To be honest, I have never used What If? analysis. It’s in the books, but like so many other lesser known analytical tools, it seldom sees the light of day. The technique requires the analyst to assume a less likely hypothesis has occurred and to work backwards from that point to imagine how it could have been achieved and what indicators and warnings may have suggested it would happen. It is a big picture tool intended to challenge confirmation bias. What If? analysis been around for a long time. The CIA put it under the broad heading of ‘Challenge Analysis’. These are tools used after a consensus has been reached and is a double-check technique to prevent complacency. It is a re-evaluation and not a fundamental part of the analytical process from beginning to end. I would argue that it should be seen as more of a principle applied throughout the intelligence cycle than a technique brought in close to the end.
Three of the best-known examples of inspirational intelligence analysis are shown here. Each, in its day, set the benchmark for how analysis should be conducted, and they all demonstrate the application of What If? Analysis, not as a double check at the end of a process but a statement at the start.
Ibrahim Saeed Ahmed, known as al Kuwaiti, was a mid-level facilitator in al Qaeda who had historic links with Usama bin Laden. He was not on anyone’s radar until in 2008, but inconsistences in reporting about him made someone in the CIA ask the question, ‘What if al Kuwaiti is still alive, active and currently associated with bin Laden?’ With hindsight this seems an obvious question to ask. At the time, the CIA had been searching for bin Landen for seven years and had processed hundreds of thousands of reports on many thousands of people; al Kuwaiti was a long shot. But, in this case he was tracked down through his mobile phone use and in 2010 he was followed to a compound in Abbatobad in Pakistan. In the following year he died in the attack launched by US special forces that killed Usama bin Laden in the same compound.
In 2011 a dark web drugs marketplace appeared called Silk Road. Its design, innovative use of TOR and Bitcoin meant that the anonymous person behind this site, known as Dread Pirate Roberts (DPR), was becoming rich while remaining completely anonymous. Six US agencies dedicated resources to identifying DPR. Gary Alford was an investigator with the Inland Revenue Service assigned to the investigation. One night he asked himself the question ‘What if the founder of Silk Road had discussed Silk Road online before it had gone public?’ Any mention of a TOR site called Silk Road, referenced before its opening, must have insider knowledge. He used a simple Boolean search string to find reference to the site prior to February 2011 and he came up with a name, Ross. At first his colleagues and investigators from other agencies didn’t believe the man behind this market could be found in one night with a Google search. The more Alford searched, the more he became convinced that Ulbricht was DPR. In time Alford was proved right and his investigation was key to the eventual arrest and conviction of Ulbricht in 2013.
When the Bellingcat agency investigated the 2018 poisonings of Sergei and Yulia Scripal in Salisbury, they decided to focus on the grainy images of the two men who had arrived in the UK from Russia and were the principal suspects. There was very little to go on, but the Bellingcat analysts ask the question, ‘What if these men were in the GRU, Russian Military Intelligence, and there were historic images of them in published journals?’ This led them to identify one of the would-be assassins from a photograph in a publicly available opensource GRU yearbook. Comments in the article led Bellingcat to eventually identify the assassin as Anatoliy Chepiga. No other professional or government agency had managed to do this.
It could be argued that these are examples of investigations and not routine intelligence work, and the mindset for investigations and intelligence analysis are different. People may say intelligence is about routine systematic procedures while investigation is about outwitting the adversary, about imagination and flair. Such ideas are just wrong but the mindset behind them has resulted in some of the worst intelligence failures in recent history. Time and again intelligence agencies have been criticised for lacking imagination. In reviews following both 9/11 and the Iraq WMD scandal, it was shown to be unimaginative, routine procedures that allowed analysts to miss key information.
I suspect many of the people responsible for the successes mentioned above had never heard of What If? Analysis. Whether they saw themselves as analysts or investigators, they used their imaginations to solve the problem.
With the current conflict in Ukraine as an example, analysts can work in one of two ways. They can wait for information to arrive, look for meaning in it and make an assessment or they can ask questions like, ‘What if Putin was prepared to used chemical weapons in Ukraine?’ or ‘What if morale in the Russian Army was so low, troops refused to fight?’. In so doing they develop a set of indicators that will provide granularity to the collection plan and shape the collection process. From this they will understand if sources and agencies are up to the job. They will develop new hypotheses and broaden their perspective to remove confirmation bias from their thinking. In short, this simple question can give analysts ownership of the intelligence cycle.
For some analysts, the analytical process is a passive one. They wait until the intelligence lands on their desk and then wonder what it means. Taking a step up from this requires the analyst to look at a situation and ask what if? This is proactive analysis at its best.