Chapter 10

Implications and Consequences

Bottom Line Up Front

A critical-thinking project is finalized by addressing the implications and consequences of the previously completed analysis. Results of the interpretation and inference analysis produce contentions (theses, key findings, conclusions, or recommendations), which imply certain conditions or actions. Implications indicate related behaviors, decisions, or conditions generated by the analytic results. Consequences occur when the implied behaviors, decisions, or conditions are acted upon. Cascading threat analyses are a common method to assess implications and consequences. In security analysis, there are two special cases of implications and consequences. First, in support of an intelligence threat analysis, a warning analysis is generated to update decision makers on the likelihood of adversaries’ actions. Second, security policy analysts must “market or sell” their recommended policy actions to decision makers. In these cases, several management-based techniques may be employed to increase the likelihood the recommended actions will be approved and acted upon.

Role of Implications and Consequences

Implications and consequences are the final elements addressed in a critical- thinking projects. The elements follow the previous critical-thinking efforts and are a check on the practicality of the analytic results. Implications claim or imply a related behavior, decision, or condition generated by the previous results.¹ They also address ideas because they directly or indirectly indicate, allude, hint, suggest, intimate, or entail beliefs, assumptions, or viewpoints resulting from the thinking. For example, if a state is assessed as a strong democracy, it implies that the state’s political power resides in the people (citizens) and not in a powerful minority. There are three general types of implications: possible, probable, and necessary (certain).² A possible implication is one that may not be expected but still has a slight probability of occurring. For example, a recurring military patrol along a contested international border would not be expected to cause a violent conflict, but it is possible a conflict may occur. A probable implication may be expected, and thus has an increased probability of occurring. If the military patrol purposely fires across the border, then a conflict probably could be expected. A necessary implication is all but certain (near 100% probability) to result in either a positive or negative consequence. When the military patrol crosses the border and engages the adversary’s forces, conflict will almost certainly follow.

Consequences, on the other hand, are the result of actions flowing from the implications. Thinking through the implications of a situation may lead to positive consequences that solve the problem or otherwise support the purpose of the analysis. Failure to think through the implications may result in negative or unintended consequences that work against the interests of the customer who requested the analysis.³ Consequences flowing from implications result in behaviors, decisions, or conditions that are acted upon. For example, if a state takes action to become a democracy, it can expect the positive consequences to include fair voting for societal leaders, less conflict and violence, and an improved quality of life for citizens. Consequences, either positive or negative, are thus what really happens and foster a series of outcomes. In the military patrol examples above, if conflict along the international border were to occur, the negative consequences could be a war between the adversarial states, loss of thousands of military and civilian lives, significant property destruction, and possible escalation into a regional war. Once the implications and consequences of a situation are understood, security analysis customers can decide if certain positive consequences are desired or if they can devise actions to mitigate the effects of negative or unintended consequences.

The remainder of this chapter addresses implications and consequences related to security analyses. Cascading threat analyses provide a basic process for assessing implications and consequences in most security analyses. Security analysis also has two specific areas that require expansion of basic implication and consequence analysis. First, in intelligence threat analyses, implications and consequences relate to predictive threat scenarios—the most probable threat scenarios adversaries may choose to pursue. This chapter presents a warning analysis structure to continually update an initial threat analysis, thus allowing customers to take mitigation actions. Second, security policy analysts must consider the acceptance of a policy recommendation (who will support or not support the recommendation) and the implementation of a policy recommendation to determine its cost and feasibility. The final section of this chapter discusses techniques for assessing acceptance and implementation of policy recommendations.

