should be remembered that each
SOCTA will vary depending upon national circumstance and tasking.

The Serious and Organized Crime Threat Assessment for Country X

Contents No.

Foreword by the Prime Minister or the Minister of the Interior x

Executive summary x

Introduction x

Terms of reference
Tasking x
Methodology x

The current situation

Crime types x
Crime groups x
Current environment x

The threat posed by serious and organized crime

Crime types x
Crime groups x
Future environment x

Conclusions x

Recommendations x
53
54 Guidance on the use and preparation of serious and organized crime threat assessments

Foreword by the Minister of the Interior

It is with great pleasure that I introduce the first national Serious and Organized Crime
Threat Assessment (SOCTA) produced by our State. The SOCTA is, as its name
­suggests, a threat assessment of current and expected new trends in serious and ­organized
crime within our State. The assessment is based upon existing knowledge and expertise
and it is drawn up in order to enable decision makers to take the appropriate action
to counter the anticipated threat.

A great number of people and various organizations have contributed to the production
of the SOCTA. This deserves to be recognized. All national law enforcement agencies
provided valuable contributions as have other institutions at a national level such as
the Department of Social Services. Additionally, a number of third parties provided
valuable assistance in building up the picture of serious and organized crime as it
impacts upon the State. We are additionally grateful to our law enforcement partners
in neighbouring countries for their cooperation. The approach taken in producing this
work has also seen consultation with a number of partners from the private sector and
academia and their cooperation has added significant value to the SOCTA. Nor should
the most valuable assistance of The United Nations Office on Drugs and Crime
(UNODC) be overlooked as they supplied the SOCTA Handbook and associated
training that gave impetus to the entire process.

Finally, and perhaps most importantly, the staff of the State Ministry of the Interior
deserve recognition for their efforts to produce this document. I appreciate and thank
them for their ongoing efforts in the production and development of this significant
and pioneering work. The SOCTA will be an important step to raise the level of coop-
eration between various competent authorities within the State as well as with our other
national and international partners. This will contribute to further develop the common
goals of defeating serious and organized crime.

Executive summary
The threat from serious and organized crime to this State is real. It comes in many
different guises and can have a negative impact in many different ways. This SOCTA
details these threats and prioritizes those anticipated to cause the greatest harm in the
future.

One of the key findings from this SOCTA is the high level of threat that trafficking
in human beings (THB) poses to this State when conducted by international
organized crime groups (OCGs) that are based outside our State but have strong links
inside our State. This is assessed as one of the top three threats that will be posed over
the next five years. This threat has materialized due to the sophistication of OCGs new
to our State who have a history of THB and their desire to exploit the increasing wealth
being generated within the State. The market place for generating profit from prostitu-
tion is a generous one for these OCGs compounded by the fact that the State legislation
against trafficking is weak. This coupled with our state policy of encouraging tourism
and attracting international workers, means there will be a rising demand for sexual
ANNEX I Example SOCTA 55

services which the OCGs are willing to supply. The harm caused is manifold, in par-
ticular the increase in disease, political damage to the reputation of our State interna-
tionally and the increasing links between human and drug trafficking groups causing
further harm within our State. This report recommends that stiffer penalties are intro-
duced for THB offences by adopting the Palermo Convention and launching awareness
campaigns warning sex tourists that their presence will not be tolerated.

Introduction

This report was commissioned by the Minister of the Interior to help inform the
Minister of appropriate courses of action to be taken against serious and organized
crime within this State. It was initiated after discussion with various national and
international bodies and organisations. There has been international recognition that in
order to “join up” the fight against serious and organized crime each State should
endeavour to identify the greatest threats posed to the State from serious and organized
crime. Only by having that type of appreciation can we hope to effectively tackle these
threats on a national and global scale.

Serious and organized crime has a major impact within this State. There is evidence
throughout the country of the misery that drug trafficking has brought. Of the slavery
that trafficking in human beings has created. Of the economic damage that corruption
has delivered. Of the death that arms trafficking has produced. These are all areas in
which serious and organized crime groups thrive and from which they earn their profits.
This report is intended to help identify those threats, place them in a national context,
prioritize them and suggest possible courses of action to help eliminate or reduce those
threats.

