SEMESTER PROJECT TEAMS complete this IntelGame in three parts: Hypotheses, Supporting Evidence,
and Data Analysis. One submission per team.
DOWNLOADS
Download the IntelGame Template Word file ( http://bit.ly/1b9EOtG) to capture results, before pasting
as plain text into the Angel assignment. When completing Data Analysis in Part 3, view the Video Tutorial
( http://bit.ly/RXKVKI), as well as download the Excel IntelGame Data file ( http://bit.ly/1fhC2a9).
Teams are given the names to analyze using Excel in the Angel assignment.
CASE
The data in this IntelGame is fictional, situated in Los Angeles in 2008, and influenced by events from the
Sniper Shootings that took place in Washington, D.C. during three weeks of October 2002.
INTELLIGENCE ANALYSIS
Intelligence analysis is the process of taking
known information about situations and entities
and characterizing a common truth with
appropriate statements of probability. The
descriptions are drawn from information that may
be both incomplete and deliberately deceptive.
The art of intelligence analysis is practiced in the
intelligence community and business settings (e.g.,
business intelligence, competitive intelligence).
Source: http://bit.ly/VQ1r3G
LEARNING OBJECTIVES
Upon completing this exercise, students should be able to:
1. Analyze a scenario and generate a common truth in the form of a hypothesis, and provide three
examples of evidence that, if found, could discredit the hypothesis
2. Describe two cognitive biases compromising analytical results
3. Demonstrate data analytics by filtering Excel data
© 2012, Edward J. Glantz
SRA111 INTELLIGENCE ANALYSIS GAME
COGNITIVE BIAS
Humans (including analysts) suffer from cognitive bias, or limitations in thinking that lead to errors in
judgment. Cognitive biases are similar to optical illusions in that the error remains compelling even
when one is fully aware of its nature. Cognitive biases, therefore, are, exceedingly difficult to overcome.
Our Structured Analytic Techniques, such as Devil’s Advocacy, can be used to improve thinking in groups
by challenging framing and confirmation bias, for example.
The following is a list of the more commonly studied cognitive biases (Source: http://bit.ly/PNa50h):





Framing Bias: Using too narrow an approach/description of a situation or issue.
Hindsight Bias: The "I-knew-it-all-along" effect sees past events as being predictable.
Confirmation Bias: Tendency to search for or interpret information in a way that confirms one's
preconceptions; this is related to the concept of cognitive dissonance.
Self-Serving Bias: Tendency to claim more responsibility for successes than failures. It may also
manifest itself as a tendency for people to evaluate ambiguous information in a way beneficial to their
interests.
Belief Bias: Evaluation of the logical strength of an argument is biased by their belief in the truth or
falsity of the conclusion.
ACH PROCESS
CIA analyst Richards Heuer's "Analysis of Competing Hypotheses" (ACH) process challenges and thus
improves thinking, since simple awareness of bias cannot produce more accurate results.
At the core of ACH is the notion of competition among plausible hypotheses, to see which survives a
gauntlet of testing with available evidence. The surviving hypothesis is the “least disproved”; it may not
always be the right answer, but it is usually better. The ACH process helps analysts overcome cognitive
limitations, such as the confirmation bias. (Source: Jack Davis )
Stated more simply, it is better to try to prove your belief is wrong. In doing so, we can identify evidence
that might be available and could be found, if only we had thought to look for it. When we try to prove
our idea is correct, we often overlook critical information, and fall victim to the confirmation bias.
2
SRA111 INTELLIGENCE ANALYSIS GAME: PART I
“THAT’S STRANGE” (FIRST SIX SHOOTINGS)
The Centers for Disease Control and Prevention
( http://1.usa.gov/UtzUoE) reports 749 firearm
homicides in the City of Los Angeles during 2006-2007.
The most common cause of a firearm homicide is gang
related, domestic violence, or robbery.
Thus, on September 5, 2008, a round fired at 5:02PM
into a GoGreen Grocery store, narrowly missing a teller,
seemed initially to be a stray round from one of these
events that might have occurred nearby.
An hour later, at another location, an African-American
father of an 18 year-old son was shot and killed, while leaving a hardware store near a police station.
Robbery did not occur, and no other motif was apparent, although police thought interviewing the son’s
contacts might provide a gang connection. At this point, no consideration was given that these two
events might be related.