Cascading Threat Analysis

Cascading threat modeling is used in a number of security areas, including emergency management, infrastructure protection, cyber security, and more. This type of modeling is particularly applicable to risk assessment, where the models help in assessing threats, vulnerabilities, and consequences. Cascading threat analyses take a systems approach (Chapter 7), which considers natural systems (earthquakes, hurricanes, wildfires, floods, etc.) and how they interact with man- made systems (communications, transportation, electrical, water systems, etc.). For example, hurricanes may damage electrical, communication, and transportation systems, while also causing property damage and flooding that affects the livability of homes and businesses.⁴

Cascading threat models assume a disaster or other action will unleash a sequence of events—often resulting in a series of negative consequences. “Toppling dominoes” is a good metaphor to visualize a series of sequential events. Lines of dominoes standing on end will topple if one end domino falls contacting and felling the next, which contacts and fells the next, and so on. The dominoes, or sequence of events, may be arrayed in one long line or may have side- branches, much the same as sequential events occur in the real world. Scenarios with a long sequence of events have individual parts that often are referred to as first order, second order, third order, etc., consequences.

Techniques for conducting cascading threat modeling are listed below. Box 10.1 provides a sample modeling effort.

Step 1: After completing the interpretation and inference analysis (Chapter 9), assess implications and consequences of resultant contentions starting with a group-informed-brainstorming effort (Chapter 8). List and address every contention generated by the interpretation and inference analysis. The informed brainstorming should be supported by historic inputs from past research on similar cases, generic inputs from group members with experience in the field, and creative-thinking inputs (Chapter 8). Focus on using both divergent and convergent techniques to develop a list of implications and consequences for each contention.

Step 2: Create a set of events trees (Chapter 7) that list the contentions being assessed followed by their implications and related consequences. As an events tree unfolds, continue the informed brainstorming to refine the list of implications and consequences.

Step 3: Assess insights from the events trees and design mitigations for each negative or unintended consequence for the contention selected for action.

Box 10.1

Cascading Threat Model: Al Qaeda 9/11 Attacks

Perspective: Al Qaeda Presume that al Qaeda returns to its initial storyboard planning (see Box 8.1) to assess the implications and consequences of its preferred decision to mount suicide attacks on the U.S. homeland with hijacked aircraft employed as missiles. As Box 8.1 describes, it appears al Qaeda did not conduct such an analysis. Below are the hypothetical results if they had done so. Step 1: Select contention(s) for assessment. In this example, the contention (or decision) was to mount suicide attacks using hijacked aircraft as missiles on the New York World Trade Center, Pentagon, and U.S. Capitol. This is the only contention assessed for this example. Step 2: Create an events tree for the contention of a hijacked-aircraft attack on U.S. homeland targets. Step 3: Al Qaeda’s insights from their perspective would include that hijacked- aircraft attacks on the U.S. homeland would either be a full success, partial success, or failure. Al Qaeda already assumed the suicide attack would kill their operatives, so this consequence is not shown on the above events tree. A 1st order consequence would indicate a full or partial success would result in U.S. property and personnel damage (amount depending on level of success). Al Qaeda also assumed a full or partial success might convince the U.S. to leave the Middle East. While this was al Qaeda’s primary motive, this consequence did not come about. Also, al Qaeda should have considered U.S. retaliation for the attack. The 2nd order consequences reveal there was a small probability the U.S. would not retaliate, supported by the fact there was no U.S. retaliation for the USS Cole attack in October 2000, al Qaeda’s last major attack on U.S. interests before September 11, 2001 (9/11). Instead, the U.S. retaliated for the 9/11 attack by forcibly overthrowing Afghanistan’s Taliban government, attacking and expelling al Qaeda from its safe havens in Afghanistan, and beginning a worldwide campaign against al Qaeda. This campaign, known as “The War on Terror,” focused an extensive U.S. intelligence effort to locate al Qaeda operatives, who were then attacked by U.S. forces. Captured al Qaeda personnel were sent to the U.S. military detention camp in Guantanamo Bay, Cuba. In May 2011, this worldwide campaign against al Qaeda culminated in the death of al Qaeda leader Osama bin Laden by U.S. special forces in Pakistan. The implication of the 9/11 attack being a failure also could have resulted in U.S. retaliation, but possibly at a lower level of intensity (dashed lines in event tree) than for an attack deemed a full or partial success. Al Qaeda actions indicate their leadership was not ready to take mitigation actions if the U.S. retaliated—a major flaw in their attack plan. It appears the opportunity to make a “spectacular” attack on the U.S. homeland, and their wishful thinking concerning how this would convince the U.S. to leave the Middle East, overcame their considerations of the risk involved in a U.S. retaliation. The above events tree could be extended further to third order, fourth order, etc., consequences based on the U.S. retaliation plan against the Taliban and al Qaeda in Afghanistan and against al Qaeda worldwide. It appears that al Qaeda had not considered the full implications and consequences of attacking the U.S. homeland.

