Knowledge Management Processes
3.3 An Intelligence Use Case Spiral
While Nonaka and Takeuchi focused on knowledge creation in the business and product-development areas, we can see how the knowledge-conversion spiral describes the exchanges within a typical intelligence application. To illustrate
Table 3.7
Conditions that Enable Knowledge Creation Enabling
Condition Condition Definition Implementation in the Intelligence Enterprise Intention Organization’s shared
vision and aspiration to meet its goals
Intelligence vision and implementing strategy to achieve the vision articulated to, understood by, and embraced by entire organization
Organizational commitment to vision (goal) and strategy (plan)
Autonomy Individual liberty of team members in thought, exploration, and action
Establish loose team charters
Allow teams to establish their own boundaries
Provide teams broad access to data; allow independence in choosing areas of focus
Redundancy Internal overlapping of information about activities, responsibility, and purpose.
Share redundant information from multiple perspectives Create and maintain alternative and competing hypotheses Conduct internal, competing analyses
Rotate personnel to different organizational assignments to expand perspectives (e.g., analysis, field operations, field visits, customer liaison)
Requisite Variety
Internal diversity of the organization; diversity is matched to the complexity and variety of the environment
Maintain a flat, highly networked organizational structure Assign diverse disciplines to problems matched to the problem scope (e.g., cross-functional analytic teams such as analysis, operations, academics, or field personnel) Creative
Chaos
Introduction of actions to stimulate beneficial interaction between the organization and its environment
Punctuation of habitual states of behavior and noncreative equilibrium conditions
Reconsideration of existing premises and frames of discernment (mindsets)
Reflection on purpose
how the spiral operates in an intelligence environment, we follow a future fic- tional, yet representative, crisis situation in which U.S. intelligence is confronted with a crisis in a failing nation-state that threatens U.S. national interests. We follow a distributed crisis intelligence cell, using networked collaboration tools, through one complete spiral cycle to illustrate the spiral. This case is deliberately chosen because it stresses the spiral (no face-to-face interaction by the necessarily distributed team, very short time to interact, the temporary nature of the team, and no common “organizational” membership), yet illustrates clearly the phases of tacit-explicit exchange and the practical insight into actual intelligence- analysis activities provided by the model.
3.3.1 The Situation
The crisis in small but strategic Kryptania emerged rapidly. Vital national inter- ests—security of U.S. citizens, U.S. companies and facilities, and the stability of the fledgling democratic state—were at stake. Subtle but cascading effects in the environment, economy, and political domains triggered the small political lib- eration front (PLF) to initiate overt acts of terrorism against U.S. citizens, facili- ties, and embassies in the region while seeking to overthrow the fledgling democratic government. The PLF waged information operations—spreading rumors via e-mail, roaming AM radio broadcasts, and publishing black propa- ganda on the Internet. The PLF also corrupted Kryptanian government infor- mation systems to support false claims of political corruption. A crisis intelligence analysis cell is rapidly formed, comprised of the following globally distributed participants:
• Five intelligence officers in Washington, D.C., including a team leader and four analysts with experience in the country and language skills;
• Six political scientists with expertise in Kryptania in four universities (three in Europe, one in the region);
• Two Kryptanian expert consultants at a regional think tank abroad;
• Four field intelligence officers (surged to seven within 3 days) in Kryptania;
• Six Kryptanian government security officials in Kryptania.
The crisis team is formed and all participants are notified and issued public/
private keys (at their appropriate access levels) to crisis collaboration portals/
collaboration workspaces on computer networks. The first portal is a secure col- laborative workspace (a specially secured virtual private network on the Internet) for sensitive but unclassified (SBU) information access by the academics and
consultants. A separate multilevel security (MLS) portal is formed on classified networks for those with access to classified intelligence data. A securedata pump moves the SBU data onto the classified portal; an automatic classification reviewer sanitizes and passes unclassified data down to the SBU portal. The cus- tom portal/collaboration capability provides the distributed team a workspace allowing:
1. Interactive discussion areas (spacesore-rooms), organized by issue areas:
collection, threats, gaps, and analysis;
2. Teleconference capability (secure audio or video conferencing for use between individuals one to one, for broadcast one to many, or for broadcast to the entire group);
3. General e-mail between members, instant mail, or broadcast postings for the entire group;
4. Group bulletin board organized by issue areas;
5. Structured group repository (database) to allow members to post acquired data, intermediate products of analysis, and annotations on intermediate products;
6. Shared application tools that allow shared analysis (passing control from user to user) and annotation of data.
In addition, the portal provides MLS access to the crisis team’s shared knowledge base, including:
1. Alerts and changes in situation status and impact on team priorities and mission;
2. Organized open source news and intelligence headlines provided at multiple levels of security (open source to classified, respectively) and continuously updated. Headlines are linked to full reports for drill down; related reports are automatically cross-linked. Open-source reports are annotated (i.e., source authority, pedigree, or confidence);
3. Basic country data for Kryptania and other regional countries (e.g., maps, government organizations, points of contact, and political, mili- tary, economic, business, and technical data);
4. Links to open (Internet) and closed sources (intelligence net) of information;
5. Access to relevant open- and closed-source intelligence databases;
6. Schedules (e.g., planned team same-time socialization meetings or report due milestones);
7. Analytic tools that can be accessed and applied to the group or indi- vidual data.
The team composition includes a diverse mix of intelligence officers, trusted academics, and Kryptanian government officials (requisite variety and redundancy within the limits of security), along with a common vision to understand and mitigate the threat. The team is provided a loose charter to identify specific threat patterns, organizations, and actions (autonomy); the cur- rent crisis provides all the creative chaos necessary for the newly formed team.
