A Rough Guide to Threat Assessment by slappypappy123


									Environment Agency for England and Wales July 2006

Conducting a Threat Assessment of Illegal Trans-frontier Waste Shipments – A Short Guide
Richard Parker, Environment Agency “The purpose of a threat assessment is to inform collective understanding of a threat and enable action” (UK National Criminal Intelligence Service – 2004).

1. Introduction Governments and their agencies need to understand the threats to their economies, environment and the safety of their citizens. They do this by conducting ‘threat assessments’ which enable them to take action to reduce the impact or the potential impact of the threat. In some circles, Threat assessments may also be called ‘Strategic Assessments’ or ‘Strategic Intelligence Assessments’, and come under the general term of ‘Strategic Intelligence’. There is no universal method for conducting a threat assessment but most Government intelligence agencies have developed their own methods. The information in this guide is based upon methods used by UK’s National Criminal Intelligence Service and experience from the Environment Agency for England and Wales in using these methods to examine environmental crime. This guide is merely a starting point for developing threat assessments. It does not replace the need for establishing an intelligence unit, which can carry out these tasks regularly and to high professional standards (see Appendix 1).

1 of 16

Environment Agency for England and Wales July 2006 2. Conducting a Threat Assessment of Illegal Import/Export of Waste The following outlines some simple steps to help develop a threat assessment. For further information see appendix 2. The production of the assessment should comprise 4 stages; scoping, data collection, analysis and dissemination. It is best managed as a project, and the following project structure is suggested;       Project Manager – normally the manager of the unit producing the work Analyst – the person who will do most of the analytical work Researcher/intelligence officer – person to gather and evaluate information prior to analysis Client representative – somebody to represent the interests of the main customer for the work Specialist representative – depending upon the experience of the panel it may be necessary to increase expertise on the project team. Law Enforcement representative – if the organisation producing the report is not the one which will take enforcement action.

The project approach helps to ensure it is a collectively shared assessment rather than one produced by a single analyst. a) Scoping 1. State the purpose of the report and who the ‘customers’ are. Define your audience tightly, there may be many interested parties, but who is actually going to take action upon receiving the assessment? This will have a significant bearing on the scope and level of detail required. 2. Define the scope of the work. Are you interested in all waste streams? What’s the geographical boundary? Your country? Your region? What offences are you interested in? What’s your time-scale? Long term? Short term? Try not to be to narrow in your first piece of work, an initial assessment would generally be ‘broad but shallow’ to identify all relevant issues, with subsequent work on individual problems being ‘narrow and deep’. 3. For each area of crime you should consider the following questions; 1. What illegal activity is taking place? What is the level and scale of it? Numbers of offences? Seriousness of these offences? 2. What’s the actual and potential impact of the crime? Consider impact both in country of origin and country of destination? Consider impact on the environment, public health, economy, politics (e.g. reputation), and social impacts. 3. Where is the crime occurring? Are there any ‘hotspots of activity’? Consider each part of the waste chain; where is the waste being produced? What transport route does it follow? And where is it disposed of? 2 of 16