Warning Analysis

Sometimes called warning intelligence or indications intelligence, warning analysis is a method used by intelligence analysts to update customers (policy makers or tactical commanders) as changes occur in their threat analyses. The main function of warning analysis is to anticipate—insofar as intelligence collection and analysis will allow—what the adversary is likely to do, especially whether adversaries are preparing to initiate action in the foreseeable future.⁵ Intelligence threat analyses usually present more than one potential action or scenario an adversary may choose and estimate which of these actions or scenarios are the most likely to occur. This is accomplished by assessing probabilities that a scenario may take place—but it is impossible to know exactly which will occur.⁶ This type of analysis starts with the interpretation and inference element of a threat analysis and allows analysts to revise their original likelihood estimates to hopefully avoid any surprise actions by the adversary; avoiding surprise is a primary goal of security policy makers and tactical commanders. For a more in-depth understanding of warning analysis, see U.S. intelligence analyst Cynthia Grabo’s seminal work, Handbook of Warning Intelligence.⁷

Warning analysis may be strategic or tactical, which differ in terms of timeliness and resources. Strategic warning is usually longer-term and provides warning of potential actions of an adversary requiring a response with the significant reallocation of resources. Tactical warning is more short-term and provides warning of potential actions of an adversary normally requiring a response with existing resources. Strategic warnings often address complex “wicked problems,” which also are considered low-probability/high-impact events—meaning the probability of an adversary’s actions may be low; but, if the actions did occur, there would likely be significant political, military, or economic consequences. For example, monitoring for a North Korean invasion of South Korea is a strategic warning situation classified as a low-probability/high-impact event. Short-term tactical warning is most applicable to tactical field commanders and supports allocation of existing friendly forces in reaction to an adversary’s actions. Watching for an anticipated terrorist attack entails tactical warning, which often is confused with current intelligence analysis. Tactical warning analysis focuses on a specific problem and the related intelligence indications of an adversary’s potential actions. Current intelligence looks at the latest information, and analysts try to make sense of the information and keep policy makers and tactical commanders informed. Current intelligence often addresses situations where a warning analysis does not exist.

Both strategic and tactical intelligence rely on robust intelligence analysis as described in this book. Warning analysts must have an in-depth knowledge of the adversary and use all the tools in their analytic “tool box” (critical-thinking and analytic techniques) to anticipate the adversary’s most likely future actions. With the initial results of their threat analysis, normally with more than one potential action or scenario the adversary may pursue, the analyst then develops an indicators analysis to identify potential observable factors pointing to the likely action of the adversary. That analysis is used to create a focused intelligence plan to collect and identify information on the observable indicators and allow revisions to the original threat analysis (see below). With a continually revised threat analysis and associated indicators analysis, security policy makers and tactical field commanders can reallocate resources and identify mitigation actions in reaction to the adversary.

When a focused warning analysis is required, it is usually referred to as an Indications and Warning (I&W) Problem. There are dozens of existing I&W problems in the security community; including the North Korean invasion of South Korea, China’s invasion of Taiwan, and Iranian attacks on Saudi Arabia. The remainder of this section presents the steps to develop an I&W problem using the lead-up to the September 11, 2001 (9/11), al Qaeda attacks on the U.S. homeland as an example. This is a case where it appears a U.S. I&W problem was not established, and the case was handled as current intelligence analysis.

Step 1: Establish the threat analysis from the interpretation and inference element (Chapter 9). Using the analytic techniques presented herein, or more advanced techniques, establish a threat analysis for the situation. That analysis usually will result in a number of actions or scenarios the adversary may take. It is up to the analysts to rank order the threat actions or scenarios based on their likelihood to be selected by the adversary. The priority ranking may entail a simple pair-wise comparison (see Figure 9.5), a weighted ranking analysis (see Box 9.2), a CARVER analysis (see Box 8.2), a matrix analysis, or a subjective assessment of the information available in the situation.