Terms of reference

Detailed below is the tasking that was agreed by the Minister of State for the Interior.
The tasking was delivered to the National Police—Analysis Department on the 1 Janu-
ary with a deadline of 30 June. Following the tasking a methodology for the production
of the report was subsequently designed and is reproduced to enhance the readers
understanding of the approach taken.

Tasking definition

The objective of this report is to provide a document which details the current and
future major threats posed to the State from serious and organized crime. In addition
the report intends to give guidance to policymakers on possible courses of action to be
taken to reduce the impact of these threats. It will not cover the area of terrorism nor
the links between terrorism and serious and organized crime. Furthermore the report
does not consider crimes against person or property unless linked to serious and
organized crime.
56 Guidance on the use and preparation of serious and organized crime threat assessments

This report was commissioned by the Minister of State for the Interior to allow him
and his office to enact policies, procedures and—where appropriate—suggest changes
in legislation to improve the national response to the fight against serious and organized
crime.

Resources

The National Police—Analysis Department was charged with producing the SOCTA.
There was a six month time-frame with one full-time analyst and one full-time researcher
along with a project manager assigned to the SOCTA part-time (50 per cent).

Methodology

The methodological approach taken was to produce a situation report by using infor-
mation obtained from various sources that are detailed as footnotes throughout the
report. Due to the sensitive nature of some of the information supplied not all sources
have been disclosed. Interviews were also conducted with various officials currently
involved in the fight against serious and organized crime. A brainstorming session
determined that both the serious and organized crime groups and the crime types that
they are involved in would be identified. A PESTEL analysis was then conducted to
determine the key national environmental factors that facilitated the existence of these
crime groups and crime types. The current national response to these OCGs and crime
types was then identified and a situation report was compiled identifying critical intel-
ligence gaps.

From the situation report a threat19 assessment was constructed. This was achieved
through a combination of different analytical techniques. Further data collection was
conducted around the intelligence gaps identified through the situation report. A SWOT
analysis was performed across the previously identified crime groups to identify com-
mon traits then a criminal business analysis coupled with market analysis assisted in
determining the facilitating factors that allowed crime groups entry to their market
place. Harm analysis then considered the possible impact those threats could have on
society focussing on political, economic and social harm. Risk analysis then takes the
threats identified and—utilizing the data from previous analysis—assesses the probability
of the threat occurring with the overall harm that could be caused. This then provides
a list of prioritized threats around which S.M.A.R.T recommendations are developed.

The indicators for each of the prioritized threats were identified from the data provided
during the data collection phase and grouped together to provide an early
warning system to law enforcement and policymakers. This was further developed into
a number of scenarios that have been written to allow for effective, intelligence-led
policy decisions to be taken quickly.

19
Threat is defined as “some person or group of people with the intention and capability to cause harm to the state and
society”.
ANNEX I Example SOCTA 57

During the analysis certain assumptions have been made; in particular the motivating
factor for individuals involved in serious and organized crime is the generation of profit.
All analysis has been conducted from this perspective and no cognisance is made of
ideological or peer pressure drivers. A further assumption is that the established OCGs
will continue to work together where a connection already exists and will look to
cooperate with other OCGs.

Sources

This is a multi-source document with information being drawn from many different
individuals and with many different organizations participating and contributing. Where
appropriate these are detailed throughout the report.

The current situation

Within this section the analysis is broken down into three main areas looking at crime
types, crime groups and then how that fits into the current environment.

Crime types

Trafficking in human beings (THB) has been reported in 12 of the 14 regional districts
of the country. The majority of identified victims come from country Z and were not
aware that they would be working as prostitutes upon their arrival. The
incidence of sexually transmitted disease within the state is at its highest level ever
recorded and is costing the state US$ 50 million per annum to treat and it is estimated
that organized crime makes over US$ 800 million per annum from this crime.

