FROM DATA TO KNOWLEDGE: HOW INTELLIGENCE AND SECURITY TOOLS CAN HELP - Cyberwar-Netwar: Security in the Information Age - page 127

have a very important operational indication. That means open sources. To be able to
pick up all the signs, to put together pieces of seemingly meaningless information, can
quickly become very meaningful when aggregated with other pieces of information. This
is also very important for national cooperation. Because you also need to have non-
classified and open information, information which could allow other countries to build
up a scenario. This is the most important thing that we have to absorb in our discussion,
that today we need pieces of evidence to be aggregated in order to make decisions. And
this is the importance of cooperation. Of course I also want to refer to a past experience
in imagery intelligence, for here some countries have been accumulating a mass of
images to be analysed. They were flooded by this mass of images but they could not
analyse the images and they backed the right indications. The same goes for intelligence.
Of course if a satellite could take a picture of our hotel location, the image of the hotel
could not explain what we are saying in this room. But why people from different
nations have come here to discuss together is an interesting indication. So I can collect
information on who is meeting in this room, as another piece of information to piece
together, and what at the end we will decide. So some cyberwar experts are meeting from
NATO-friendly nations, but some countries could be meeting together to discuss
something else. If I have a real spy inside I can close the loop. If I have a spy inside I
would solve any problem but I need to access this additional source of information by
undercover agents at different levels of open source intelligence. Their weight as a whole
contributes to the right answer.
Buyukoner : I would like to add some comments on your explanations. As you know,
when you say intelligence, it always reminds me that intelligence has a cycle. It is a
closed loop and consists of four phases of planning; information collection, isolated
evaluation, examination and closing the loop. Col. Handy said the simulation method
can be used for this. All functions for each phase of the intelligence cycle are already
defined in their function and how we perform the functions. So it is very easy to fit your
information flow, whether it is business intelligence or a national intelligence system,
from data to knowledge. We can easily use this cycle to simulate this kind of system.
Gabovych : I would like to make a small addition to the question of open sources and
closed sources. Because it depends on what you call closed sources and open sources. Let
us say, if you are speaking of the tragedy of September 11 th there was information
regarding border crossing of the terrorists. There was information regarding the flying
school. There was a lot of other information related to this matter but it was partially
closed and partially opened. It depends on how much information is open and how much
can be analysed. So I think that most information is really open, but is so diverse that
the question is how it should be collected and systemised.
Erez : Dr. Buyukoner just made some remarks that I wanted to raise but I would like
to go to another point which was already discussed. For sure those open sources have a
very heavy weight in the information collected by intelligence. For sure in the open
sources you will not find the date and the location of a terrorist attack, but a good analyst
who knows how to read them properly can have a lot of red lights from open sources. A
remark was made about the movement of people who were on the wanted list on flights
to the United States or on international flights. Another similar example I can give is that
there is a mosque in London which is very well-known for its radical Imam with his