Step 2: Develop an indicators analysis. This type of analysis establishes an indicators list and then correlates the indicators with potential threat scenarios the adversary is likely to mount. The indicators list allows the analyst to watch for mounting evidence in support of a particular threat scenario, such as target location and type of attack. Indicators instill rigor in the analytic process when analysts inform policymakers and tactical commanders that a threat is about to materialize. When an indicators list is included with a threat analysis, it demonstrates to the decision maker or tactical commander how the analysts will track new developments as they keep them informed. In providing indicators before a threat materializes, the analyst makes the assessment much more transparent and available for scrutiny. In his book Intelligence and Surprise Attack, Erik Dahl highlights situations where national leaders are given only strategic warning and not specific warning of threats (how, where, when). Lacking specific warning usually results in low decision maker receptivity to the threat, which increases the probability of a successful attack.¹¹ The indicators analysis technique entails:

• Identify the likely set of competing scenarios from the results of the ACH analysis above.
• Create separate lists of observable indicators for potential activities, statements, or events expected for each likely scenario.
• Regularly review and update the indicators list to assess any changes.
• Identify which scenarios are unfolding based on changes to items identified in the indicators list.

Indicator lists should concentrate on those activities or events that can be observed by available intelligence collectors. The indicators list will consist of items on threat capabilities (weapons types, weapon delivery methods, etc.) and the adversary’s intentions to use those capabilities (weapon movements, training activities, statements of intent, changes in propaganda levels, etc.).¹² When addressing a threats to a fixed structure, a good place to start is developing an indicators list from the actions attackers might take to surveil and collect information on a target, as shown in Figure 10.1.

For threats that do not fit the Figure 10.1 framework, another technique to develop an indicators list is to conduct an informed-brainstorming What If? Analysis.14 This type of analysis assumes the action or scenario will occur and then focuses on explaining how the event might occur. To conduct a What If? Analysis, the analyst or group of analysts should:

• Assume the action or scenario will happen or has happened.
• Determine what triggering events permitted the action or scenario to unfold to help make the What If? plausible. Triggering events could include: death of a leader, a political or economic event, a religious date of significance, the anniversary of a significant societal event, etc.— anything that could spark a change from the adversary planning an attack to actually carrying one out.
• Develop a chain of events based on a combination of logic and evidence to explain how the event could have occurred. Events trees (Chapter 7) are a good technique to employ. Figure 10.1 provides information to assist in developing an events tree for an infrastructure attack.
• “Think Backwards” from the event in concrete ways; that is, specify what must actually occur at each stage of the action or scenario.
• Identify one or more plausible pathways that lead to the action or scenario; often, more than one pathway will appear possible.
• Generate an indicators list or “observables” for each action or scenario that would help to detect its origins.
• Consider the scope of the positive and negative implications and consequences of the indicators list and their correlation to each action or scenario.

Box 10.3 provides an example of an indicators list and indicators analysis related to the Box 10.2 threat analysis results, based on a What If? Analysis.

Step 3: Develop and activate a focused intelligence collection plan. Obtaining information on each of the items on an indicators list usually requires a coordinated interagency intelligence collection effort. Depending on the nature of the threat, this intelligence collection effort could be mounted inside the United States, overseas, or a combination of both. Analysts first should start with a broad plan of the intelligence collection requirements. From this requirements summary, analysts or dedicated intelligence collection managers, then would activate the necessary collection systems. The intelligence management actions could include adding the requirements to the IC standing requirements for recurring long-term collection, the shorter-term (minutes to days) time-sensitive requirements, or ad hoc collection requirements generated when a formal collection requirement does not exist or a one-time collection effort is required.¹⁶ It is imperative that analysts provide the collectors the background on the threat, the full threat analysis, and specific collection actions required. This allows the collectors to tailor their efforts to obtain and report the desired information. Developing a focused interagency intelligence collection effort has the added advantage of informing the appropriate agencies of the priorities to be placed on the threat.