Environment Agency for England and Wales July 2006 4. Who is committing the crimes? What do know about them? Can we profile the offenders? (they may fall into different categories, which require different approaches). Organised groups? Different ethnic groups? What other crimes are they involved in (this may offer opportunities for joint working with other law enforcement agencies). Again consider stages in the waste chain; the producers, the brokers, the carriers and the disposers. Some may be unwittingly committing crimes, others very deliberate in their actions and some may fall inbetween. For each group consider their locations, contacts, strengths and vulnerabilities. 5. Why do people commit the offences? What are the gains to be made? Money? Power? Are they committing the crimes as part of other crimes (car theft for example) or to facilitate illegal movement of other goods (drugs). Are they forced into non-compliance through complex regulations and ignorance? 6. How are they committing the offences? What methods do the criminals use to commit the crimes? How do they conceal their activities? How are they organised? 7. How big is the market for the waste? What is the current market value for the products being traded? What’s the historical trend? 8. What is the current risk of getting caught? If offences are detected what’s the likely punishment? How does this compare with the gains to be made? 9. What is the current enforcement response? How much effort goes into detecting and preventing the crime? How effective is this? Is it measured? What tactics and strategies have been tried? Having gathered information about the current nature and scale of the crime, its necessary to try to outline future scenarios for the crime. It is not advisable to try to predict one future but outline a series of scenarios which together bracket all possible futures.  In order to do this its important to understand historic trends in offending over time. Has it got worse? Better? Have there been specific points at which changes have occurred? New legislation? Changes to market values? Changes to enforcement tactics? Look for potential impacts in the future. These might include legislative change (not just in TFS regulation, but in related areas), consumer trends (mass purchasing of LCD TVs for example is driving a significant trade in second-hand CRT’s), enlargement of the EU, new trade routes from emerging economies which may mean more empty shipping containers returning. Changes to enforcement in neighbouring countries which may cause displacement of the activity to your country.


b) Data Collection Having scoped the work, compile a data collection plan. Table 1 shows a section from a data collection plan.

3 of 16

Environment Agency for England and Wales July 2006 Table 1 - Section from a Data Collection Plan for Illegal TFS Information requirement Details of offenders and their activities Source(s) Regulator database Police database Interviews with enforcement staff Method Direct interogation Information request Structured interview by phone Will require separate requests to different forces. Notes

Information from Email to ‘trusted’ Industry sources companies.

Guarantee confidentiality.

Interviews with previous offenders Information on market values and trends for specific waste streams

Phone or face to face interview

Could use a third party (consultancy/university) . Pose as potential buyer, phone needs to be untraceable. Seek legal advice on methods.

Industry journals Internet Trade bodies Direct request Waste Telephone survey producers and brokers

This can be repeated for each data requirement. Where opinions are received from individuals they should be evaluated according to the source and whether it is corroborated elsewhere. The standard method for doing this is called the 5x5x5 evaluation. This method has 3 components, each of which has 5 criteria. The components are Source (what do you know about there person supplying it?), Intelligence (how does it fit with what you already know?) and Handling (how should the information be disseminated to others?). Each piece of information is given a code based on these three components, appendix 3 contains further information on the system.

c) Analysis Detailed instructions on how to analyse the data are beyond the scope of this guide, and more specialist literature/or training is recommended (see appendix 2). The skills of the analyst are paramount here and these include critical thinking, statistical analysis, mapping and charting, in addition to some theorectical knowledge of criminology. The real skill in analysis is moving

4 of 16

Environment Agency for England and Wales July 2006 from descriptive data and information to actionable intelligence (often referred to as moving from description to deduction).

d) Dissemination It is normally useful to produce two documents an unclassified one which can be publicly disseminated and a RESTRCITED or CONFIDENTIAL version for limited circulation amongst law enforcement. Dissemination needs to be planned. Carefully consider the actions you want taken as a result of the assessment, delivery by presentation and discussion will probably be required with the client. The analyst is usually the best person to deliver the results, as it is largely their work.

