АОРД Логотип

Crime

ILP

OSINT

Intelligence

Criminal analysis

ALL-UKRAINIAN ASSOCIATION

SCIENTISTS AND SPECIALISTS IN THE FIELD OF OPERATIONAL AND SEARCH ACTIVITIES

Latest news

All news
Review of the textbook by Fedchak I. A. Modern Analytical Intelligence.

Review of the textbook by Fedchak I. A. Modern Analytical Intelligence.

1. General characterisation of the publication

The textbook by Ihor Andriyovych Fedchak, “Modern Analytical Intelligence”,  DOI: 10.5281/zenodo.19664430 was prepared and published by the Lviv State University of Internal Affairs with the support of the European Union Advisory Mission in Ukraine. The book was recommended for publication by the University's Academic Council; its reviewers were B. Denysenko, organised crime expert of the European Union Advisory Mission, and I. Revak, head of the research laboratory of OSINT intelligence and security analytics at the Lviv State University of Internal Affairs. Structurally, the book comprises four modules and eleven chapters, arranged according to the logic of a consecutive exposition of the stages of the analytical intelligence cycle — direction, collection, the application of analytical techniques, and dissemination.

It is impossible to appraise this work outside the context of its appearance. Ukraine is implementing the Intelligence-Led Policing model, and that implementation has been fixed in departmental orders of the National Police dating from 2016, while the circle of specialists with a systematic command of the model remains narrow and the body of knowledge about it is being formed predominantly in academic and educational publications. In such circumstances a textbook does not merely describe the model — it shapes the understanding of the model held by those who will subsequently work within its framework, and consequently every inaccuracy in conveying the model's foundations will be reproduced for years and will be corrected far less easily than an isolated methodological error. For precisely this reason the requirements applicable to such a publication must be substantially higher than those applicable to an ordinary teaching aid, and it is against these requirements that the book is assessed below.

2. Strengths of the publication

The source base of the textbook deserves a high assessment for its scale. Of the 187 items used, 117 are foreign, and these constitute the canonical corpus of the discipline: the works of R. Heuer, D. Kahneman, M. Lowenthal, R. Clark, R. Jervis, P. Gill and M. Phythian, doctrinal documents of NATO, the US Joint Staff and the UK Ministry of Defence, the handbook of the United Nations Office on Drugs and Crime, training material of the Central Intelligence Agency, and studies by the RAND Corporation. The depth to which this body of material has been worked through substantially exceeds the level typical of Ukrainian-language publications of the corresponding profile.

The reproduction of analytical techniques has been carried out with methodological accuracy, and this is a substantial merit of the publication, since a technique distorted in a textbook is thereafter reproduced in practice as the norm. The classification of structured analytic techniques into eight “families” correctly reproduces the taxonomy of R. Heuer and R. Pherson with explicit attribution, while the analysis of competing hypotheses is presented as a nine-step algorithm that preserves the very logic most often lost in paraphrase: the hypothesis selected is not the one most confirmed but the one least disconfirmed. The illustrative example involving the theft of museum exhibits is methodologically correct and pedagogically well chosen.

The treatment of the discipline of expressing uncertainty merits a high assessment. The textbook sets out systematically the institution of words of estimative probability, that is, standardised verbal formulations each of which is tied to a known numerical range: it presents the classic table of Sherman Kent, in which verbal formulations are matched against numerical probability values and permissible margins of error; it offers a more recent interpretation of those same formulations in terms of ranges; and it reproduces the British “probability yardstick” with its explicit requirement to abandon vague modal expressions. The requirement of standardised use of these formulations has been included in the list of quality criteria for the analytical product, and a separate block of self-assessment questions is devoted to the topic. This is the component most frequently lacking in domestic publications, and the author has worked it through conscientiously.

The system for evaluating source reliability and information credibility in its 4×4, 5×5 and 6×6 variants has likewise been correctly reproduced, together with the practical caution that, in case of doubt, it is better to understate the rating than to overstate it.

The sub-module devoted to work with the future is, in point of depth, the strongest part of the publication. Some thirty-seven pages are allotted to it, across which drivers and key drivers are consistently distinguished, the assessment of the intensity of their operation is described, and the construction of a scenario matrix at the intersection of two axes of uncertainty is set out, with a characterisation of all four quadrants and the caution that the assessment of a quadrant as desirable or undesirable depends on the nature of the drivers themselves. A typology of scenarios is offered, with the “joker” scenario singled out; the role of disruptors and the procedure for finalising scenarios are explained. The indicator system has been elaborated with particular thoroughness: the types of indicators, the structure of their description with baseline and threshold values, the indicator card as a working template, and the quality criteria — observability, validity, reliability, stability, uniqueness. This is a level of detail suitable for direct application in practical work.

The chapter on the use of artificial intelligence is the most topical part of the book. It examines the configuration of specialised AI agents through system prompts and Skill modules, the deployment of local agents based on Claude Code, the use of Gemini and NotebookLM for processing primary documents, and the integration of models through APIs; the exposition is accompanied by security cautions: the developers of third-party agents see usage statistics, and platforms store prompts on their own servers, for which reason sensitive data and investigative materials must not be sent to them.

The author's terminological position regarding the designation of the specialist himself deserves due recognition. Notwithstanding the established use of the collocation “criminal analyst” (кримінальний аналітик) in part of the literature cited, the textbook does not employ it, consistently choosing instead the neutral “analyst” or the descriptive construction “analyst of a criminal analysis unit”. This choice is well founded, since in Ukrainian the adjective “criminal” (кримінальний), when placed alongside the designation of a person, signals — by analogy with such expressions as “criminal boss” or “criminal element” — membership of the criminal world rather than a profession, so that the fused collocation risks being read as “criminal-minded analyst”. The source of this trap is the inexact rendering of the concept of crime analysis as “кримінальний аналіз” (criminal analysis) instead of “аналіз злочинності” (analysis of crime), and the English-language tradition consistently avoids it: the professional association is named the International Association of Law Enforcement Intelligence Analysts, that is, it employs the term “law enforcement analyst”.