In addition to notifying federal agencies when a collection effort takes place inside the United States, it often requires the support of state and local law enforcement agencies. At times, support of corporate security officials also is required. The vast majority of the U.S. critical infrastructure is owned by businesses and corporations that employ thousands of their own security personnel. There are several considerations when soliciting intelligence collection support from other than federal agencies. First, any supporting documents or briefings will likely need to be declassified and provided to participating agencies. Second, depending on the nature of the threat, the analyst should ask several questions:

• • Should the owners of the locations of the most likely attacks be informed of the threat?
  • Should the supervisors and workers at the locations of the most likely attacks be informed of the threat and asked to assist in the data collection efforts?
  • Should the general public be notified of the most likely attacks?
  • Should the general public be asked to assist in the data collection efforts?

Box 10.4 presents an example of a broad intelligence collection plan resulting from the Box 10.3 indicators analysis.

Step 4: Update the threat analysis likelihoods for each scenario. As new information is revealed from the indicators analysis and corresponding intelligence collection plan efforts, the analyst must continually revisit the original threat analysis and update the original likelihood estimates, as appropriate. For example, from the Box 10.4 intelligence collection plan, if it had been found several potential al Qaeda operatives had enrolled in U.S. aviation training programs, it may have resulted in an increase in the likelihood estimate from likely to very likely for the Box 10.2 scenario 2 (possible attack of U.S. structural facilities with hijacked aircraft used as missiles). In fact, in summer 2001, two reports of aviation training enrollments by Middle Eastern males were reported to FBI headquarters, but both reports were discounted and further investigation not conducted. In these two reports, it was the 9/11 al Qaeda operatives being trained to fly—but not land—wide-body commercial aircraft in the training programs.

Bayesian analysis should be considered by analysts in revising estimated threat likelihoods (Chapter 7). There will seldom be sufficient information in a threat analysis to calculate precise numeric probabilities for use with Bayes’ Theorem to update probabilities. Instead, the warning analyst becomes more like a casino card-counter, who uses new information to make an intuitive estimate of how the likelihood of specific scenarios change, allowing the card-counter to adjust their betting and playing strategy. While warning analysts primarily are generating subjective estimates of likelihood, these estimates still provide the customer the best assessment of what may be about to happen.

Warning analysts face the challenge of making estimates in highly complex situations, where information is usually incomplete, and with human adversaries often making unpredictable decisions. But the analysts still must provide decision makers the best estimates possible. The biggest failure in most warning analyses is when all the evidence available on the case is not examined closely; or, if an I&W problem is never established, as it appears was the situation in 9/11.

Policy-Marketing Analysis

Policy marketing refers to the “selling” of policy actions. Security policy analysts must develop a marketing plan to convince policy makers to adopt and support the policy recommendations resulting from the interpretation and inference element (Chapter 9) and implications and consequences element (this chapter). The consequences of not considering the needs and inclinations of policy makers could result in rejection of a recommended policy option. Policy analysts must keep in mind how the opportunities and limitations surrounding both politics and resources determine the acceptance or rejection of their recommendations. There may be resistance to changing existing policies, especially if the existing policies have been in place for a lengthy time and developed a strong supporting constituency. The ability of security analysts to present new or controversial material to policy makers is often called “speaking truth to power” and, when not handled properly, has been the downfall of many an analysis.²⁵ The key to marketing policy recommendations is to ensure the policy analysis is based on the latest intelligence analysis (even if the policy analyst also must act as the intelligence analyst); verify that the policy analysis is grounded in facts, logic, and reasoning; consider the politics and resources of the issue; and prepare verbal and written reports with strong arguments that support the recommendations.