Almost one month later, on the morning of October 3, a white male (age 39) died while mowing his lawn.
Initially an engine catastrophe was suspected, although it was later discovered a high power rifle had
shot him. Within the space of two more hours, three victims at different locations were killed by a high
power rifle: an Indian-born male in his fifties died pumping gas fifty yards from an officer in a patrol car,
a Hispanic mother (age 34) of a seven year-old died waiting at a bus stop, and a twenty-five year-old
white woman died while purchasing gas.
Forensics had confirmed that all of these events involved a high power rifle. Bullet fragments, however,
could not confirm that the same rifle had been used. Police now believe these events could be connected,
as high power rifles are unusual in gang, domestic, or robbery homicides. It was also noted that the
shootings took place near major freeway interchanges. Still confusing was the diversity in victim
ethnicity, lack of an apparent motif, and limited/conflicting witness statements.
3
SRA111 INTELLIGENCE ANALYSIS GAME: PART I
Figure 1 Freeway Interchange Location of Shooting Incidents A--F
Read Table 1 “Incident Data” associated with this part to review location, date/time, facts, assumptions,
and eyewitness reports. After reviewing the data, draft answers to the questions provided.
Table 1 Preliminary Incident Data
MapID
Freeway1st
Freway2nd
IncidentPoliceID
DateStamp
TimeStamp
FactsKNOWN
Assumptions
A
210
405
124962
09/05/2008
5:02PM
No evidence, no motive,
no suspect; “random
event”
B
10
405
135723
09/05/2008
6:02PM
C
10
5
138507
10/03/2008
7:41AM
Single bullet fired into
a GoGreen grocery
store, narrowly
missing check out
clerk
Steve Johnson, 55
year-old African
American father of an
18 year-old son shot
and killed leaving a
hardware store in a
shopping plaza, across
the street from a
police station. Bullet
probably highpowered, possibly
.223 military caliber.
Jimmy Buchman, 39
year-old white male,
died while mowing
lawn. Initially thought
to be a mower
malfunction, later
determined he had
been apparently shot.
No evidence, no witness,
no suspect, no motive, no
robbery
No evidence, no witness,
no suspect, no motive, no
robbery; not linked with
previous incidents.
4
SRA111 INTELLIGENCE ANALYSIS GAME: PART I
MapID
Freeway1st
Freway2nd
IncidentPoliceID
DateStamp
TimeStamp
FactsKNOWN
Assumptions
D
210
5
139658
10/03/2008
8:12AM
No robbery, no evidence,
no witnesses;
investigators now
dismissing domestic crime
and robbery (most
common homicide
motives)
E
10
110
140370
10/03/2008
8:57AM
F
60
605
147311
10/03/2008
9:58AM
Sanjay Akbar, a 54
year-old Indian-born
man was fatally shot
while putting gas in his
Taxi. An officer was
sitting fifty yards away
in a patrol car in heavy
traffic.
Maria Lopez, a 34
year-old Hispanic
mother of a 7 year-old
son was shot sitting at
a bus stop in front of a
post office.
Mary Parker, a 25
year-old white
woman, was shot
while purchasing gas.
This was the sixth
possibly related highpowered rifle shooting
case, fifth shooting
death, and fourth
shooting death in
roughly two hours.
White van with black
lettering lead released at
press conference.
Police expanded
motivations to include
racial crime, hate crime, or
terrorism. In addition, a
link between the victims
was being sought. A
hotline was created to
report suspicious
activities, especially
information about white
vans. Forensics began
evaluating bullet
fragments, and victim
autopsies were
conducted.
QUESTION SET: THREE PLAUSIBLE HYPOTHESES (25 POINTS)
Given information provided in the case Table 1, generate three plausible hypotheses that could explain
the shootings.
For each hypothesis, use at least one (1) fact/witness statement from the case, and cite where found in
the case (e.g., Table, 1/Incident B). Fact/witness statement may be reused as needed. Feel free to add
“conjecture” to complete plausible hypotheses.