The pedagogical architecture of the publication has been thought through: clear objectives for each module, self-assessment questions after each chapter, separate reference lists, worked examples running through the text, and a list of abbreviations that functions as a terminological minimum, supplying not merely expansions but also concise definitions.

Taken together, what we have before us is a conscientiously executed, well-structured work that is in places unique within the domestic literature, and it is precisely this that obliges the reviewer to apply to it requirements of a corresponding order rather than to confine himself to an approving acknowledgement.

3. The principal defect: borrowing the term without borrowing the model

The textbook borrows from the Intelligence-Led Policing model its key term and places that term in its title, while leaving outside the exposition the entire organisational and managerial layer which the term denotes. This is the central defect of the publication; it is doctrinal rather than debatable in character, and it is this defect that gives rise to the majority of the others examined below.

The ground for this assessment lies in the provenance of the concept itself. The term “analytical intelligence” entered Ukrainian usage as a rendering of the English intelligence in the context of the ILP model, and the textbook itself records this provenance in its introductory chapter. The author of the model, Jerry Ratcliffe — according to the relevant OSCE publication, the most cited scholar in the context of ILP — defines Intelligence-Led Policing as a business model and managerial philosophy in which data analysis and criminal intelligence constitute the pivot of an objective decision-making system; consequently, by its genesis the term denotes not the analyst's ability to process bodies of data but the manner in which a manager takes decisions on the basis of that processing. To borrow the term while discarding its managerial content is to deprive it of the very thing for which it was introduced.

This idea was operationalised in the model which J. Ratcliffe proposed in 2008 in a three-component form, the “3-i” — interpret, influence the decision-maker, and impact upon the criminal environment — and which in the second edition of 2016 he expanded into the four-component “4-i” by adding the initial component of intent; the corresponding diagram is placed on page eighty-three of that edition, and an independent reproduction of it is contained in the OSCE Guidebook on Intelligence-Led Policing. The logic of the model is as follows: the decision-maker formulates his intent and conveys it to the analyst; the analyst interprets the criminal environment; he must then influence that person by his conclusions; and finally that person's decision exerts a real impact upon the criminal environment. It is precisely the last two components that distinguish Ratcliffe's model from traditional cycle models, which terminate in the dissemination of the product and require no confirmation that a decision was taken or that it had an effect.

The primary source of the model is effectively absent from the scholarly apparatus of the textbook, and this is not a minor bibliographical oversight but an indicator of how superficially the model itself has been assimilated. J. Ratcliffe is mentioned only once, and then not as the author of the concept but as the editor of a volume from which a chapter by another author has been taken; neither the “4-i” model nor the Ukrainian or English names of any of its components — intent, interpret, influence, impact — appear in the text. The third edition of his work, published in 2025, has likewise been left out of account.

The situation with the remainder of the ILP canon of authors is still more telling. Bibliometric analysis of the relevant corpus of publications identifies as the most cited in this subject area J. Ratcliffe, J. G. Carter, M. Maguire, N. Cope and J. Sheptycki, and in the second tier S. Chermak, E. McGarrell, D. L. Carter, L. Mazerolle and S. Darroch. Of these ten, exactly one author is represented in the textbook, and even then only in an editorial capacity. All three chronological strata of the canon are absent: the early British stratum, which formed the language of risks, targets and organisational pathologies; the transitional strategic stratum; and the American empirical stratum, devoted to the implementation of the model, to information sharing and to the measurement of its effectiveness.

The absence of the critical branch of this literature is particularly keenly felt. N. Cope's 2004 work is devoted to the gap between the declared importance of analysis and its actual embeddedness in operational policing, while J. Sheptycki's study of the same year, “Organizational Pathologies in Police Intelligence Systems”, cautions against the naive assumption that analytical products are automatically strategic and complete. This is literature that diagnoses precisely the defect which the textbook itself exhibits, and its absence from a publication intended to implement the ILP model in Ukrainian educational practice cannot be justified.

The constituent elements of the managerial layer are likewise absent. The architecture of levels of analytical intelligence is not defined; the toolkit is not differentiated across levels; no typology of analytical products is presented; the procedural mechanisms of tasking and prioritisation are not described — indeed, the concept of the control strategy, the document that records agreed priorities and converts the strategic assessment into an operational agenda, is not used in the publication at all; the legal and ethical limits of the activity are not delineated; and the components of influence upon the decision and impact upon the environment are not elaborated, since the question of implementing recommendations is raised only in passing and without any methodology, while the term “decision-maker”, standard in the Western tradition, has been replaced by the generalised “client” and “manager”.

These six gaps belong to one and the same layer of the model, and it is this that lends the defect its systemic character. If they are removed from the publication, what remains is a methodology of the analyst's work — an aggregate of techniques for structuring, evaluating, generating and testing hypotheses and constructing scenarios — but this aggregate is precisely the content of what domestic practice has traditionally called criminal analysis. A textbook named after the key term of a managerial model thus reproduces at the structural level the very conflation of analytical intelligence with criminal analysis for the sake of overcoming which that term was introduced into Ukrainian usage in the first place.

This is confirmed, too, by the manner in which the textbook closes the cycle. The tenth chapter states directly that feedback completes the dissemination stage and that, on its basis, management formulates the next requests to analysts, so that the cycle closes upon a new task, while influence upon the decision and its consequences remain outside it. The module that ought to have constituted the managerial completion of the cycle is devoted to quality standards for dissemination and to the unit's self-assessment through the after-action review technique and a system of key performance indicators; the latter have been worked out well, but this is the optic of evaluating one's own effectiveness, not a methodology for influencing a management decision.

Fairness requires the observation that the textbook does in fact cover the component of intent: the client's formulation of his intent and its communication to the analyst corresponds in substance to the whole of the second module, with its framing of questions, determination of information requirements and management of collection. The material is set out thoroughly, but it is not named as a component of the model, so that the reader cannot see of which construction the thing he is studying forms a part.