Security policy analysis may involve single or multiple issues. A single-issue policy analysis usually is limited to one policy action and addresses a single goal, including revising or implementing a new program to address a specific problem. A multi-issue policy analysis usually addresses a number of policy actions or programs with multiple goals, and is packaged under an overarching strategy. Security policy analysts face several major challenges in marketing their recommendations for both single-issue policies and multi-issue strategies. The challenges include:²⁶

1. Assessing the tradeoffs posed when the goals of competing policies or strategies are incompatible.
2. Measuring the costs and effectiveness of policies and strategies when the actions recommended are so different that they are not easily compared.
3. Developing the program components—the action agenda—for policies and strategies in enough detail so policy makers know what they are approving and will support further planning and eventual implementation.

Below are three analytic techniques for assisting policy analysts to help ensure the policy analysis is complete and to develop sufficient details to convince policy makers to approve their recommendations—How-How Analysis, SWOT Analysis (Strengths, Weaknesses, Opportunities, Threats), and Acceptance Analysis. At times, the analyst may need only one or two of these techniques; at other times, all three techniques may be required. Depending on the policy analysis situation, these techniques provide systematic procedures for ensuring the analyst’s briefing or written report contains sufficient details to obtain policy maker approval and/or support for recommended policies.

How-How analysis. The purpose of a How-How analysis is to generate initial steps toward planning and implementing recommended policy options. The How-How analysis begins with the results of the interpretation and inference element (Chapter 9) and completion of a cascading threat analysis (see above). The technique follows a divergent-thinking approach to identify important general action steps. Depending on the situation, How-How analysis may be applied to the preferred, recommended policy option; several of the highest- priority options; or to all the policy options developed in the interpretation and inference element results. The goal is to develop detailed options for policy makers to approve one or more options. Once a recommended policy option is approved, the How-How analysis can be revisited to develop even more in-depth actions and activities for policy implementation. The How-How analysis proceeds as follows:

• • Identify the recommended option.
  • Ask the first “how” question and record responses.
  • Ask “how’ again and record responses.
  • Continue to ask “how” questions until the level of required detail is achieved.²⁷

To visualize a How-How analysis, an events tree diagram is provided in Box 10.5. This example is based on the outcome matrix analysis presented in Box 9.3 on President Obama’s decision about troop deployments in the Afghanistan war.

Box 10.5

How-How Analysis: Obama’s War in Afghanistan

Box 9.3 details the 2009 negotiations to decide on revised U.S. troop deployments in Afghanistan (AF). During these negotiations, the U.S. DOD offered the option of 45,000 additional troops with enablers (support units) to continue a counter-insurgency (CI) strategy. A How-How analysis could have been employed by DOD planners to develop this option. From the above How-How analysis, DOD planners could generate the details of a plan to increase the number of U.S. troops in Afghanistan and pursue a CI strategy. Bob Woodward’s book Obama’s Wars 28 captures how much of the above planning took place. President Obama initiated an independent think tank review of U.S. strategy in Afghanistan in spring 2009. The U.S. Commander in Afghanistan completed a force review and second strategy review in late- summer and early-fall 2009. President Obama made his decision to increase troop deployments in Afghanistan on November 29, 2009. The main DOD actors in establishing the option for 45,000 troops plus enablers to conduct a CI strategy similar to the one successfully conducted earlier in the decade in Iraq were: Secretary of Defense, Joint Chiefs of Staff, U.S. Central Command, and the U.S. Commander in Afghanistan. Other actors in the above How-How analysis were peripheral to the DOD planning. The next step would be to take the details of an initial plan and place them through a SWOT analysis.

SWOT analysis. The strengths, weaknesses, opportunities, and threats (SWOT) analysis is a systematic assessment of a recommended option (policy, program, or strategy) and is widely used in government and corporate management circles.²⁹ Using their knowledge of the option under consideration, combined with informed brainstorming, analysts develop a SWOT assessment for a recommended option. Strengths and weaknesses usually relate to the internal attributes of an option. Opportunities and threats usually relate to external conditions affecting the option.

