← Cyberwarfare: From Statecraft to OperationsSkip to lesson ↓

Intelligence, Indications, and Attribution

Intelligence Support to Cyber Operations

Convert commander questions into collection that supports access, effects, protection, assessment, and warning.

Approx. 3 min reading · Includes diagrams; allow extra time for reflection and linked resources.

Start reading ↓
About this learning content and editorial review
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

Your focus

What you’ll learn

  • Write prioritized intelligence requirements and a collection matrix for a notional campaign decision.

This lesson connects the intelligence cycle to operational tempo. Learners create decision-linked requirements and balance target understanding with counterintelligence and intelligence-gain-or-loss concerns.

Build requirements around decisions

Begin with a decision and deadline: whether to protect an access, change posture, approve an effect, warn a partner, or attribute publicly. Turn it into a question whose answer could change the choice. “Monitor Sandworm” is a topic; “Will this access enable disruption of regional electricity restoration during the next 30 days?” is a decision-linked requirement.

Decompose the requirement using the cyber strategic warning and intelligence-requirements workflow: define indicators, observables, sources, owners, update cadence, and thresholds. Collect across technical telemetry, malware analysis, infrastructure, vulnerabilities, identity, organizational behavior, geopolitical events, public messaging, partner reporting, and target-system knowledge. Grade source reliability separately from information credibility. Record alternative explanations and what would disconfirm the leading judgment.

Intelligence supports more than targeting. It estimates civilian dependencies, partner equities, recovery behavior, adversary adaptation, probability of attribution, blowback, and post-operation effect. The declassified Operation Glowing Symphony material shows collection management, intelligence gain/loss, political-military assessment, collateral-effects estimation, legal review, and measures of effectiveness intertwined with offensive planning.

Decision-led intelligence chainSix linked nodes move from decision to requirement, indicator, source, assessment, and feedback, while a deadline bar limits collection.Intelligence begins and ends with a decisionDECISIONREQUIREMENTINDICATORSOURCEASSESSMENTFEEDBACKDECISION DEADLINE • collection value decays with time
Decision-led intelligence chain — A chain connects decision, requirement, indicator, source, assessment, and feedback under a deadline.

Manage intelligence gain, loss, and counterintelligence

Acting can reveal collection, burn access, teach the adversary, expose a partner, or disclose what is known. Waiting can allow harm. Create an intelligence gain/loss assessment for every consequential action: information gained through execution, information lost through disclosure or changed behavior, sources at risk, recovery opportunities, and future access cost.

Use staged decisions. Preserve passive observation where it answers a higher-priority requirement; take protective action when mission or civilian risk crosses an agreed threshold; share enough with a partner to reduce harm while protecting sensitive provenance. Maintain strict handling for operational data and avoid contaminating intelligence with assumptions from planning. After action, compare predicted adversary reaction with observed adaptation and update collection.

Intelligence gain-loss balanceA balance compares protection and new knowledge with burned access, source exposure, and adversary learning, above an action threshold.Every action changes what can be knownGAINprotect • learn • assessLOSSburn • expose • teachMISSION / CIVILIAN HARM THRESHOLD
Intelligence gain-loss balance — A balance weighs mission protection and new knowledge against burned access, source exposure, and adversary learning.

Resources