Drug trafficking has been reported in eleven of the fourteen regional districts of the
country. The types of illicit drugs are numerous however the most prevalent—accounting
for over 80 per cent of reported cases—is heroin trafficking. The intravenous use of
heroin and the sharing of needles by addicts are causing the spread of HIV. This is
costing the state approximately US$ 20 million to treat and organized crime makes
over US$ 500 million per annum from this crime.

Crime groups

The organized crime group (OCG) known as The Bullet Boyz is heavily involved in
the trafficking of human beings (THB). They are based in neighbouring country Z but
conduct most of their criminality in our State and have established good working
relationships with indigenous criminals who are involved in drug trafficking.

An ethnic, indigenous OCG is known to control the vast majority of drug trafficking
into and throughout the state. Recently they have established international links with
another OCG based in country Z known as The Bullet Boyz.
58 Guidance on the use and preparation of serious and organized crime threat assessments

Current environment

At present THB is a relatively low political priority. There is no State funding for any
inter-agency forum—and no inter-agency communication—on THB for sexual exploita-
tion. At present no shelters exist for the victims of THB and more usually the victims
are arrested and fined for practising prostitution and then deported as illegal migrants.
This can drive them back into the hands of their traffickers.

The increasing wealth of our State and the drive to attract international workers and
tourism has increased the appeal of the State to traffickers in human beings. The major-
ity of the money generated from this trafficking business does not stay within the State
as the main group controlling the trafficking is based in country Z.

The state health services are coming under increasing pressure trying to cope with the
increase in sexually transmitted disease. Law abiding members of society are starting to
complain about the increasing number of prostitutes seen on the streets of our major
cities.

The threat posed by serious and organized crime

From information provided it can be assessed that there is an increase in the trafficking
of women into country X for the purposes of sexual exploitation. The number of
interceptions at the border of possible victims has increased by over 20 per cent on last
year and government statistics highlight a growing number of non-indigenous women
with sexually transmitted disease. The International Organization for Migration has also
noted an increasing number of victims reporting to them from country X. This may
be due to a larger numbers of workers from the international community now in
country X along with an increase in gross domestic product and relative wealth of the
indigenous population. All of these can act as pull factors for THB activities. Meanwhile
the national legislation of country X does not recognize trafficking in human beings as
an offence and the national legislature has to prosecute individuals under outdated
kidnap or false imprisonment legislation.

One of the major strengths of The Bullet Boyz OCG involved in THB activities is
their ability to work with other OCGs within our State and use their networks for
mutual assistance. This insight plus the previously identified facts of weak legislation
and low political will to tackle THB and illegal migration where country X is only a
transit country leads to the following hypothesis: The Bullet Boyz OCG use their traf-
ficking victims as drug “mules” to bring drugs into the State for the indigenous OCGs
involved in drug supply and distribution within the State.

Their willingness to cooperate with other OCGs however is a potential weakness that
could be exploited by law enforcement. It may provide an opportunity for an under-
cover officer to be introduced to this OCG given their willingness to deal with many
different individuals.
ANNEX I Example SOCTA 59

The impact that this particular OCG can have on the State is potentially large. It is
assessed that they are expanding their activities beyond THB by forging links with other
OCGs in our State. They are moving into drugs trafficking and this will increase their
sphere of influence. The harm that could be caused to the State includes international
political difficulties as other States may view the flourishing sex trade as indicative of
a poorly run state. Economic damage will be caused as the majority of money gener-
ated from these trafficked victims ends up outside our State and health care and other
social costs have to be met from within the State budget. When compared against the
other threats to the State it is assessed that the threat from this OCG and its involve-
ment in THB activities should be placed within the top three priorities. In order to
monitor this threat there are a series of indicators that can be measured and that have
been identified through the previous analysis. These include:

"" Incidence of sexually transmitted disease

"" Number of migrants intercepted at border crossing points with country Z
"" Number of street prostitutes arrested

Should all of these indictors increase over time then a warning will be generated and
the appropriate State authorities will be informed.