Hypotheses may help anticipate the next shooting attempt, or even identify the perpetrator. Each
hypothesis should:
1. Describe the shooter, or aspects of the shooter,
2. Describe the motivation, and/or
3. Describe the means (e.g., weapon, mode of transportation).
5
SRA111 INTELLIGENCE ANALYSIS GAME: PART I
EXAMPLE:
Single white male, prior military experience, using a military rifle (Table, 1/Incident B) to target victims
based on racial discrimination.
HYPOTHESIS 1
HYPOTHESIS 2
HYPOTHESIS 3
QUESTION SET: EVIDENCE NEEDED TO DISPROVE HYPOTHESIS (10 POINTS)
Copy ONE hypothesis presented above, and suggest THREE pieces of evidence that could discredit or
“falsify” this hypothesis. This evidence may either be fact/witness statement from Part I of this case, or
new (i.e., not yet presented).
In parentheses, specify which part of the selected hypothesis is refuted.
The practice to falsify/disprove a belief attempts to overcome framing and confirmation cognitive bias.
Identifying new evidence not yet found helps guide investigators.
EXAMPLE
The hypothesis “Single white male, prior military experience, using a military rifle to target victims based
on racial discrimination,” could be discredited based on evidence such as:
1) Single white males were also targeted (refutes racial discrimination),
2) A non-white male was seen leaving the scene (refutes white male), or
3) A female was seen with the male shooter (refutes single shooter).
HYPOTHESIS SELECTED
EVIDENCE 1
EVIDENCE 2
EVIDENCE 3
6
SRA111 INTELLIGENCE ANALYSIS GAME: PART II
PANIC IN THE CITY (ALL NINE SHOOTINGS)
Three more high-power rifle shootings occurred
at different locations the following week, all near
major freeway interchanges. An elderly Haitian
immigrant was killed crossing the street on
October 9, a white woman in her forties was
killed in a grocery store parking lot two days
later, and on October 14, a 13 year-old boy
survived being shot as he entered his middle
school.
Public unrest and media scrutiny was heightened.
Because of the proximity to freeway interchanges,
Operation SpiderWeb was developed to
immediately lock down freeway traffic following a shooting incident, leading to snarling traffic jams and
further complications.
A joint operation command was also formed to combine local and federal police, with representatives
from the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF), Federal Bureau of Investigation
(FBI), the Secret Service, and the US Marshals. Combined, they were called the SNIP Task Force
(SNIPTF).
Additionally:
A. Police cross-referenced California owners of white vans with rifles capable of firing .223 rounds
B. SNIPTF released a possible profile to media: Single shooter, angry, self-centered, fascinated with
weapons and violence, recently suffered a domestic or job related setback, a white male adult, not
displaying signs of mental illness, frequented gun shows, liked military books and movies, not in a
relationship, not confrontational, hypersensitive and suspicious, and playing close attention to media
coverage.
C. Leads matching the above description ultimately resulted in dead ends.
D. Police released a composite graphic of the suspected white van to the press; white vans in the area
were routinely stopped and investigated, often causing traffic delays.
E. The sniper called the tip line to make extortion demands, and he identified himself using the phrase
found at the scene on the playing card; since the phrase had not been officially released to the press,
the call was deemed to be valid.
F. A disagreement brewed at SNIPTF between trained negotiators and profilers. The negotiators
wanted police to take a hard line with the shooter and use strong language to “call out” the sniper.
Profilers believed a more reserved approach would be better, possibly drawing out information to
help identify the sniper.
7
SRA111 INTELLIGENCE ANALYSIS GAME: PART II
INCIDENT LOCATION GEOSPATIAL DATA
Figure 2 Freeway Interchange Location of Shooting Incidents A—I; Incident F Data “Pop-Up” Illustrated
8
SRA111 INTELLIGENCE ANALYSIS GAME: PART II
Table 2 Geospatial Incident Data
MapID
Freeway1st
Freway2nd
A
B
C
D
E
F
210
10
10
210
10
60
405
405
5
5
110
605
G
H
I
5
210
405
710
2
101
IncidentPoliceID
124962
135723
138507
139658
140370
147311
ADDITIONAL SCENARIO DATA
149060
149166
149222
DateStamp
TimeStamp
09/05/2008
09/05/2008
10/03/2008
10/03/2008
10/03/2008
10/03/2008
5:02PM
6:02PM
7:41AM
8:12AM
8:57AM
9:58AM
10/09/2008
10/11/2008
10/14/2008
8:10PM
2:30PM
9:15AM
Read the complete “Incident Data” in Table 3 associated with this part to review location, date/time,
facts, assumptions, and eyewitness reports. After reviewing the data, draft answers to the questions
provided.