5 of 16

Environment Agency for England and Wales July 2006 APPENDIX 1 - Requirements of a National Intelligence Unit The best way to produce threat assessments (and other intelligence work) is to establish a dedicated intelligence unit with trained intelligence analysts. This allows information networks to be developed and maintained and assessments to be produced on a regular basis. The following summarises the basic requirements, and is taken from guidance on the UK’s National Intelligence Model. People: A typical intelligence unit might comprise an intelligence manager, one or more intelligence analysts, a researcher and administrative support. Larger units may have a dedicated data manager. The staff require specialist training to understand how to research, collate and analyse intelligence and present it to decision makers. Systems: Intelligence work can be done without IT systems, however they do make life a lot easier! The unit should be able to pull data from various systems, combine it and then use graphical tools to display relationships, patterns and trends. These tools include spreadsheets, mapping tools (Geographical Information Systems) and charting tools (to show links between people, places, vehicles etc.). Ways of working need to be developed which ensure that information is handled and stored securely. Information sources: The unit needs access to a wide range of data and information. It may be necessary to change how and what data is collected and in what form and this will be an ongoing task for the unit as intelligence assessments identify new information requirements. This guide suggests potential sources of information. Agreements to allow access to externally held databases may need to be developed. Knowledge: Staff need to develop knowledge of and have access to legislation, protocols, codes of practice, information sharing agreements etc. They also need to have a knowledge of previous work and its results. It therefore important that prevention and enforcement work is regularly reviewed and results are documented and accessible to analysts. Underlying all this is the intelligence process. It is important to put in place processes so that intelligence is used to inform decision making at the right level. The intelligence unit is only part of the process, many other players are required, both within and outside of the organisation to ensure each part of the intelligence cycle (figure 1) is followed;

6 of 16

Environment Agency for England and Wales July 2006

Results of intelligence work must be presented to decision makers and it is important to establish regular meetings for this. These meetings will be required at both a national and local level. The chair would normally be the national/local director or manager who is able to allocate resources to the identified problems. The intelligence process should be outlined in a document, with links to other relevant documents such as legislation, codes of practice etc.

7 of 16

Environment Agency for England and Wales July 2006 APPENDIX 2 – Further Reading There are many texts on Strategic intelligence, but one of the most respected authors in this field is Don McDowell, an Australian who runs an intelligence consultancy and training company called the Intelligence Study Centre; http://www.intstudycen.com/Publications/body_publications.html The UK National Intelligence Model is a business process for intelligence-led policing that has been adopted by all UK police forces. Many other areas of law enforcement and regulation have also adopted intelligence-led approaches based on the concepts and standards in the model. The latest guidance on the model is available at; http://www.acpo.police.uk/asp/policies/Data/nim2005.pdf Some work has been done towards creating a single European intelligence model, but I have been unable to find anything recent on this; http://www.tulliallan.police.uk/downloads/pdf/imbook.pdf

8 of 16

Environment Agency for England and Wales July 2006 APPENDIX 3 – Environment Agency Internal Guidance on Intelligence The following guidance has been developed to help Environment Agency enforcement staff gather and record intelligence, it is reproduced here in full;

Work Instruction Criminal Intelligence – Recording, Disseminating and Using
Number: 27_06 Status: Richard Logan Tom Tarling Richard Parker Richard Logan Version 1 Issue Date: Post: Post: Post: Post: 26/01/2006 Review Due: 01/08/2006

Document Owner: Document Author: Primary Contact: Approved by:
(as set out in Schedule B of the NFSoD)

Process Manager, Incidents & Enforcement Information Officer Environmental Crime Service Manager Process Manager, Incidents & Enforcement


To ensure that criminal intelligence is recorded, assessed, disseminated and used by Enforcement Teams in a secure and controlled manner, using the resources and systems at present available in the Agency. To make intelligence available to aid in enforcement operations.


This document defines „intelligence‟ and sets the minimum standards for: 1. Recording criminal intelligence. 2. The security of intelligence. 3. The evaluation and assessment of intelligence and risks. 4. The dissemination of intelligence. 5. The ethical use of intelligence. Security Guidance Manual National Intelligence Model The Code of Practice for the Recording and Dissemination of Intelligence Material Data Protection Act Policy Data Protection Act Procedure Five Minute Guide Criminal Intelligence - for Managers & Team Leaders of Intelligence Officers Five Minute Guide Criminal Intelligence – Recording, Disseminating and Using 5x5x5 Form A&B Risk Assessment Form C

Related Documents:

If you have any queries on the content of this document or suggestions for improvement, refer to the Primary Contact named above.

If any term or acronym used in this document is unfamiliar you might find the definition in the Glossary on Easinet: Information Resources > Glossary of Terms and Acronyms.