The practical consequences of this defect extend far beyond academic completeness. In Ukrainian law enforcement agencies the managerial dimension of the ILP model is already left out of account, since everyday practice exhibits a persistent conflation of analytical intelligence with criminal analysis, under which a model that is managerial by design is reduced to a technical toolkit for processing information, while the figure of the decision-maker drops out of the field of view of analysts and their superiors alike. A textbook intended to form competencies for an already operative, normatively established system does not correct this defect but reproduces it at the level of educational literature, conferring upon it academic legitimacy.

4. The architecture of levels: levels are mentioned but not distinguished

The textbook does not distinguish the strategic, operational and tactical levels of analytical intelligence — neither as methodological categories nor as a ground for selecting the toolkit — and this is unacceptable in a publication that lays claim to a systematic exposition of the discipline. The corresponding adjectives occur frequently in the text, yet exclusively in attributive use, within enumerations such as “strategic, operational or tactical needs” or “prioritises requests in accordance with operational, tactical and strategic needs”, whereas the publication contains no definition of these levels whatsoever, nor any section devoted to distinguishing them, nor any comparison of their time horizons, objects of study, typical clients and forms of product.

The situation is aggravated by the presence of a vertical model which the reader will inevitably take for an architecture of levels. This is the analytical hierarchy borrowed from the NATO CIMIC Analytic Spectrum concept and presented as the sequence “description — explanation — interpretation — anticipation”. This construction is built upon the criterion of increasing cognitive complexity of the operation and answers the question of how deeply the analyst has worked through the material, whereas the architecture of levels answers a fundamentally different question — for which level of management the result is intended. These dimensions are independent, since a tactical task may require anticipation while a strategic request may be confined to description; and by presenting only one vertical, the textbook does not merely leave a gap but creates a direct occasion for methodological error.

A direct continuation of this defect is the undifferentiated character of the toolkit. A complete review of the text revealed not a single instance in which a technique was correlated with the level of the task: the analysis of competing hypotheses, the “Five Whys” technique, AIMS and the scenario matrix are all presented outside any level-related context, while the isolated cases in which the name of a technique happens to stand next to a word denoting a level are explained by the nature of the instrument itself rather than by the author's design, since SWOT analysis adjoins “strategic” because it is historically an instrument of strategic planning.

International practice, by contrast, builds upon levels not only the choice of techniques but entire research traditions with their own canon of authors. The strategic level, oriented towards assessing long-term threats, identifying intentions and forecasting systemic change, rests upon the structured analytic techniques of R. Heuer and R. Pherson, upon the macro-environmental scanning and conceptual modelling of systemic threats of D. McDowell, and upon the threat and risk assessment methods of J. Ratcliffe. The operational level, which serves protracted investigations and the dismantling of specific groupings, rests upon the social network analysis in criminology of C. Morselli, with its identification of key brokers and measurement of node centrality, upon the link analysis, association matrices and analysis of commodity and financial flows of M. B. Peterson, and upon the network targeting and assessment of criminal groups' resilience to targeted interventions of D. A. Bright. The tactical level, oriented towards immediate response, rests upon the pattern recognition and linking of serial events of R. Boba Santos, upon the hot-spot mapping, prospective mapping and analysis of repeat and near-repeat victimisation of S. Chainey, and upon the geographic profiling and prediction of the next event of D. J. Paulsen.

A comparison of this canon with the bibliography of the textbook reveals a regularity that explains the origin of the defect itself. The literature of the strategic level is represented in the publication: Heuer, Pherson and McDowell are present. The literature of the operational level is entirely absent — neither Morselli, nor Peterson, nor Bright appears in the list of sources. The literature of the tactical level is equally absent in its entirety — there is no Santos, no Chainey, no Paulsen. Along with these authors, entire families of methods have dropped out of the textbook: the measurement of centrality and identification of brokers in criminal networks, association matrices, the analysis of commodity and financial flows, the assessment of network resilience, the linking of serial events, hot-spot mapping, prospective mapping, repeat victimisation analysis, and geographic profiling.

The gap with respect to levels is therefore not an editorial oversight but a consequence of the fact that the author worked through the source corpus of only one of the three levels. The absence of any distinction between levels in the text correlates directly with the absence from the bibliography of the literature of two levels out of three, and for precisely this reason the defect cannot be remedied by the addition of a few paragraphs — it requires the assimilation of two separate research traditions.

The methodological weight of this consists in the following. In international practice the level determines the choice of technique, the depth of its application and the form in which the result is presented: timelines and link analysis serve predominantly tactical and operational tasks; the scenario matrix, work with drivers and indicator systems belong to the strategic level; the analysis of competing hypotheses is applicable everywhere, but with differing depth of matrix. By presenting the toolkit as a single universal set, the textbook deprives the student of the principal practical skill — the ability to select an instrument adequate to the task of a specific client — leaving him with a catalogue of techniques and no criterion of choice.

A logical consequence is the absence of a typology of analytical products, which in international practice is precisely what materialises the distinction between levels. The United Kingdom's National Intelligence Model and the methodological materials of the United Nations Office on Drugs and Crime operate with a list of nine products, each tied to a particular level: threat assessment, problem profile, target profile, market profile, criminal business profile, crime pattern analysis, network analysis, demographic and social trend analysis, and results analysis. The textbook elaborates in fact only the threat assessment, and even that in the context of the SOCTA methodology, so that the publication operates consistently with the generalised notion of an “analytical product” without showing that this product has differing institutionally established forms depending upon its addressee.

5. Forecasting or foresight: an unnoticed substitution of paradigm

The material presented in the textbook under the name of forecasting is, in its methodological nature, foresight, and this substitution is nowhere recognised or flagged, with the result that the section of greatest depth in the publication proves to be methodologically misnamed.