Conclusions
The lack of robust anti-trafficking legislation is doubtless an attractive feature for organ-
ized crime when looking for a place to expand their criminal enterprise. One of the
major strengths of the main group identified as trafficking women for sexual exploita-
tion is their ability to identify and exploit areas of weakness. They are further aware of
the developing demand for sexual services within the State due to increasing national
wealth and the influx of international workers and tourists. They are continuing to
expand their THB business and are using their links with indigenous OCGs to expand
their areas of criminality within the State.

Recommendations
It is recommended that the state enshrines in national legislation the so-called “Palermo
Protocol” aimed at preventing, suppressing and punishing trafficking in persons,
­especially women and children.

It is further recommended that an international awareness campaign is launched ­warning

potential sex tourists that they will be arrested, prosecuted and—if found guilty—
imprisoned for using the sexual services of a victim of trafficking.
 ANNEX II
Analytical approaches20

As noted throughout this handbook the SOCTA is a strategic product but it should
be remembered that there no such entity as “strategic intelligence” or “operational intel-
ligence”. There is only information that is analysed and used for strategic or operational
purposes. There are numerous different analytical tools and techniques that can be used
to develop a SOCTA and some are better suited to providing the appropriate informa-
tion than others but all have aspects which can be applied to SOCTA analysis. Some
of these more suited techniques are briefly described below but it should be recognized
that this is not a definitive nor exhaustive list and that many other tools and techniques
exist.

Criminal business analysis

Criminal business analysis (CBA) recognizes that serious and organized crime operates
as a business to achieve its aims. Analysing how a criminal enterprise conducts its busi-
ness will lead to a deeper understanding of how the criminal enterprise attempts to
achieve its aim. This can then assist in predicting possible future criminal activity,
identifying vulnerabilities in the criminal process and provide areas for further intelli-
gence gathering. To achieve this deeper understanding the analyst must develop a sound
conceptual model of the business activity. This might be achieved by examining how
a legitimate business operates and then comparing that against the criminal enterprise.
Approaching experts in the area may also provide insight for the analyst.

A key part of the methodology for completing a CBA is to consider the “5W1H
questions” i.e. who, what, when, where, why and how. For example:

"" Who are the key members? Who have the specialist roles?
"" What is the nature and scale of the business? What is the organization’s ability
to corrupt?

20
For a fuller and more detailed examination of these and other tools and techniques please see the UK National Policing
Improvement Agency (2008) “Practice Advice on Analysis” www.npia.police.uk/

61
62 Guidance on the use and preparation of serious and organized crime threat assessments

"" When does the activity occur? When does it not occur?
"" Where does the activity occur? Where do key members live/travel etc?
"" Why? This is dependent upon the perspective taken by the analyst and will
have been highlighted in the methodology (financial gain, ideological reasons
etc.)
"" How do members communicate? How have MOs changed over time?

Market analysis

Market analysis aims to identify the criminal market around a commodity or service,
and can be used to describe any criminal market at any level. Similar to criminal
business analysis (CBA) the analyst must develop a sound conceptual model of the
market. Again asking experts in the field and/or identifying previous analysis undertaken
will assist in this understanding.

"" A key part of the methodology for completing a market analysis is to consider
the “5W1H questions” i.e. who, what, when, where, why and how. For
example;
"" Who are the suppliers, customers and victims?
"" What is the nature and scale of the market? What are the supply and demand
drivers?
"" When is the market active?
"" Where does the market operate (location)? Where is it strongest?
"" Why. This is dependent upon the facilitating factors identified through
­PESTEL, SWOT and other relevant analysis techniques.

"" How does the market operate? This is also linked to the facilitating factors
and drivers.