Table 3 Complete Incident Data
MapID
Freeway1st
Freway2nd
IncidentPoliceID
DateStamp
TimeStamp
FactsKNOWN
Assumptions
Eyewitness
A
210
405
124962
09/05/2008
5:02PM
Single bullet
fired into a
GoGreen
grocery store,
narrowly
missing check
out clerk
No evidence, no
motive, no
suspect;
“random event”
B
10
405
135723
09/05/2008
6:02PM
Steve Johnson,
55 year-old
African
American
father of an 18
year-old son
shot and killed
leaving a
hardware
store in a
shopping
plaza, across
the street from
a police
station. Bullet
probably highpowered,
possibly .223
military
caliber.
No evidence, no
witness, no
suspect, no
motive, no
robbery
Man and a
woman in a
Thunderbirdlike blue car
seen driving
away;
dismissed as
“location
improbable” at
time of
shooting
Loud “boom”
heard, no
shooter seen.
White sedan,
possibly
Toyota seen
(dismissed as
“location
improbable” at
time of
shooting)
9
SRA111 INTELLIGENCE ANALYSIS GAME: PART II
MapID
Freeway1st
Freway2nd
IncidentPoliceID
DateStamp
TimeStamp
FactsKNOWN
Assumptions
C
10
5
138507
10/03/2008
7:41AM
No evidence, no
witness, no
suspect, no
motive, no
robbery; not
linked with
previous
incidents.
D
210
5
139658
10/03/2008
8:12AM
E
10
110
140370
10/03/2008
8:57AM
Jimmy
Buchman, 39
year-old white
male, died
while mowing
lawn. Initially
thought to be
a mower
malfunction,
later
determined he
had been
apparently
shot.
Sanjay Akbar, a
54 year-old
Indian-born
man was
fatally shot
while putting
gas in his Taxi.
An officer was
sitting fifty
yards away in
a patrol car in
heavy traffic.
Maria Lopez, a
34 year-old
Hispanic
mother of a 7
year-old son
was shot
sitting at a bus
stop in front of
a post office.
F
60
605
147311
10/03/2008
9:58AM
Mary Parker, a
25 year-old
white woman,
was shot while
purchasing
gas. This was
the sixth
possibly
related highpowered rifle
shooting case,
fifth shooting
death, and
fourth
shooting death
in roughly two
hours.
Police expanded
motivations to
include racial
crime, hate
crime, or
terrorism. In
addition, a link
between the
victims was
being sought. A
hotline was
created to
report
suspicious
activities,
especially
information
Eyewitness
No robbery, no
evidence, no
witnesses;
investigators
now dismissing
domestic crime
and robbery
(most common
homicide
motives)
White van with
black lettering
lead released at
press
conference.
Witnesses
heard a
“popping”
sound. A
Spanish
speaking
witness
reported
seeing a white
van with black
lettering leave
the area.
10
SRA111 INTELLIGENCE ANALYSIS GAME: PART II
MapID
Freeway1st
Freway2nd
IncidentPoliceID
DateStamp
TimeStamp
FactsKNOWN
Assumptions
Eyewitness
about white
vans. Forensics
began
evaluating
bullet
fragments, and
victim autopsies
were
conducted.
ADDITIONAL SCENARIO DATA
10/09/2008 8:10PM
Emmanuel
Carole, a 72
year-old black
male carpenter
(originally
from Haiti) was
shot and killed
crossing the
street.
G
5
710
149060
H
210
2
149166
10/11/2008
2:30PM
I
405
101
149222
10/14/2008
9:15AM
Jennifer
Masters, a 43
year-old white
woman,
survived being
shot in the
parking lot of a
different
GoGreen
grocery store.
Evan Michaels,
a 13 year-old
male, survived
being shot as
he walked into
his middle
school.
Police confirm
that a .223 highpower rifle has
been used in all
shootings from
a distance of
100-150 yards.
Police alerted
shooter may be
driving north.
Ballistics linked
four of the
shootings.
Police announce
that they are
seeking a serial
killer. A joint
operation
command is
formed
combining local
and federal1
police. No
motive, no
suspects, and
no link between
victims.