The difference between the two approaches is not a terminological nuance but goes to the very foundations on which a conclusion is built. Forecasting is extrapolative in method and monofuturist in result: it proceeds from the trends of the past, constructs a single most probable future, assigns it a numerical probability and admits of verification against outturn, and accuracy constitutes its principal criterion of quality. Foresight is exploratory and plurifuturist: it does not extend a trend but identifies driving forces and critical uncertainties, constructs several equally plausible alternative futures, as a matter of principle assigns them no probabilities, and is evaluated not by the accuracy of prediction but by the robustness of the decisions taken across the whole spectrum of modelled variants and by the timeliness with which the signals of transition to one of them are recognised.

The entire toolkit of the corresponding sub-module belongs to the second tradition: axes of uncertainty, the four quadrants of the scenario matrix, alternative narrative scenarios, disruptors, the “joker” scenario as an analogue of the wild card, and indicators of transition between scenarios. This is confirmed by the very title of the sub-module — “Future-oriented analysis”, a direct calque of the English futures-oriented analysis. Yet all of this is described consistently in the vocabulary of forecasting, and the conflation is recorded in the text directly and more than once. On page 340 the two concepts are brought together in a single formulation — “dynamic analysis and anticipation (forecasting)”; on page 350 indicators are characterised as “prognostic (future-oriented, foresight)”, so that the sole appearance of the term “foresight” in the entire publication presents it as a synonym for prognostic quality rather than as a distinct approach with criteria of quality of its own; and finally, on page 372 a self-assessment question is framed thus: “For what purpose is the scenario matrix (‘axes of uncertainty’) used in forecasting?” — that is to say, the foundational instrument for working with alternative futures is expressly assigned to forecasting, and in the very place where the student consolidates what he has learned.

The first consequence of the substitution lies in the distortion of the criterion of success. A reader trained to call scenario work forecasting will expect it to come true, whereas a set of scenarios is not intended to come true; and from this derives an adjacent gap: the textbook describes no mechanism for retrospectively checking previously issued assessments against the subsequent course of events. In the foresight paradigm such a mechanism is unnecessary; in the forecasting paradigm it is obligatory; and the publication stands between the two, belonging to neither, even though the systematic comparison of issued forecasts against the actual development of the situation is all but the only means of empirically demonstrating the value of the analytical function to management.

The second consequence concerns relations with the client and is directly destructive of that managerial completeness whose absence has been noted above. A manager to whom an analyst promises a forecast and then supplies four scenarios without any indication of probabilities will perceive this as an evasion of the answer, so that confidence in the analytical function falls precisely at the point where the model of Intelligence-Led Policing requires influence upon the decision.

The third consequence is the blocking of access to forecasting proper. Since the reader believes the topic to have been mastered, he has no incentive to turn to probabilistic methods, not one of which is represented in the textbook. Bayesian reasoning — the sequential updating of a prior assessment as new evidence arrives, which constitutes the mathematical basis of inference under conditions of incomplete data — is not mentioned in the publication; the numerical assignment of probability to individual scenarios is absent, so that the reader is given no instrument with which to answer the client's principal practical question: which of the scenarios is the most probable, and by how much; and the calibration of forecasts, together with the empirical tradition of forecasting tournaments that arose out of the work of P. Tetlock and demonstrated the measurability of the accuracy of analytical predictions, is represented neither in the text nor in the bibliography. Also left outside the exposition are the Delphi method and other procedures of structured expert elicitation, alternative futures analysis, the cross-impact matrix, backcasting and horizon scanning, while morphological analysis is mentioned only as a synonym for the scenario matrix, without any explanation of its own procedure.

6. The source base: the methodological core lags behind

The methodological core of the publication rests upon literature that lags behind the current state of the discipline, and the widest gap falls upon its strongest section. The foresight block is supported by a single specialised source — K. van der Heijden's “Scenarios: The Art of Strategic Conversation” in its second edition of 2005, that is, lagging twenty-one years behind the date of the textbook's publication — while the remaining sources supporting this section belong to the literature on structured analytic techniques, where scenario work figures as one of eight “families” rather than as an independent discipline with an epistemology of its own. The median year of publication of the whole body of sources supporting the methodological apparatus of techniques falls in 2016.

This assessment must, however, be accompanied by a methodological caveat, without which it would be unjust. The age of a publication cannot be equated with the obsolescence of its content, since in analytical intelligence canonical works retain their force for decades: R. Heuer's “Psychology of Intelligence Analysis” of 1999 and the Central Intelligence Agency's training material of 2009 have not been refuted or superseded; they constitute the operative standard to this day, and citing them testifies to competence. The question, therefore, is not one of arithmetic of years but of whether the textbook reflects what has genuinely changed in the discipline over the past decade.

By that criterion the gap proves to be critical. Over the past decade foresight has been institutionalised as a distinct field with state and international standards of its own: the UK Government Office for Science issued the methodological instrument for work with the future, “The Futures Toolkit”, the second edition of which appeared in 2024; the European Commission introduced a strategic foresight function with annual reports, and the Joint Research Centre deployed a Competence Centre on Foresight and a Megatrends Hub; corresponding units operate within the OECD and the United Nations system; and conceptually the discipline operates with Voros's futures cone, the three-horizons framework, Inayatullah's causal layered analysis, the methodology of horizon scanning, and work with weak signals and wild cards. Not one of these instruments or documents is represented in the textbook, with the result that the methodologically strongest part of the publication proves to be the most weakly supported in terms of sources: the author sets out foresight expertly, relying on a work of 2005 and without identifying what he sets out as foresight.

The chronological composition of the bibliography confirms this tendency and reveals a characteristic inversion. The median year of publication of foreign sources falls in 2016 and of domestic sources in 2021–2022, while the share of foreign works from 2023–2026 does not exceed twelve per cent, whereas for domestic works it reaches almost forty. The domestic segment of the bibliography is therefore noticeably more recent than the foreign one, and the methodological core itself — the corpus of foreign works that forms international standards — proves to be the oldest stratum of the publication: updating has taken place predominantly in that part which reflects the Ukrainian adaptation of the model rather than in the part that ought to transmit the current state of international methodology.