Crime pattern analysis

Crime pattern analysis (CPA) identifies the nature and scale of emerging and current
crime and disorder trends, linked crimes or incidents, hot spots of activity and common
characteristics of offenders and offending behaviour. Useful tools for CPA are maps,
graphs and tables. The main sources of information for CPA are crime and incident
reports. Patterns may be found within the detail of crime and incident reports, such
as the location of the event, the type of property involved, or the method by which
the event was progressed.
ANNEX II Analytical approaches 63

The main advantages of CPA are that it:

"" Determines current, new or emerging problems;
"" Predicts criminal activity;
"" Identifies the most significant offenders in hot spots;
"" Aids linking between committed offences and possible offenders;
"" Focuses intelligence gathering;
"" Highlights preventive, reduction or diversion opportunities;
"" Can be used to make decisions about resources.

Network analysis
Crime network analysis provides an understanding of the nature and significance of the
links between people who form criminal networks, and organizations that interrelate.
It also assesses the strengths and weaknesses of criminal groups or organizations.

Network analysis:

"" Provides a detailed picture of the roles played by individuals, including their
rank in a hierarchy and level of control.
"" Supports the identification of intelligence gaps and subjects to target.
"" Gives an understanding of scale and seriousness of the threat posed by criminal
groups.
"" Shows associations within and outside the network.
"" Identifies key areas and possible tactics for investigation and disruption.
"" Focuses intelligence gathering and provides information for making decisions
about prevention, enforcement or intelligence responses.

Network analysis will often be developed using graphical software to demonstrate the
links between individuals, locations, events and organizations. Charts are a useful brief-
ing tool and will often accompany the final report. Carrying out a piece of network
analysis often triggers the production of other analytical techniques, such as criminal
business analysis and market analysis. Network analysis is also frequently used to ­support
the development of other intelligence products.

Demographic and social-trend analysis

Demographic and social-trend analysis (DSTA) examines how demographic and social
changes within an area or within a demographic group can affect levels and types of
crime and disorder. These changes may be an individual occurrence, such as a live music
event, or may be, for example, a long-term change in either the ethnic make-up or age
profile of a geographical area.
64 Guidance on the use and preparation of serious and organized crime threat assessments

Demographic and social-trend analysis:

"" Can be used to make decisions about resources at a strategic level;

"" Highlights where future pressures on resources are likely to arise;
"" Identifies current or emerging problems;
"" Can be used to improve knowledge in relation to partnership working;
"" Aids the planning process for seasonal or tactical operations in response to
emerging social phenomena or movements of people;
"" Highlights preventive, reduction or diversion opportunities;
"" Helps to focus intelligence gathering;

In developing a DSTA the 5W1H questions are employed and the “what” questions
are of particular value, for example:

"" What is the nature of the trend/change examined?

"" What is the background—ie, the situation prior to the change/trend? Consider
PESTEL issues as well as demographic and crime data.
"" What are the factors that have altered/are likely to alter?
"" What factors may have caused/may cause changes in crime trends or offending
behaviour?

Sources of information for a DSTA often come from outside traditional law enforce-
ment circles and could include;

"" Unemployment levels;

"" Truancy rates;
"" Homelessness levels;
"" Details of socio-economic status;
"" Population growth;
"" Inward and outward population migration;
"" Family size;
"" Types of domestic, business and community premises;
"" Ethnic origin of the population;
"" The age of individuals living in an area.

Indicators and warnings

Indicators—and the warnings that they inform—are the key predictive elements within
analysis. They provide a method for monitoring the current situation for changes that
may have a future impact upon the subject of the analysis. In terms of a national
ANNEX II Analytical approaches 65

SOCTA they provide a “watchtower” from which the analyst can survey the environ-
ment for changes that may have an adverse impact on society from serious and organ-
ized crime.

Indicators are the measurable “facts” upon which the analyst has built their
hypotheses.

Fact: John Smith associates with known criminals.

Fact: John Smith has no visible income.
Fact: John Smith lives a very expensive lifestyle.
Statement: John Smith makes his money from criminality (inductive reasoning).

By monitoring these facts the analyst will be able to identify any changes which, when
taken together, might provide a warning to law enforcement that (further) action should
be taken. For example;

Fact: John Smith associates with more known criminals.