9 of 16

Environment Agency for England and Wales July 2006 1. Introduction 1.1 A robust system for managing criminal intelligence should be at the centre of all law enforcement bodies. Such a system can be used to understand criminal activity which, in turn, informs the prevention and detection crime at both operational and policy levels. 1.2 In order to be of use, intelligence must be properly evaluated and its worth assessed. The emphasis must be on the integrity of its use. The management of intelligence should be conducted in a secure environment by officers with the correct training. 1.3 When information is processed into intelligence it can affect peoples lives and businesses. The collection and use of intelligence is governed by a number of pieces of legislation; the most important being the Data Protection Act 1998. This act demands anyone holding or processing intelligence should be able to demonstrate a justified need, appropriate use and correct handling.

2. Definitions 2.1 Criminal Intelligence is "any information that has been collected, analysed and then disseminated with the aim of preventing, detecting or disrupting crime and non-compliance.” 2.2 Information is “unevaluated material of every description that when processed can result in the production of intelligence.” 2.3 Standard Grounds means the grounds under which officers may record and disseminate intelligence material as laid out in section 1.8.2 of the Code of Practice for the Recording and Dissemination of Intelligence Material. 2.4 Code of Practice refers to the Code of Practice for the Recording and Dissemination of Intelligence Material 2.5 Sources are the originators of the information which is turned into intelligence. These may be human or technical - such as cameras or recordings.

3. Recording and Evaluating Intelligence 3.1 The management of criminal intelligence should be carried out by Area Environmental Crime Teams. Within these teams one person will be designated as the Intelligence Officer. It is the Intelligence Officers responsibility to record, evaluate and diseminate criminal intelligence 3.2 The decision to create an intelligence record on any individual requires adherence to both the Data Protection Act 1998 and the Human Rights Act 1998. Recording intelligence must be justified and properly controlled.

10 of 16

Environment Agency for England and Wales July 2006 3.3 The Standard Grounds test should always be applied. The test allows recording where it is: „likely to be of value for the prevention and detection of crime and disorder when the recording is done in a manner which is compliant with the Data Protection Act 1998.‟ 3.4 Before intelligence is recorded this must be properly authorised and an assessment made of the risks of its use and the risks to the data subject (see 3.5, 5, 6.3 & 6.4)

3.5 When recording intelligence material the officer must be satisfied that:    The activity conforms to the standard grounds (see 3.2) The intelligence material to be recorded into systems has been properly evaluated via the 5x5x5 system (see section 8), and where appropriate, sanitised and its worth established; Where the intelligence material is to be recorded into systems for later action, it has been assessed for risks from its potential disclosure in court proceedings. In most cases it will be sufficient to have sanitised the intelligence and considered Public Interest Immunity where this is relevant.

3.6 Until a national intelligence system has been implemented, Intelligence Officers will record intelligence material collected using the criminal intelligence systems currently in use. These will consist of electronic systems, databases and spreadsheets and paper based systems 3.7 Criminal intelligence will be evaluated by using the 5 x 5 x 5 system and the national intelligence report form will be used for this purpose. There are two forms;   The Intelligence Report. (live link to 5x5x5 form A) The Intelligence Report Continuation Form (live link to 5x5x5 form B)

3.8 Intelligence should be sanitised by removing material that may identify a sensitive source. Officers should guard against putting material into intelligence reports that adds no value or leads to the identification of a source. Where an officer is concerned that the contents of a report might identify the source, reference should be made to their Line Manager prior to onward dissemination or entry onto an intelligence system. (see section 9)

4. Security of Intelligence Data Every officer of the Agency is responsible for protecting information and assets in their custody. 4.1 A clear desk policy should be adopted. All sensitive materials should be in held in a secure locked container when not being used. 4.2 All cabinets used for storing intelligence and sensitive information should be locked at the end of the working day or when left unattended should preferably be 11 of 16

