In my ten years of practical experience as a working crime analyst, I wondered why crime analysts at the local level of law enforcement seemed so much more willing to share their work processes, products, tips, and advice than state and federal analysts. While I joined both the International Association of Crime Analysts and the International Association of Law Enforcement Intelligence Analysts to learn everything I could, I found the crime analysts to be very open and sharing while the intelligence analysts, and those who might be called investigative analysts working at state and federal agencies, were more private and abstract in what they shared. This is not meant as a criticism at all. I just could not understand it. I knew I was working as a crime analyst and crime analysts were the people doing my job, and their advice was most needed for me. I was SO very grateful to them. But I WANTED to know more about the particulars of intelligence/investigative analysis. It was a big mystery.
Then I went to work at federal law enforcement agency and suddenly the clouds were removed from my eyes. Most of my analytical work involved cases that might go to trial or result in a plea deal, and none of that case information could be shared with anyone, except on a case investigated jointly with another agency. No other sharing was allowed. Maybe after there was a conviction someone might use a case as an example at a conference, but that was about all.
The culture of federal law enforcement is based on asking permissions if you want to do work outside of the agency that often involves navigating a long chain of command that ends up from your field office to offices and desks in Washington, DC. You can get permission to do things outside your agency, but it requires a real determination and the need for an excellent justification. You don't do things just because it sounds like a good idea, or you feel like trying it, or you want to help an individual or the whole profession (unless you are super-motivated). Your loyalty is to the agency - that permeates everything about the workplace. Because what you do is seen as reflecting on the agency's reputation, you have to have the agency's reputation in mind. Your individual identity and opinion is a moot point. I will always have a loyalty to the federal agency where I worked, but it was difficult for me to not desire my individuality when I worked for it.
And this is why I have been quiet for many years, not blogging, not doing extra beyond working as an investigative analyst (and grateful for the experience), nose to the grindstone, and then enjoying early retirement. I just did not like asking permission! The irony is that I was better at being an investigative analyst, because case work is like having a big research project with one limited universe of a subject, and crime analysis involves a big wide universe of crime and many technical tools that challenged me often, as I am not a statistician nor very computer tech savvy, and only type with a few fingers. But crime analysis meant more to me, because it is urgent and public safety could be impacted positively on a daily basis if I did a good job. It could protect the families I know in the city I live in.
I prefer to be part of preventing crime over getting the bad guy (or woman) off the street - even though that matters, too. State and federal law enforcement agencies are mainly focused on criminal investigation over crime prevention.
Unfortunately, the culture of not sharing inhibits the growth of the analytical profession. There is much to be learned from one another, and in all agencies we benefit from mutual support.
When I read the article below, I was happy to see my observations articulated and confirmed in the realm of cyberthreat analysis - which is not shared as it should be - and you want cyberthreat information shared with many, because the target victims are across the globe. Threat intelligence analysis should help prevent crime, and sharing really matters in prevention efforts.
Read: Most Threat Analysts Banned from Sharing Intel with Peers at this link.
Quote from the article:
"It revealed that two-thirds (66%) of threat intelligence analysts participate in a professional community, in order to gain access to the most up-to-date and actionable information to help them protect their organization.
This includes subscriptions to vulnerability databases (61%), taking part in professional forums and blogs (45%) and receiving threat intelligence from paid (42%) and free (33%) feeds.
However, employers are usually against these same analysts sharing their own intelligence with external communities. Over half (52%) claimed they do not allow such activity."
No comments:
Post a Comment