1. AQUAINT Scenario Breakout -- Group 2, Team 1 12 June 2002

2. AQUAINT Goal l Brief the Joint Staff J2, Director of Intelligence on the terrorism threat for Thanksgiving weekend l Short suspense: briefing due to J2 in 2 hours l Read message traffic and assemble data into logical pattern l Establish means, motive, opportunity and intent to terrorize l Perform link and nodal analysis via data mining l Competing event timelines and hypothesis development l Structure of “typical” terrorist organizations/modeling l Analyst questions: l Mentoring needed for junior analysts (ARDA researchers) l Sharing of data among various analysts at different agencies l Answer Fusion – Storytelling through weighted evidence l Tell J2 what you know (argument), what you don’t know (missing data) and what you think will happen (assumptions) l Worst case scenario (something will happen) l Most likely scenario (argument and why it will happen)

3. AQUAINT Process l Each member read all messages l Date/time group important l Develop timeline and plot locations for events l Compare to typical terrorist organization l Extrapolate and compare to required events in terrorist planning timeline: Cut OutCut Out Cut Out Political Wing Military/ Execution Wing Finance/ Logistics Wing Ideology Motivation Terror Event Planning Financing Team Training Team Assembly Equipment & Transport Travel Pre-operation Surveillance Execution Order

4. AQUAINT Problems l Brief the Joint Staff J2, Director of Intelligence on the terrorism threat for Thanksgiving weekend l Did not complete task in time l Too much data to sift through manually in addition to training l Performed some link and nodal analysis l Some event timelines and hypothesis developed using analyst imagination and previous experience l Missing some events along timeline due to lack of data collection l Analyst questions: l How do they do it today? l How can XML assist in the future? l How to deal with conflicting/bogus data among sources? l Participants learned how to be an analyst for the day l Discovered difficulty of daily analyst tasks l Built timeline of events logically, anticipated future events

5. AQUAINT Solutions l Need data mining and discovery tools l Need tools to organize data logically and compare to existing models of behavior, prompts for next event l Need tools to share data among multiple agencies and across networks of varying classifications and formats l Analyst participants “gave up” reading traffic due to extreme volume of pieces from multiple agencies l Need tools to put pieces into perspective l Need tools that allows “drill down” into details but maintains “big picture” and compares competing hypothesis l Need tools to model potential outcomes based on precursor events l Predictive analysis based on experience and timelines l Factoid Q&A combined with other tools to establish patterns and hypothesis with focus on meaning