Environment Agency for England and Wales July 2006 in a locked room. Restricted items should be secured by one lock, confidential material by two locks. 4.3 When a computer system is used for storing intelligence or other sensitive information the system should be password protected and closed when not being worked on. Computers should not be left unattended with such systems open/running. 4.4 Intelligence held in paper format should disposed of by shredding, prior to recycling

5. Points to Consider Law enforcement agencies need to be able to satisfy themselves that the use of intelligence is justified and properly authorised. Before recording or disseminating intelligence the following questions should be asked:          Is the action proportional to the problem it is intended to solve? Does it comply with the Standard Grounds? Does the intelligence contain material relating to persons other than the target and if so has collateral intrusion been considered? Is there risk of personal injury to the target, or a law enforcement officer? Is there a risk of an intelligence led operation leading to potential injury to a officer? Have all risks relating to the source of the intelligence been considered? Is there a risk to the reputation or the community relations of the Environment Agency should the intelligence be exposed? Will the retention or dissemination of the intelligence risk compromising covert techniques, current operations (of both the Environment Agency and other law enforcement bodies) or a source? Have any special restrictions been placed on the intelligence, for example, by the officer who supplied the information?

6. Disseminating Intelligence 6.1 Intelligence Officers within the Environmental Crime Teams are the authorising officer for the dissemination of intelligence material to other United Kingdom law enforcement agencies 6.2 Subject to the provisions of paragraph 6.3 below, an officer may disseminate intelligence material to:  Statutory United Kingdom law enforcement agencies  The Security and Intelligence Services  United Kingdom agencies, other than statutory law enforcement agencies, that are prosecuting agencies.

12 of 16

Environment Agency for England and Wales July 2006 6.3 Before disseminating intelligence material in accordance with paragraph 6.2 the Intelligence Officer must be satisfied that the dissemination;  Conforms to the standard grounds as set out in paragraph 1.8.2 of the code of practice;  Concerns intelligence material that has been properly evaluated using the 5x5x5 system and the dissemination complies with this system and the worth established;  Has been assessed for risks attaching to its use or from its potential disclosure in court proceedings. 6.4 When disseminating intelligence material to an external body the Intelligence Officer should complete the Risk Assesment Form C (live link to form). 6.5 Dissemination of material should be logged with a record kept of what was disseminated, to whom and the purpose of the dissemination.

7. Retention of Intelligence Material

7.1 All data and information must be handled in accordance with the Data Protection Act 1998, the Criminal Procedures and Investigations Act 1996 and the Code of Practice for the Recording and Dissemination of Intelligence Material 7.2 All material gained and recorded for intelligence purposes must be subject to review, weeding and disposal procedures. Material that no longer serves a purpose under the Standard Grounds should be destroyed. 7.3 Intelligence material should usually be destroyed after 3 years. In the case of intelligence connected to offenders with a conviction this is extended to 5 years.

8. 5x5x5 System For Evaluating Intelligence. The 5x5x5 system is a government standard which provides a framework for evaluating the source, content and handling of dissemination of each piece of intelligence. It is used by all Law Enforcement Agencies in the European Union. Source Evaluation

There is no doubt of the authenticity, trustworthiness and competence of the source, or the information has been supplied by an individual who in the past has proven to be reliable in all instances. Examples might include technical deployments or information known directly by law enforcement officers. Information in the past has always been 100% accurate.

13 of 16

Environment Agency for England and Wales July 2006 Sources where information in the past, has in the majority of instances, proved to be reliable. Examples might include contacts whose information has been proven correct the majority of times but not enough to warrant an A grading.

Sources where in the past information , in the majority of cases, has proved unreliable. In the past some supplied information has proved correct - however in the majority of times it has been incorrect. Information should not be acted upon without corroboration. This evaluation might also be assigned to a product from a technical deployment where the quality of recording is poor.