The SWOT results should identify “gold badges” and “red flags.” Gold badges are features of the option under assessment that would be attractive, necessary, or unavoidable; and would likely influence the policy maker to approve the option. Gold badges identify viable means to attain high-priority goals and protect vital interests. Red flags identify potential problems with the option, to include likely failure to achieve goals, payoffs too small, risks too high for the policy makers, or costs too high. Such red flags will usually result in the rejection of the option, irrespective of its strengths and opportunities.³⁰

A SWOT analysis is facilitated through the use of a simple 2 X 2 matrix template as shown in Figure 10.2. Once the initial SWOT analysis is completed and gold badges and red flags identified, the policy analyst then may revise the option to make it more marketable to the policy makers.

Box 10.6 provides an example of a SWOT analysis based on the Box 9.3 decisions surrounding President Obama’s decision on troop deployments in the war in Afghanistan.

Acceptance analysis. With a SWOT analysis completed and necessary revisions under consideration, an acceptance analysis allows the determination of conditions that might help or hinder an option’s final approval and implementation. Here contextual thinking is injected into the analytic process to develop an understanding of the decision’s implications, consequences, and overall environmental conditions. The analyst must be sensitive to the physical and psychological factors of stakeholders involved in the decision process. Stakeholders are individuals, groups, or organizations that have a vested interest in the approval or rejection of recommended policy options.

Acceptance analysis should begin with a 5Ws + 1H analysis (Chapter 8). As part of this analysis a table is created with two columns: one for sources likely to assist the approval or implementation of an option and one for those likely to resist the approval or implementation of an option. Then under each column, list the 5Ws + 1H results about the option from the perspective of those assisting or resisting the approval or implementation of that option. The next step is to use the results of the 5Ws + 1H to conduct an acceptance analysis by creating a table that lists stakeholders, their level of support for an option, and potential actions to gain support where it is lacking or to improve existing support. An acceptance analysis proceeds as follows:³²

• Generate a list of all stakeholders.
• Identify each stakeholder’s existing level of support for the option.
• Estimate each stakeholder’s level of support required for the option’s approval.
• Generate action items to achieve the level of support required for the option’s approval.

Box 10.7 provides an example of an acceptance analysis surrounding President Obama’s 2009 decisions on troop deployments in Afghanistan (Boxes 9.3, 10.5, 10.6 provide details).

Key Concepts

Acceptance Analysis

Analysis of Competing Hypotheses

Capabilities

Cascading Threat Models

Consequences

Contextual Thinking

How-How Analysis

Implications

Indication & Warning Problem

Indicators Analysis

Indicators List

Intelligence Collection Plan

Intentions

Low Probability/High Impact Event

Policy Marketing

Positive Consequences

Stakeholders

SWOT Analysis

Threat Analysis

Unintended Consequences

Warning Analysis

What If? Analysis

Discussion Points

1. Using information in Boxes 6.3 and 7.1, conduct a cascading threat analysis of the implications and consequences from an Iraqi perspective of the 1980 Iraqi attack on Iran.
2. Using information in Boxes 6.3 and 7.1, develop an Indications & Warning Problem—indicators list, indicators analysis, and intelligence collection plan— from an Iranian perspective for a possible 1980 Iraqi attack on Iran.
3. Using information in Boxes 2.1 and 7.2, develop a How-How analysis, SWOT analysis, and Acceptance analysis for the end of the day-one ExCom discussions during the Cuban Missile Crisis (where President Kennedy’s advisors recommended surprise surgical airstrikes on Cuban air defenses and Soviet missile sites, followed by an invasion of Cuba).

Notes

¹ Richard Paul and Linda Elder, Critical Thinking, Tools for Taking Charge of Your Professional and Personal Life, 2^nd ed. (Upper Saddle River, NY: Pearson Education, Inc., 2014), 93.

² Ibid.

³ Ibid, 117.

⁴ Fred May, Cascading Disaster Models in Postburn Flash Flood,” in The Fire Environment— Innovations, Management, and Policy, eds. Bret Butler and Wayne Cook, Proceedings RMRS-P- 46CD, March 2007 (Fort Collins, CO: U.S. Department of Agriculture, Forest Service, Rocky Mountain Research Station, 2007) https://www.fs.fed.us/rm/pubs/rmrs_p046/rmrs_p046_443_464.pdf (accessed April 28, 2021).