The qualitative composition of the most recent foreign stratum does not compensate for this observation but reinforces it. Among the foreign items dated 2023–2026, only about a third are academic or doctrinal: materials of the US National Defense University on the commander's critical information requirements, a bulletin of the Center for Army Lessons Learned, an article in the journal Argumentation, and a study on deception detection in Acta Psychologica. The remainder are publications of a reference or marketing character on commercial websites: an explanation of the “need to know” principle on the resource of a VPN provider, an article about the Gantt chart on the corporate blog of a project-management system, a post about the TOWS matrix on the site of a private training academy, a note about premortem analysis on a technology portal; and non-specialist web resources of this kind constitute, on the whole, a noticeable share of the foreign segment. The manner in which part of the sources were selected deserves separate attention. A number of URLs are given together with the technical tracking parameter utm_source=chatgpt.com, which unambiguously attests that the links in question were obtained through a dialogue with a generative language model. This parameter occurs fourteen times, belongs to three sources and — what is more significant than the number itself — made its way not only into the page footnotes but into the final list of references, and was therefore not removed at any stage of the editorial processing of the manuscript. What is at issue, accordingly, is not a technical carelessness of presentation but the fact that a source base formed with the aid of artificial intelligence entered the textbook without any subsequent validation.

An independent defect is the use of earlier editions of canonical works in cases where more recent ones were available long before the textbook appeared and contain material bearing directly upon its most “modern” claims. The sixth edition of R. Clark's “Intelligence Analysis: A Target-Centric Approach” of 2019 is cited, whereas the seventh appeared in August 2022 and contains a new chapter on anticipatory intelligence with a methodology of predictive and prescriptive analysis — that is, material bearing directly upon the foresight sub-module. In the same way, the ninth edition of M. Lowenthal's “Intelligence: From Secrets to Policy” of 2022 is cited instead of the tenth, published in 2025, in which the role of artificial intelligence in analytical work and the problem of representing uncertainty are set out systematically for the first time — the very questions to which the textbook devotes a separate chapter positioned as innovative.

The state of affairs may be summarised by a comparison with those directions which, from roughly 2015 onwards, have defined the leading edge of the discipline. Formalised standards for analytical production and the discipline of expressing uncertainty have been worked through partially, since the key instrument is present but the normative framing is absent. Probabilistic and Bayesian reasoning, together with calibration practices, are not represented at all. The critical empirical testing of the structured techniques themselves is well represented, since the bibliography contains the 2016 RAND study and the works of S. Marrin, which raised the question of the evidential basis for their effectiveness, and this testifies to the author's awareness of the contested state of his own subject. The discipline of working with data has been poorly elaborated. The integration of artificial intelligence is strongly elaborated in its technological part and not elaborated at all in its legal part. The managerial completion of the cycle is absent. Of six directions, the textbook thoroughly works through two, partially works through one more, and leaves three unaddressed; and in this lies the principal substantive asymmetry of the publication: the modernity of the technological toolkit is not matched by the modernity of the professional norms and methodological frameworks that govern the quality of analytical judgement.

7. Collation of the gathered data: the stage is marked out but left unfilled

The stage of ordering the gathered data is marked out structurally in the textbook but has not been filled out methodologically, since of the obligatory procedures of ordering — denoted in the English-language tradition by the term collation — only the organisational ones are set out, while all the procedures for assuring data quality have been left outside the text.

Contemporary models of the intelligence cycle — the United Kingdom's National Intelligence Model, the OSCE Guidebook, and the American model of processing and exploitation — single out the ordering of gathered data as an independent stage between collection and evaluation; and a complete stage presupposes registration with a record of the moment at which the data arrived, categorisation according to a standardised taxonomy, standardisation of format and terminology, removal of duplicates, cleaning of erroneous, incomplete and contradictory records, verification at the level of the individual record, triangulation — that is, confirmation of a fact by at least two independent sources — traceability of the provenance of the data, input validation prior to the analysis stage, and indexing and archiving for repeat retrieval and reproducibility.

Architecturally the textbook has the right place for all this, since in the eighth chapter the stage of applying techniques is broken down into four tasks, the first of which — “Consolidation” — precedes source evaluation and is realised through registration, grouping and categorisation, and standardisation. Substantively, however, only these three organisational procedures are covered, and some three pages of general formulations are devoted to them without a single concrete technique: triangulation, removal of duplicates and data cleaning are not examined in the publication at all; verification is present but is concentrated in the chapter on deception detection, that is, it is presented as a specialised instrument for countering disinformation rather than as an obligatory procedure for processing any gathered data whatsoever; validation relates to the finished product rather than to units of raw data at the input; and traceability of provenance and indexing go unmentioned.

It is notable that two sources capable of filling this gap are present in the bibliography: the Berkeley Protocol on Digital Open Source Investigations, in which the principle of cross-checking against several independent sources runs throughout, and the United Kingdom's National Intelligence Model, which institutionalises the ordering of data as a distinct established function. Both are cited, but neither is drawn upon in constructing this section, so that what is at issue is not a shortage of material but its under-use.

The gap acquires practical sharpness in the light of the textbook's own chapter on artificial intelligence, since the agent configurations described in it generate large, heterogeneous, duplicate-laden and in part contradictory bodies of raw data, in working with which the discipline of ordering data becomes a critical skill. A publication so attentive to the possibilities of artificial intelligence in data collection devotes no commensurate attention whatever to the ordering of the results of that collection — which is precisely what led to the use, within the textbook itself, of a source base obtained with the aid of artificial intelligence without its validation.

8. The normative framing: standards and legal limits are not represented

The normative framing of analytical activity is absent from the textbook — both as regards formalised standards for analytical production and as regards the legal limits within which it is carried out — with the result that the instruments have been transmitted but the norms governing their application have not.

