The intelligence cycle: five stages that keep casework honest

Direction, collection, processing, analysis, dissemination. The five-stage intelligence cycle comes from military and national-intelligence doctrine, and it predates the internet. It has outlived every tool that was supposed to replace it, for a dull reason: it was never about technology. It is a discipline for deciding what to gather and when to stop, and no amount of software has taken that decision off anyone's desk.

Five stages, one loop

Direction sets the requirement, the question someone actually needs answered, phrased tightly enough to bound everything that follows. Collection gathers material against it. Processing turns the raw take into something an analyst can work with. Analysis turns that into a judgement. Dissemination puts the judgement in front of the person who asked, and their reaction, the follow-up question or the decision that changes the situation, becomes the next requirement. Each stage is a decision about scope, which sounds administrative until you remember that scope is where budgets and legal exposure live. Some doctrines count six stages by splitting evaluation and feedback into a step of its own; the substance is the same. The thing to hold onto is the loop, not the list.

The cycle in an open-source engagement

Say a client asks whether a prospective distributor has ties to a sanctioned entity. Here is the model earning its keep in open-source work:

1. Direction. The requirement is written as a question with scope attached: which entities, which jurisdictions, what counts as a tie. This is also where the lawful basis for handling personal data gets documented, before the first search runs. A requirement that takes a morning to phrase well routinely saves days of collection.
2. Collection. Registers, filings, news archives, platform data, gathered against the question and nothing beyond it, with provenance recorded at capture.
3. Processing. The unglamorous middle: normalising names across alphabets and transliterations, translating, deduplicating, extracting entities so that "J. Novak", "Janez Novak" and a directorship record resolve to one person, or demonstrably don't.
4. Analysis. Corroboration across independent sources, contradictions surfaced instead of smoothed over, and a confidence level attached to every judgement the report will carry.
5. Dissemination. A product someone can act on: an assessment with reasoning, not a folder of captures. The decision it informs, and the questions it raises, come back as new direction.

The circle was never literal

Practitioners have picked at the tidy diagram for decades, with cause. Real casework iterates and overlaps: analysis exposes a gap, collection reopens, processing reruns over material captured on day one. Nobody works the stages in single file, and on a live case the whole loop can turn several times in a day. That criticism misses what the model is for. It is a checklist against skipped steps, not a workflow. Teams that collect before a requirement exists hoard noise and GDPR exposure. Teams that let raw captures masquerade as findings push shallow judgements downstream. The cycle names each step so its absence becomes visible, and in casework the absences are what hurt.

The loop is also where quality control lives. Feedback is not a courtesy round; it is how the next tasking gets sharper than the last, and a report that draws a pointed follow-up question has done more than one that merely closes a ticket. There is a simpler test buried in all of this, and it costs nothing to run: name your requirement. If you can't, you are browsing, not collecting.

Frequently asked questions