⁵ Cynthia Grabo, with Jan Goldman, Handbook of Warning Intelligence, Complete and Declassified Edition (Lanham, MD: Rowan & Littlefield, 2015), 2.

⁶ Ibid, 381.

⁷ Ibid (entire book).

⁸ Arthur S. Hulnick, Keeping Us Safe: Secret Intelligence and Homeland Security (Westport, CT: Praeger, 2004).

⁹ Richards J. Heuer Jr., Psychology of Intelligence Analysis, (Washington, DC: Central Intelligence Agency, Center for the Study or Intelligence, 1999), 95-110.

¹⁰ Office of the Director of National Intelligence, “Intelligence Community Directive 203 Analytic Standards,” (Washington, DC: Office of the Director of National Intelligence, 2015), 3. https://www.dni.gov/files/documents/ICD/ICD%20203%20Analytic%20Standards.pdf (accessed July 20, 2018).

¹¹ Erik J. Dahl, Intelligence and Surprise Attack, Failure and Success from Pearl Harbor to 9/11 and Beyond (Washington, DC: Georgetown University Press, 2013), 177.

¹² Sundri Khalsa, Forecasting Terrorism, Indicators and Proven Analytic Techniques (Lanham, MD: Scarecrow Press, 2004).

¹³ Christopher Paul and Eric Landree, “Defining Terrorists' Information Requirements: The Modified Intelligence Preparation of the Battlefield (ModIPB) Framework,” Journal of Homeland Security and Emergency Management: 5, no. 1, (2008): 1-18. https://www.rand.org/pubs/external_publications/EP20080028.html (accessed April 14, 2021).

¹⁴ Richards J. Heuer Jr. and Randolph H. Pherson, Structured Analytic Techniques for Intelligence Analysis, 2^nd ed. (Thousand Oaks, CA: Sage/CQ Press, 2015), 250-254.

¹⁵ Michael W. Collier, “Intelligence Analysis, A 9/11 Case Study,” in Homeland Security and Intelligence, 2^nd ed., ed. Keith Gregory Logan (Santa Barbara, CA: Praeger, 2018), 88.

¹⁶ Robert M. Clark, Intelligence Collection (Los Angeles, CA: Sage/CQ Press, 2014), 451.

¹⁷ The following discussion was edited from Collier, 88-92.

¹⁸ Bill Gertz, Breakdown, How America’s Intelligence Failures Led to September 11 (Washington, D.C.: Regnery Publishing, 2002), 83–104.

¹⁹ Bob Graham, Intelligence Matters, The CIA, the FBI, Saudi Arabia, and the Failure of America’s War on Terror, with Jeff Nussbaum (New York: Random House, 2004), 75.

²⁰ Richard A. Clarke, Against All Enemies, Inside America’s War on Terror (New York, Free Press, 2004), 236.

²¹ 9/11 Commission, The 9/11 Commission Report, Final Report of the National Commission on Terrorist Attacks Upon the United States (New York: W.W. Norton & Company, 2004), 258.

²² Peter Lance, 1000 Years for Revenge, International Terrorism and the FBI—The Untold Story (New York: HarperCollins Publishers, 2003), 405.

²³ 9/11 Commission, 258.

²⁴ Ibid.

²⁵ Aaron Wildavsky, Speaking Truth to Power: The Art and Craft of Policy Analysis (Boston, MA: Little, Brown and Company, 1979).

²⁶ Richard L. Kugler, Policy Analysis in National Security Affairs: New Methods for a New Era (Washington, DC: National Defense University, Center for Technology and National Security Policy, 2006), 73.

²⁷ Gerard J. Puccio, Marie Mance, and Mary C. Murdock, Creative Leadership, Skills That Drive Change, 2^nd ed. (Thousand Oaks, CA: SAGE, 2011), 230-232.

²⁸ Bob Woodward, Obama’s Wars (New York, NY: Simon & Schuster, 2010).

²⁹ Heuer and Pherson, 308-310.

³⁰ Kugler, 47.

³¹ Heuer and Pherson, 309.

³² Puccio, Mance, and Murdock, 215-217.

³³ Woodward.