As regards standards of production, this manifests itself as follows. The scale of words of estimative probability, considered above among the strengths of the publication, is presented as a useful technique among other techniques, whereas in international practice it is an element of an obligatory normative standard. Intelligence Community Directive ICD 203 “Analytic Standards”, which establishes mandatory requirements for every analytical product and under which analytical materials are regularly audited, is not mentioned in the textbook, nor is any other formalised list of such requirements, the consequence of which is the absence of two fundamental distinctions. The first is between the probability that an event will occur and the analyst's level of confidence in the assessment itself, which are different dimensions, since high probability may be accompanied by low confidence owing to a paucity of sources. The second is the requirement that facts be textually separated from assumptions and judgements within the body of the product. The student thus learns to apply the scale as a matter of good practice rather than as an obligatory requisite of the product, non-compliance with which renders the product liable to be returned for revision.

Adjacent to this, and no less substantial, is the absence of the standards of the International Association of Law Enforcement Intelligence Analysts — the document “Law Enforcement Analytic Standards” in its 2012 edition, which contains requirements addressed to the analyst himself as regards education, training and certification, together with requirements addressed to the product and the process and tied to the stages of the cycle. This gap acquires additional weight in view of the fact that a key role in developing these standards was played by M. B. Peterson, who codified the profession of the law enforcement analyst and whose works on the analysis of criminal networks and financial flows are likewise absent from the publication. Two consequences follow: the absence of any linkage between the declared learning outcomes and the professional competence framework developed for precisely the target audience of the publication rather than for national-level intelligence officers; and the fact that the process block of these standards is the typical locus for formalising data-quality requirements, so that its absence partly explains the weakness of the section on the ordering of data.

The doctrinal basis of the analytical function of law enforcement agencies has likewise been left out of account. The works of D. L. Carter, and in particular the guide “Law Enforcement Intelligence” prepared for the United States Department of Justice — a manual on analytical intelligence for state, local and tribal law enforcement agencies, which has run to a third edition — constitute the standard for building analytical units and fusion centres, yet they are not mentioned in the publication. Their absence is directly connected with the failure to elaborate the organisational mechanisms noted above.

The exposition of the system for evaluating source reliability also requires refinement. Substantively the scales have been reproduced correctly, but they are presented as “unified (international) standards” without naming the primary source, whereas what is at issue is an evaluation system established in the NATO tradition under the name of the “Admiralty Code” and enshrined in standard STANAG 2511, and known in Anglo-Saxon crime analysis practice as the 4×4 and 5×5×5 systems. An analogous observation applies to the SOCTA methodology, since only its Ukrainian-language adaptation is cited, while Europol's primary methodology, to which that adaptation is fitted, is absent from the bibliography.

Belonging here too is the inconsistency in the rendering of foreign authors' surnames, most conspicuous in the case of a figure central to the publication. The surname of Richards J. Heuer Jr. is given in four different Cyrillic forms — “Гойєр” (Hoyier), “Гойер” (Hoyer), “Хойєр” (Khoyier) and “Хеур” (Kheur) — two of which, “Гойєр” and “Хойєр”, are used on one and the same page 316, while the form “Хеур” appears on page 82 at precisely the point where the classification of structured analytic techniques is set out, that is, in a key methodological passage. The surname is of German origin, and the letter combination eu in it is pronounced [oy], which makes the form “Гойєр” the correct one, the more so since the current Ukrainian orthography renders the sound [h] by the letter “г”; and the inconsistency in spelling the name of an author central to the discipline makes it harder for the reader to locate the primary sources.

The most serious matter in this block is, however, the absence of any legal and ethical framing, and for a publication issued with the support of the European Union Advisory Mission this is inadmissible. The problem of human rights is not raised in the textbook; neither the General Data Protection Regulation nor Council of Europe Convention No. 108 and its modernised version — which constitute the legal basis for processing personal data within the European space — is mentioned; the protection of personal data is considered only in passing within the chapter on artificial intelligence, and the principle of proportionality and judicial oversight of interference with privacy only episodically. Meanwhile the OSCE Guidebook, the basic international document on implementing ILP, devotes a separate chapter to human rights and data protection, developed by the Office for Democratic Institutions and Human Rights, proceeding from the premise that analytical intelligence by its very nature intrudes upon privacy and requires clear legal safeguards. Belonging here too is the absence of European Union Regulation 2024/1689 on artificial intelligence — the single binding EU legal standard on the use of AI in law enforcement, whose provisions on high-risk systems take effect in August 2026, that is, synchronously with the appearance of the textbook. The ethical part of the corresponding chapter raises the right questions — algorithmic bias, the opacity of decisions, mass surveillance, responsibility for errors — but relies on general sources from 2020 and does not reach the regulation now in force.

9. Didactic completeness: the apparatus for forming skills is absent

The textbook contains no apparatus for forming practical skills, since the publication includes no practical assignments, exercises or teaching cases for independent work, nor any criteria for assessing learning outcomes. The self-assessment apparatus that is present is well organised, inasmuch as self-assessment questions accompany every chapter and the list of abbreviations functions as a terminological minimum; yet these questions by their nature test the reproduction of what has been read rather than the ability to apply a technique to new material. Since analytical intelligence is above all a practical competence formed by the repeated execution of procedures on real bodies of data, the publication remains a source of knowledge but is not a means of forming skills, and requires obligatory accompaniment by a separate practical course.

10. Conclusion: the doctrinal defects of the publication and their consequences for the law enforcement system

The defects identified are doctrinal rather than debatable in character, and this fundamentally alters the nature of the assessment. A debatable observation concerns the way in which material has been set out and may be accepted or rejected at the author's discretion; a doctrinal observation concerns what has been set out as the model and cannot be rejected, since a distorted model is thereafter reproduced throughout the entire system of training specialists.

The pivotal defect is the excision from the model of Intelligence-Led Policing of its entire managerial layer while retaining its name. The textbook does not define the architecture of levels, does not differentiate the toolkit across levels, does not present a typology of analytical products, does not describe the mechanisms of tasking and prioritisation, does not delineate legal limits, and does not elaborate the components of influence upon the decision and impact upon the criminal environment. All six gaps belong to one and the same layer of the model, and what is therefore at issue is not an aggregate of omissions but a consistent truncation of the concept to the methodology of the analyst's work — that is, to what domestic practice already calls criminal analysis.