This first spiral of knowledge creation (Figure 3.6) occurs within the first several days of the team’s formation.
3.3.2 Socialization
Within 10 hours of the team formation, all members participate in an on-line SBU kickoff meeting (same-time, different-place teleconference collaboration) that introduces all members, describes the group’s intelligence charter and pro- cedures, explains security policy, and details the use of the portal/collaboration
3 1
Crisis team define problem apply experience
learn
2 Enter filters, search and retrieval
keys for needed data
3 Automated combination and
analysis of data in databases 4
4 View, conceive, and understand explanations and
patterns
Knowledge- base models Crisis
Figure 3.6 Intelligence-use case spiral example.
workspace created for the team. The team leader briefs the current situation and the issues: areas of uncertainly, gaps in knowledge or collection, needs for infor- mation, and possible courses of events that must be better understood. The group is allowed time to exchange views and form their own subgroups on areas of contribution that each individual can bring to the problem. Individuals express concepts for new sources for collection and methods of analysis. In this phase, the dialogue of the team, even though not face to face, is invaluable in rapidly establishing trust and a shared vision for the critical task over the ensuing weeks of the crisis. Over the course of the next day, several total-group and sub- group teleconferences sustain the dialogue and begin to allow the members to exchange tacit perspectives of Kryptania, approaches to understanding the threats, and impressions of where the crisis might lead. This process of dialogue exposes the diversity of mental models about the threat and even the different interpretations of the group’s charter (the organizational intention). As this hap- pens, the team begins to request additional source or types of information on the portal and starts to record requests, impressions, needed actions, and needs for charter clarifications (questions about the “boundaries” of the problem and restrictions on access) on the bulletin board.
3.3.3 Externalization
The initial discussions lead to the creation of initial explicitmodelsof the threat that are developed by various team members and posted on the portal for all to see, including:
1. Structure charts of the PLF and possible linked financial supporters and organized crime operations;
2. Lists of likely sources of the black propaganda;
3. Map of Kryptania showing cities of greatest influence by the PLF and supporters;
4. Time history of PLF propaganda themes and terrorist activities;
5. Causal chains of past actions and hypotheses of possible future course of FLP actions.
The team collaboratively reviews and refines these models by updating new versions (annotated by contributors) and suggesting new submodels (or linking these models into supermodels). This externalization process codifies the team’s knowledge (beliefs) and speculations (to be evaluated) about the threat.
Once externalized, the team can apply the analytic tools on the portal to search for data, link evidence, and construct hypothesis structures. The process also allows the team to draw on support from resources outside the team to conduct
supporting collections and searches of databases for evidence to affirm, refine, or refute the models.
3.3.4 Combination
The codified models become archetypes that represent current thinking—cur- rent prototype hypotheses formed by the group about the threat (who—their makeup; why—their perceptions, beliefs, intents, and timescales; what—their resources, constraints and limitations, capacity, feasible plans, alternative courses of action, vulnerabilities). This prototype-building process requires the group to structure its arguments about the hypotheses and combine evidence to support its claims. The explicit evidence models are combined into higher level explicit explanations of threat composition, capacity, and behavioral patterns.
Initial (tentative) intelligence products are forming in this phase, and the team begins to articulate these prototype products—resulting in alternative hypothe- ses and even recommended courses of action for the United States and Kryptania.
3.3.5 Internalization
As the evidentiary and explanatory models are developed on the portal, the team members discuss (and argue) over the details, internally struggling with accep- tance or rejection of the validity of the various hypotheses. Individual team members search for confirming or refuting evidence in their own areas of exper- tise and discuss the hypotheses with others on the team or colleagues in their domain of expertise (often expressing them in the form of stories or metaphors) toexperiencesupport or refutation. This process allows the members to further refine and develop internal belief and confidence in the predictive aspects of the models. As accumulating evidence over the ensuing days strengthens (or refutes) the hypotheses, the process continues to internalize those explanations that the team has developed that are most accurate; they also internalize confidence in the sources and collaborative processes that were most productive for this ramp-up phase of the crisis situation.
3.3.6 Socialization
As the group periodically reconvenes, the subject focuses away from “what we must do” to the evidentiary and explanatory models that have been produced.
The dialogue turns from issues of startup processes to model-refinement processes. The group now socializes around a new level of the problem: Gaps in the models, new problems revealed by the models, and changes in the evolving crisis move the spiral toward new challenges to create knowledge about
vulnerabilities in the PLF and supporting networks, specific locations of black propaganda creation and distribution, finances of certain funding organizations, and identification of specific operation cells within the Kryptanian government.
All of these refined issues challenge the team and begin a new spiral of explora- tion and creation by the team.
3.3.7 Summary
This example illustrates the emergent processes of knowledge creation over the several day ramp-up period of a distributed crisis intelligence team. The full spi- ral moved from team members socializing to exchange the tacit knowledge of the situation toward the development of explicit representations of their tacit knowledge. These explicit models allowed other supporting resources to be applied (analysts external to the group and on-line analytic tools) to link further evidence to the models and structure arguments for (or against) the models. As the models developed, team members discussed, challenged, and internalized their understanding of the abstractions, developing confidence and hands-on experience as they tested them against emerging reports and discussed them with team members and colleagues. The confidence and internalized understanding then led to a drive for further dialogue—initializing a second cycle of the spiral.