The ACE and the Intelligence Cycle – Forward Observer Shop

The ACE and the Intelligence Cycle

Last Friday, I answered a reader question about the ‘central processing’ for community security. During an emergency that threatens our community, we need to have an organizational brain. This brain, much like our own, receives information from its senses, and then makes sense of that incoming information. That information might be new gang tags or suspicious activity during peace time, or it might be a group of looters, the sound of gun shots, a heavy law enforcement presence, a bridge that’s been washed out, a wildfire that’s expending near our town, or any number of potential pieces of valuable information during an emergency scenario.

For community security, we call this ‘brain’ the Analysis & Control Element, or ACE for short. If you have a neighborhood watch, a community security team, or a preparedness group — or even if you’re going it alone — you need to have an ACE. Without a specific person or team capable of sorting through incoming information about what’s happening in the area, you can’t produce intelligence. You must have an ACE. (And you can read a more introductory article here.)

Today, we’re building onto our knowledge of the ACE. By now, you should at least know what the ACE is and what it does, generally. The ACE is our brain, and our intelligence collectors are our senses. It’s really as simple as that.


I don’t need an ACE… do I?

One of the most important things we can do to improve our security is to understand the event or the threat facing us. Once we understand that, then we can define our mission. Your mission might be as simple as Secure the community from looters and criminals during a natural disaster. One night several years ago, I was listening to my police scanner during a tornado in the area. Shortly after the tornado had passed, residents reported a black jeep driving around their neighborhood and trying to loot destroyed homes. The police were finally able to find the jeep, but what would that community have done without police? This is a really great reason why we want to have a neighborhood watch or community security team. Anything more extreme than this tornado, especially in a “without rule of law scenario”, and it’s easy to see how community security is going to play a much more vital role for you, your family, and the other families in the community. In a worst case scenario, maybe your mission becomes Defend the community from looters and criminals. In order to secure or defend, you need access to intelligence. Intelligence doesn’t produce itself, so yes, you need an ACE.

In any case, once we understand the threat and can define our mission, then we can understand what intelligence we need to provide in order to support the mission. Remember our maxim: Intelligence drives the fight. If there’s no intelligence, then operations are ineffective. If operations are ineffective, then bad guys win. If bad guys win, then we’re at risk of losing life or property.


I know I need an ACE. How should I organize it?

The most logical way to answer this question is to ask What is the mission? We can’t “drive the fight” unless we know what we’re driving towards. I don’t want to beat a dead horse, but I can’t overstate this enough: as an intelligence guy, if I don’t understand the mission, then I won’t be very effective and producing the necessary intelligence. But the better I understand my commander’s vision for operations, the more I understand what the commander wants to do in response to the threat — i.e., the mission — then the better I’ll be able to inform him about the things he need to know in order to make decisions. (For more on what this process looks like, refer to Day 01 of the Intelligence and Community Security series.)

Once we understand our mission, then we’re going to have a much better idea of how to drive it. I’m going to provide some recommendations for ACE organization, along with what ACE Operations looks like. Remember that we’re going to be required to have manning for 24/7 ACE operations. That means manpower. While I recommend three positions, keep in mind that three people can do this job effectively for short durations. Once we get beyond 18-24 hours, we’re going to need some rest – that means a gap in coverage, which means we need manpower.

At a bare minimum, we need three positions: ACE Chief, Collector, and Analyst. The reality is that we’re going to have to wear several hats because there’s a lot that needs to get done. Let’s work around the Intelligence Cycle for a look at this process.

Phase One: Planning, Requirements, Direction – The ACE Chief and Analyst work together to determine the mission requirements. The mission requires our community security team to prevent looters and criminals from threatening the community during this emergency. We don’t know how long this emergency will last, so we should be prepared to produce intelligence indefinitely. Our ACE has an enduring requirement to produce Early Warning about potential threats in the area. We identify our Intelligence Requirements, and then we task our collectors to go forth and seek out intelligence information.

Phase Two: Collection – Who are our collectors? Well, we have one guy in our ACE responsible for Collection, and in this case the ACE Chief will also cover down on collection management. (Do we see why the ACE Chief — maybe that’s going to be you — needs to be well versed in intelligence? He wears all the hats.) Our Collector is responsible for monitoring the police scanner and, if available, the news and social media. We set up the scanner in the middle of the room and let it run. If something significant occurs, the Collector is responsible for writing down that information. If the Collector sees something on Facebook or Twitter, he writes it down. Those become intelligence reports and are tracked in Phase 3 (below). But we can’t do this with just one collector, so the ACE Chief is also responsible for informing community members to be on the lookout. A neighbor calls or radios over to the ACE to report that black jeep that’s looting in the area. The ACE Chief reports that to the community security team and others in the area, and now the security guys have a mission: find that black jeep and stop the looting. Meanwhile, the ACE Chief has informed community members to keep their eyes peeled. Because we’ve done our Area Study, we know how out-of-area looters or criminals might get into our neighborhood, so we’re going to recommend that we get “eyes on” those areas to look out for suspicious vehicles or potential criminals. Maybe we even set up a checkpoint or two so we can control access. Now we have a constant feed of information about the people coming into our neighborhood. And those security guys are intelligence collectors, too, because everyone has a responsibility to report suspicious activity. In the Army, we used to say that “Every Soldier is a Sensor”. If a soldier spotted a potential threat, he had an obligation to report it. The same is true of our community — every neighbor is a sensor. And when they sense something suspicious or see a potential or active threat, they report it to the ACE.