The second doctrinal defect is the methodologically erroneous naming of work with alternative futures. The textbook sets out foresight while calling it forecasting, and entrenches this conflation not only in its terminology but in its self-assessment questions, so that the student assimilates the instrument together with an erroneous criterion for evaluating its result.

Both defects have an identical structure: the instrument has been transmitted in isolation from the framework that gives it meaning. The set of analytical techniques has been severed from the managerial model from which the publication's title was taken, and the scenario toolkit from the paradigm of working with the future that determines the criteria of its correct application. Yet the transmission of the framework is precisely the specific function of a textbook as a genre: an individual technique a specialist will master from methodological recommendations, from a course or from colleagues, whereas an understanding of which system a technique forms part of, by what criterion its result is evaluated and when its application would be erroneous, is given by systematic education alone.

The harm that such a publication causes to the law enforcement system is concrete and deferred in time. The ILP model has been under implementation in Ukraine since 2016, and the principal obstacle to that implementation is precisely that the managerial dimension of the model remains unassimilated: in everyday practice analytical intelligence is conflated with criminal analysis, the analytical product is not carried through to a decision, and the effectiveness of the analytical function is not measured by its impact upon the criminal environment. A textbook intended to overcome this obstacle reproduces it — and reproduces it with the authority of an educational publication recommended by an academic council and supported by the European Union Advisory Mission. A student who works through the book will acquire a professional command of technique without acquiring an understanding of the system of which that technique forms part, and will take up his post with the very conception that already predominates within that system.

The effect of entrenchment must be emphasised separately. The corpus of Ukrainian professional literature on analytical intelligence is only now being formed, the circle of authors is narrow, and every new publication becomes a reference point for those that follow. In such an environment a framework incorrectly assimilated does not remain the error of a single book: it will be cited, reproduced in curricula and methodological recommendations, and will in time acquire the status of settled knowledge, which will be incomparably harder to refute than to correct today. For precisely this reason the observations set out above concern not the quality of an individual publication but the quality of the professional space that this publication is forming.

The totality of what has been established permits the following to be stated: the publication discloses analytical intelligence, after a fashion, as a methodology of the analyst's work and does not disclose it as a governed managerial system embedded in the institutional and legal context of law enforcement activity; the source base of its methodological core lags behind the current state of the discipline and, as regards work with the future, rests upon a single source twenty-one years old; part of the sources were obtained through a generative language model and included without validation; the normative and legal framing of the activity is entirely absent; and no apparatus for forming practical skills has been provided.

The textbook may be used in the educational process of higher education institutions with specific conditions of study and in the system of continuing professional development for practising analysts exclusively as a source of information about analytical techniques, subject to obligatory accompaniment by a practical course and subject to the condition that the managerial dimension of the model, the architecture of levels and the legal limits of analytical activity are presented by the instructor from other sources. There are no grounds for recommending the publication as a self-sufficient textbook of modern analytical intelligence until the defects noted have been remedied.

Read more
Strategic Analytics and Law Enforcement Transformation of Ukraine in Wartime