Witness
reported a
burgundy
Caprice ran a
red light at the
time of the
shooting; was
discounted as
a suspect
vehicle when
later
discovered
abandoned
and burned.
Dark-colored
car with
Arizona plates
and tinted
windows seen
driven away by
a black
teenager.
Police, assisted
by academy
recruits, search
and discover a
bullet casing
and a playing
card with the
words, “For
the police,
from your
friend and
God.” This
information
was not
released to the
media.
1
Federal representatives included the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF), Federal Bureau of Investigation
(FBI), the Secret Service, and the US Marshals; combined they were called the SNIP Task Force (SNIPTF).
11
SRA111 INTELLIGENCE ANALYSIS GAME: PART II
QUESTION SET: SUPPORTING EVIDENCE (25 POINTS)
Despite significant internal disagreement, the SNIPTF team shared this shooter profile with the media:
Single shooter, angry, self-centered, fascinated with weapons and violence, recently suffered a
domestic or job related setback, a white male adult, not displaying signs of mental illness,
frequented gun shows, liked military books and movies, not in a relationship, not
confrontational, hypersensitive and suspicious, and playing close attention to media coverage.
Select THREE pieces of the above profile and indicate whether supported by fact/witness statement from
the Case Table 3 (e.g., Table, 3/Incident B), OR indicate as SNIPTF conjecture.
EXAMPLE
Table, 3/Incident B, “The bullet was thought to be from a high-powered military rifle” (supports
shooter may have interest in military objects and weapon fascination).
SNIPTF 1
SNIPTF 2
SNIPTF 3
QUESTION SET: SUPPOSITION ANALYSIS (10 POINTS)
After some deliberation, and evidence analysis, SNIPTF is confident that witnesses in Incident E actually
observed the shooter leaving the scene.
Number TWO (2) pieces of specific fact/witness statement and cite (e.g., Table 3/Incident B) from Case
Table 3 that might support SNIPTF’s belief that shooter is driving a white van.
NO EXAMPLE FOR THIS PART (GUIDING QUESTIONS INSTEAD)
 Was it reasonable to assume a vehicle was being used?
 What benefits would a van, versus a car or truck, provide?
 Why a white van specifically?
White Van 1
White Van 2
12
SRA111 INTELLIGENCE ANALYSIS GAME: PART III
The use of data analysis is a growing trend in
investigations. Data sources are readily provided by
video cameras and digital transactions. Optionally,
students may evaluate his/her “digital footprint“
using EMC’s downloadable calculator
( http://bit.ly/HuotZ3).
LICENSE PLATE RECOGNITION (LPR) is one of the
new forms of data capture that is becoming quite
popular ( http://bit.ly/1b4UxMh) with law
enforcement. Units about the size of a paperback
book can be mounted atop police cruisers to capture
data on every car it passes; it is conceivable that these devices could also be installed at major freeway
interchanges.
In this part, students will analyze LPR data provided in an Excel file. Assume that this data was captured
at freeway interchanges during the time of each shooting incidents (plus or minus one hour).
In the Angel assignment, students will also be given the names of three Persons of Interest (POI) that
witnesses believed they observed at a shooting incident by describing vehicles and/or parts of license
plate numbers. Students will evaluate LPR by filtering data In the Excel file to determine whether further
police investigation of the POI may be beneficial. POIs will be determined to be either a:



SUSPECT: LPR data puts POI at one (or more) shooting incidents, but never at a different location
during an incident
NOT A SUSPECT: LPR data puts POI at another location, during any shooting incident
INCONCLUSIVE: LPR data does not put POI at a shooting incident, but also does not put POI at an
alternate location (i.e., no data, so more investigation may be needed)
VIDEO DEMONSTRATION
View the brief video tutorial demonstrating how to filter Excel’s data by POI’s last name.
QUESTION SET: POSSIBLE SUSPECT DATA ANALYSIS (30 POINTS)
Open the Angel submission exercise for your team, and the Excel file provided in Angel. Teams will be
given three POIs to investigate. Filter POI’s last name in Excel. As shown in the Video Demonstration,
verify Excel’s vertical scrollbar (right-side of window) is pushed completely up before interpreting sort
results, and clear filters before continuing.
13