Fact: John Smith still has no visible income.
Fact: John Smith lives an increasingly expensive lifestyle.
Warning: John Smith is making more money from criminality (inductive reasoning).

The basis for developing good indicators is identifying information (facts) that can be
measured and that properly inform the warning. As with all data collection it is
­important to ensure that you ask the right questions, of the right people, to get the
right information. For example, there were a large number of houses being broken into
in one particular area. The police visited all the home owners in the area and asked if
their house was secure, to which the answer was always “Yes”. The police then visited
the local school and asked the home owners children “If you came home from school
and were locked out of your house, could you get in?” To which the majority of ­children
said, “Yes, there is a broken window at the back” or “the spare key is under the mat”,
etc. The more accurate response came from asking the right question of the right
people.

By constructing and then monitoring the right indicators and developing suitable
warnings from associated indicators potential problems can be identified and dealt with
before they become actual problems. This is a truly pro-active, intelligence-led law
enforcement approach to tackling serious and organized crime.

The development of indicators allow for the monitoring of changes that may have an
impact on future threats and vulnerabilities. Scenario writing use indicators to “predict”
which particular scenario is unfolding, thus giving the decision maker an early oppor-
tunity to react to the developing future. It is this technique that allows for the time
element highlighted during risk analysis to be accounted for (paragraph 93). “You don’t
need to know the future. You just have to be prepared for it” (Pericles 55BC).
66 Guidance on the use and preparation of serious and organized crime threat assessments

Scenario writing

Scenario writing is resource intensive and requires a relatively refined analytical skill set
in order to perform it well. Strategic planning, when looking into the future normally
relies on a single, most-likely projection of future developments based on existing
­patterns instead of allowing for a multitude of possible developments. Scenarios are
an option to overcome such limitations. Scenario writing tries to answer two basic
questions;

"" What are the key factors that cause a particular future to develop?

"" What possibilities exist to influence these key steps?

The first stage in scenario writing therefore is to identify the key factors that will impact
upon the future development of the subject area. This should be done using as much
external input as possible ensuring a broad a range of ideas. For example the SOCTA
may have highlighted an increasing threat to society and the state from the trafficking
of human beings (THB) for the purposes of sexual exploitation. The analyst may look
to write a number of possible scenarios around this increasing threat projecting 10 years
into the future. The key influencing factors should be identified and these may include;
demographic changes, improving economy, social acceptance of prostitution, political
indifference, legislative changes, border control management, health issues, global warming,
policing priorities, international pressure, internal trafficking, sex tourism, etc.

Once these factors have been identified they have to be prioritized. This is done through
the process of influence analysis. All the key factors are placed in a matrix and ­compared
against each other.

Figure 15. Influence analysis matrix

A B C D

For example, A could be border control management, B sex tourism, C legislative

change and so on. An assessment is then made on how influential each factor is on
the other factors. Those factors which have the greatest influence over the largest number
ANNEX II Analytical approaches 67

of factors are those that should be prioritized. Having done this the next step is to
determine which of those prioritized factors can be influenced by the state. It would
be difficult for a national government to influence global warming however it can influ-
ence legislative change.

It then falls to the analyst to begin writing the scenarios that may develop using the
key, prioritized factors previously identified. One method is to take the top two of the
prioritized factors and place them along x and y axis with the extremes of both axis
being the opposite of each other. For example:
Figure 16. Four scenarios, four perspectives

Social acceptance

Scenario 1 Scenario 2

Prostitution legalized Prostitution illegal

Scenario 3 Scenario 4

Social non-acceptance

The analyst will now write four scenarios taking four different perspectives. Scenario 1
will consider what the future looks like if prostitution is legalized and is socially accepted.
The scenario will be written using some of the other identified factors. For example
how would legalized, socially accepted prostitution impact upon health issues, organized
crime, sex tourism, etc. Scenario 2 will consider socially acceptable, illegal prostitution
against the same health, organized crime and sex tourism factors, and so on.