Phase Three: Processing – Now that the ACE has a decent flow of intelligence information coming in, we need to process it. Our Analyst is responsible for our maps and map overlays. (For an overview of required gear, see the Ultimate ACE Startup Guide.) The scanner pipes up: police dispatch is reporting that a green Ford F-150 has been spotted looting a few miles away, outside our Area of Operations (AO). The Analyst should have a list of suspicious people and vehicles, and should make it accessible to community members to help identify them. (Do we see why community involvement is so important?) The Analyst goes over to our 24″ x 36″ area map and updates the threat overlay with the last known location of that F-150. As the night goes on, there are more reports of looting and robberies. Every time that kind of information becomes available, the Analyst updates the map overlay. Over the course of several hours, we start to get a general sense of how safe the overall area is. We have a much better indication of which areas are secure and which areas aren’t. But a lack of threat reporting doesn’t always indicate a lack of threat. A neighboring area has been quiet, and we want to know what’s going on over there. How can we confirm or deny that area is safe? A phone call? A security patrol? A few of our guys agree to hop in the truck and roll over there to see what’s going on since we have no reliable information from the area. Let’s get in touch with a few houses over there and see if they’ve seen or heard anything. And since this is a community effort, maybe they become new sensors for us so we can better generate Early Warning for potential threats to our neighborhood.

Phase Four: Production – After our Analyst has had the opportunity to compile some information, we produce intelligence. Maybe every 12 hours, we create a new map overlay to display the significant events that have happened in the area. Maybe once a day, our Analyst finalizes a list of known or suspect criminals and their vehicles. This phase is a little less important if we don’t have strong production requirements. Otherwise, it’s critically important in the military and civilian intelligence agencies.

Phase Five: Dissemination – Intelligence drives the fight, which means that we need to give our finished intelligence to decision-makers. That might be the leader of our community security effort or neighborhood watch. Regardless of who that is, they need intelligence in order to make good decisions. It may even be a good idea to share a lot of the intelligence with members of our neighborhood. Maybe the Analyst gives an intelligence briefing of the general to members of the community. If we have the capabilities, let’s print up some flyers of known or suspected criminals, so we can help our community spot these people. There are a lot of possibilities depending on the mission and situation, however, let’s keep in mind the most important part: finished intelligence is useless unless it gets into the hands of the people who need it. Finish strong and make sure that all the efforts that went into the intelligence result in a positive effect for community security.

These are the five phases of the Intelligence Cycle, along with hypothetical activities that would happen during each phase. It’s important to note that while this phase should be linear (that is, that each phase occurs in succession), the Intelligence Cycle is ongoing. We may be in various phases simultaneously. If, during the process of updating our map (Phase Three), one of our Collectors gets information about nearby gang activities (Phase Two), then we need to enter Phase One for this new threat, which is figuring out what we know and what we don’t know about this gang, generating Intelligence Requirements (How many? Where? What weapons do they have? What vehicles do they have?), and then tasking those requirements out for collection (re-entering Phase Two). That intelligence information is hopefully collected very quickly, and then we start Phase Three again.

Bottom line: if you don’t have the manpower to get all this done, now is the time to develop it. Now’s the time to hold a town hall meeting, or a community meeting, or go door to door to your neighbors and gauge their interest in community security. Now’s the time to start a neighborhood watch and begin to formalize this process before the next emergency.

I hope this article helps you to visualize the work of intelligence for community security. If you want more knowledge and training, there are a few options:

The Area Intelligence Course is a step-by-step process of identifying threats to your community and generating threat intelligence. It’s available online, with hours of lectures and how-to’s available for streaming 24/7, and it also has some worksheets that will help you determine the risk to your community during an emergency.

SHTF Intelligence: An Intelligence Analyst’s Guide to Community Security is a nearly 200-page manual for the work of local intelligence. It’s a start-to-finish guide to building and implementing an intelligence program to keep your community secure during an emergency.

Lastly, my next SHTF Intelligence course is 19-20 May in Austin, Texas, I’ll be in Idaho in June, and have courses planned for North Carolina, Pennsylvania, and California later in the year. I’ll be updating my training calendar with new dates. If you want more information about these courses, be sure to sign up for my weekly email update below.

As always, if you have questions, comments, or concerns, please leave a comment below or send me an email.


Always Out Front,

Samuel Culper

If you want to sign up to receive a weekly update by email, then use the first form below. If you’d like to receive these blog posts (Mon-Fri) by email each day, sign up with the second form.




Mike Shelby is a former military intelligence NCO and contract intelligence analyst. He spent three years in Iraq and Afghanistan and is now the intelligence and warfare researcher at Forward Observer.

Leave a Reply

Your email address will not be published. Required fields are marked *

Name *