Examples might include individuals who have routinely proven unreliable in the past, or there is some doubt about the authenticity, trustworthiness or competency. For instance the information is known to be second or third hand.

This does not necessarily mean that the information is unreliable but should nonetheless be treated with caution. Corroboration should be sought.

Evaluation of Intelligence Items of intelligence from the same source that relate to different subjects or persons should be recorded on separate intelligence reports. 1 = Known to be true without any reservation Examples might include products of technical deployments or events directly witnessed by law enforcement officers. Care should be taken when utilising this code. For example whilst an officer might overhear a conversation been two suspects and the report is an accurate record of this conversation the intelligence might not be accurate as the source might be repeating hearsay or might be lying. 2 = The Information is known personally to the source but is not known personally to the reporting officer 3 = The information is not known personally to the source but is corroborated by information already recorded. 4 = The information is not known personally to the source and it cannot by corroborated in any way. In this case the value of the intelligence cannot be judged. 5 = Suspected to be false. Action should be taken with extreme care and the corroboration sought be sought from a more reliable source. In addition information of this nature can be useful in

14 of 16

Environment Agency for England and Wales July 2006 'knowing your enemy' however it must always be correctly and clearly graded and risk assessed prior to inclusion in any intelligence system. Handling codes for onward Dissemination of Intelligence Material Code 1 = Permits dissemination to other law enforcement and prosecuting agencies. This code also permits dissemination to law enforcement agencies within the European Economic Area (EEA) plus those outside the EEA where adequate safeguards for the rights of individuals exist. Code 2 = permits dissemination to non-prosecuting parties in the United Kingdom. For example credit card companies and commercial organisations. Code 3 = permits dissemination to non-EEA law enforcement agencies where no adequate safeguards for the rights of individuals exist. This should be disseminated only on grounds of substantial public interest and after consultation with your line manager Code 4 = permits dissemination but only within the originating organisation Code 5 = no further dissemination: refer to the originator. Special handling requirements have been imposed by the officer who authorised collection. It is expected that Public Interest Immunity will be made to protect this intelligence and the potentially sensitive source.

9. Examples of Sanitisation. Example 1

Yesterday I met John Clarke at 17:00 hours at the Fox and Hounds public house. He said that the day before he was round at Frank Smith's place and he overheard him telling someone to 'dump the asbestos in the normal place'. John Clarke dialed 1471 on the phone and the number that came back was 01234 456789.

The intelligence report places the source at a known location at a known time and could lead to their identification. It also highlights that the source is known personally to the reporting officer.

Best Practice

Intelligence suggests that Frank Smith is involved in the illegal disposal of waste. He has an associate who uses the following telephone number: 01234 456789.

15 of 16

Environment Agency for England and Wales July 2006 Example 2

As part of the covert surveillance operation 'Mercury' a fixed camera installed at premises overlooking 1 High Street, Anytown recorded John Doe calling on the operational target, Fred Jones, and handing over a envelope which appeared to contain bank notes. This was timed at 11:00 hours on Tuesday the 12th of February 2005.

This reveals a technical source and might reveal its location. In addition it states that an active operation involving covert surveillance is ongoing against the target.
Best Practice

Intelligence indicates that John Doe handed over a package, thought to be bank notes, to Fred Jones on the 12th of February 2005. Example 3

Mrs Joan Smith rang at 23:30 hours on February 12th to report that her friend Miss Sally Jones, landlady of the Red Lion Hotel, had mentioned that she was offered salmon by Tommy Smith and an unknown associate. The unknown associate stated that the salmon were 'fresh from the river Teifi‟. Believing the fish to be poached she refused. Miss Jones noted that the pair drove off in a white transit, A123ABC.

The report identifies both the initial source of the information and the identity of the person making the report.
Best Practice

Intelligence suggests that Tommy Smith and an unknown associate are illegally taking salmon from the River Teifi. They are using a white transit, A123ABC, a vehicle registered to a John Doe of 7 High Street, Anytown.

16 of 16

To top