Once these scenarios have been written the appropriate indicators are chosen to moni-
tor which scenario is developing, thus allowing for an early warning to be given should
an undesirable future be unfolding. The majority of indicators will already have been
identified through the previous analysis in the SOCTA that highlighted the increasing
threat from THB.

It is the ability to quickly assess which future is unfolding and to then be able to react
to it that makes scenario writing so useful. As previously noted however it is very
resource intensive and for this reason they are still not widely used within the law
enforcement environment.
 ANNEX III
Bibliography

CENTREX (2005)–now National Policing Improvement Agency (UK)—“Guidance on

the National Intelligence Model”.

CLARK Robert M (2006): “Intelligence analysis: A target centric approach” 2nd Edi-
tion ISBN: 978-1-93311-693-8.

COTTRELL Stella (2005): “Critical Thinking Skills: Developing Effective Analysis and
Argument” ISBN: 978-1403996855.

CRIMINAL INTELLIGENCE SERVICE CANADA (CISC) (2007): “Integrated threat

assessment methodology”.

CRIMINAL INTELLIGENCE SERVICE CANADA (CISC) (2007): “Strategic early

warning for criminal intelligence”.

EUROPOL (2008): “European Organized Crime Threat Assessment (OCTA)”.

GALEOTTI Mark (2007): “Global Crime Today: The Changing Face of Organized
Crime” ISBN: 978-0415436670.

Gendarmerie Belge (1996): “Techniques de Problem Solving”.

HARRIS R (2008): “Evaluating Internet Research Sources” (internet).

HEUER Richards J. Jr. (1999): “Psychology of Intelligence Analysis” Centre for the
Study of Intelligence, Central Intelligence Agency ISBN: 978-1594546792.

Institute for International Research on Criminal Policy, Ghent University (2004):

“Measuring organized crime in Europe” ISBN: 978-9062159390.

International Association of Crime Analysts (2004): “Exploring crime analysis: reading

on essential skills” ISBN: 1-59457-980-6.

69
70 Guidance on the use and preparation of serious and organized crime threat assessments

INTERPOL (1997): “Crime Analysis Booklet”.

Law Enforcement Intelligence Unit and International Association of Law Enforcement

Intelligence Analysts (2000): “Intelligence 2000 Revising the Basic Elements” ISBN:
0-9706887-0-9.

McDOWELL Don (1997): “Strategic Intelligence and Analysis—Guidelines on meth-

odology and application” ISBN: 1-876287-004.

McDOWELL Don (2008): “Strategic Intelligence: A Handbook for Practitioners,

Managers and Users” ISBN: 978-0810861848.

National Policing Improvement Agency (2008): “Practice Advice on Analysis”.

PETERSON Marilyn (1990): “Criminal Intelligence Analysis” ISBN:0-912479-07-8.

RATCLIFFE Jerry H (2008): “Intelligence-led policing” ISBN: 978-1-84392-339-8.

RATCLIFFE Jerry H (2004): “Strategic Thinking in Criminal Intelligence”.

SOCA (Serious Organized Crime Agency, UK)(2008): “The UK threat assessment of

serious and organized crime for 2008/9”.

TUSIKOV Natasha & FAHLMAN Robert C (2008): “Threat and Risk Assessments:
A Common Framework”, in RATCLIFFE Jerry H (ed) Strategic Thinking in Criminal
Intelligence (2nd edition) (2009).

UNODC (2005): “Transnational Organized Crime in the West African region” ISBN:
92-1-148195-3.

VAN DER HEIJDEN Toon & KOLTHOFF Emile (1992): “Crime Analysis—a tool
for crime control” (Proceedings of the First International Crime Analysts Conference)
ISBN: 90-74555-01-2.
Vienna International Centre, P.O. Box 500, 1400 Vienna, Austria
Tel: (+43-1) 26060-0, Fax: (+43-1) 26060-5866, www.unodc.org

Guidance on the preparation and use of

serious and organized
crime threat assessments

Printed in Austria
The SOCTA Handbook
V.10-54768—July 2010