Strategic Analytics and Law Enforcement Transformation of Ukraine in Wartime

Ukraine's internal transformation today is a strategic factor no less important than the events on the frontline. For the West, the issue of state manageability is gradually becoming almost as critical as military resilience. Therefore, the strengthening of analytical intelligence, digital financial control, anti-corruption infrastructure, and the fight against organized crime directly affects the state's resilience, the level of allied support, the post-war architecture of power, and economic recovery, while simultaneously generating new risks. 
Ukraine is transitioning from a post-Soviet "network" model to a system of centralized data, financial monitoring, and law enforcement analytics — effectively forming a state of military digital control. Law enforcement agencies are moving from a reactive model to a preventive and analytically driven one, while the anti-corruption vertical becomes part of geopolitics, ensuring control over the use of aid and investment guarantees. The war is destroying the old criminal-oligarchic architecture, strengthening the control of borders and financial flows. 
However, risks arise. An excessive concentration of law enforcement resources can shift the balance from the rule of law to the dominance of forceful decisions: this yields quick results but threatens the politicization of investigations and pressure on business. The conflict between reform and the old elites inevitably generates sabotage and turbulence, although in the long term, it can weaken the oligarchic model. Organized crime is adapting to the wartime economy — from arms smuggling to schemes around recovery and cybercrime. Society reacts sharply to the inequality of justice, and selective punishment can cause radicalization and distrust. After the war, there is a risk of a "forceful state syndrome," when special services do not want to lose influence, but an active civil society and the European vector of integration can prevent this. 
Under such conditions, it is possible to consider the following development scenarios: 
Successful scenario. Ukraine holds the frontline, modernizes the state, limits oligarchic influence, creates an effective analytical law enforcement system, and integrates into European institutions. This means not only strengthening the state after the war but also forming a new governance model where a security state is combined with democratic competition. In this case, the country emerges from the war significantly stronger than it was before 2022, with a new quality of the state apparatus, greater public trust, and stable investment guarantees. 
Unsuccessful scenario. If the law enforcement system becomes overly politicized, the fight against corruption is selective, and the recovery economy turns into a source of new resource redistribution, then internal trust will begin to collapse. The West will become more cautious in its support, and political instability will grow. This could lead to a rollback to authoritarian practices, where law enforcement agencies dominate democratic institutions, and society loses faith in justice and equality. 
Integrated forecast. Ukraine is moving not towards collapse, but towards a complex model of wartime modernization. The main challenge of the next 3–5 years is to combine a strong security state with the preservation of a democratic competitive system. This will become the key internal strategic task after the active phase of the war. 
At the same time, the current state is characterized by the fact that an asymmetry is forming in Ukraine between a high tactical level of analytical intelligence and a weak strategic level, as the state is learning to detect individual threats quite quickly, but it is forming the ability to forecast systemic risks much more slowly. This means that law enforcement agencies are increasingly better at answering the questions "what happened?" and "who is involved?" by using digital criminal analysis, open-source intelligence, financial monitoring, and automation of the evidence base, but at the same time, they weakly answer the questions "what will happen in a few years?", "what processes are already irreversible?", or "where are new criminal-political ecosystems forming?". As a result, a "state of reaction" emerges rather than a "state of forecasting," which reacts well to a crisis but does not create qualitative models of long-term foresight, which is especially dangerous in conditions of war, social trauma, demographic changes, and EU integration. 
This weakness generates a number of risks: fighting consequences instead of causes, when the system documents schemes but does not forecast their emergence; the illusion of analytical modernization, when digital tools create the appearance of a strategic approach but in reality remain tactical; a lack of risk-based management, leading to a chaotic distribution of resources; the inability to forecast social instability, which can erupt suddenly after the accumulation of invisible factors; and the political vulnerability of law enforcement agencies that focus on short-term indicators and media effect rather than long horizons. The most dangerous long-term risk lies in the loss of strategic time, because if forecasting is not established now, the complexity of the system will increase sharply after the war, and institutions may simply not have time to adapt. 
Under such conditions, refining the vision of the future, the following scenarios are possible: 
A positive scenario assumes that Ukraine will manage to transition from tactical to strategic analytics, form a culture of forecasting and risk management, integrate methods of scenario planning and strategic foresight, and then be able to become one of the most modern security states in Europe. In such a model, the state not only reacts to crises but also anticipates them, which allows reducing systemic threats even before their manifestation, ensuring stability and the trust of society and partners. 
A negative scenario consists in the fact that the strategic level will remain declarative, and the state will turn into a "digitally strong, but strategically short-sighted system" that accumulates data but does not comprehend it. In such a model, crime adapts faster than law enforcement agencies, crises accumulate unnoticed, politics becomes reactive, and governance gets overloaded, which leads to cyclical crises and a loss of trust both domestically and from the West. 
An optimal scenario involves combining a strong tactical level with a gradual buildup of strategic analytics, where the state maintains operational efficiency but at the same time forms institutions of long-term forecasting, integrates risk-based governance, develops a culture of foresight, and creates mechanisms for early warning of social and economic crises. In such a model, Ukraine not only holds the frontline and modernizes the state but also gradually transitions to managing complex systems, which allows avoiding excessive politicization of law enforcement structures and ensuring a balance between security and democratic competitiveness. 
The integral conclusion is that Ukraine's main hidden risk is not a lack of data, but a lack of strategic comprehension of data, because tactical analytics helps win individual episodes, while strategic analytics determines whether the state will win the historical cycle as a whole. In the next 3–7 years, the key factor of resilience will be the ability to transition from a culture of operational response to a culture of strategic forecasting and risk management, and this exactly will determine whether Ukraine becomes a modernized European security state or remains in a cycle of constant crisis response. 
If we integrate the factor of weak strategic analysis in the law enforcement system specifically into the military context, it becomes obvious that the risk picture for Ukraine is much more complex than it might seem at the level of frontline dynamics. This is because modern war is no longer just a clash of armies, but also a war of logistics, management cycles, state adaptability, forecasting, decision-making speed, and institutional resilience, and that is exactly why the weakness of the strategic analytical level can directly affect defense capability even without a visible collapse of the frontline. 
Ukraine is gradually forming a strong tactical security system that has individual effective units, modern operational analytics, digital tools, and successful cases, however, the strategic risk forecasting architecture remains fragmented, which in peacetime creates management problems, and in wartime turns into a national security factor. Hence, the following possible risks are identified: 
Risk 1 lies in the delayed detection of systemic threats, when tactical analytics works well with already manifested schemes but does not see slow accumulative processes, such as the exhaustion of mobilization resilience, a drop in motivation, or the shadowing of mobilization procedures, which leads to a political crisis and a deterioration in army recruitment; 
Risk 2 consists of weak forecasting of the adversary's infiltration and adaptation, when the system catches individual agents but does not see the rebuilding of entire networks of influence in the areas of defense procurement, logistics, energy, or cyber systems, which allows the enemy to undermine the rear without directly breaking through the frontline; 
Risk 3 arises from the incorrect prioritization of resources, when the law enforcement system reacts to media pressure and concentrates on high-profile cases, but misses strategically dangerous processes — the degradation of defense logistics, corruption in supply chains, or the personnel exhaustion of critical specialists; 
Risk 4 lies in the loss of time in an adaptation war, where victory goes to the one who learns and rebuilds the system faster, and if strategic forecasting is weak, then Ukraine risks reacting brilliantly tactically but being late strategically, underestimating the speed of the adversary's adaptation; 
Risk 5 consists in the overload of public administration, when a huge flow of data and constant crises shorten the planning horizon, and the state begins to live "from crisis to crisis," which exhausts the system in a long war. 
In the next six months, the frontline will likely remain relatively stable, the Armed Forces of Ukraine will retain the capacity for defense and local counterattacks, and the West will continue its support, but internal management pressure will increase, especially in the mobilization, personnel, and logistics spheres, and the main danger will not lie in a momentary collapse, but in the gradual accumulation of invisible systemic overloads. 
Under such conditions, refining the vision of the future, the following scenarios are possible: 
A positive scenario lies in the fact that Ukraine will manage to increase strategic analytics, integrate risk forecasting into the law enforcement system, properly prioritize resources, and create a foresight architecture that will allow not only reacting to crises but also anticipating them, which will ensure the resilience of the state even in a long war. 
A negative scenario means that the strategic level will remain weak, and then the state will turn into a system that accumulates data but does not comprehend it, reacts to media noise but misses structural threats, which will lead to management fatigue, institutional overload, and a gradual decrease in defense capability in 2026–2027. 
An optimal scenario involves combining strong tactical analytics with a gradual buildup of strategic analytics, where the state maintains operational efficiency but at the same time forms institutions of long-term forecasting, integrates risk-based management, and creates mechanisms for early warning of social and economic crises, which allows avoiding excessive politicization of law enforcement structures and ensuring a balance between security and democratic competitiveness. 
The integral conclusion is that the main risk of the coming years is not a frontline collapse or even a shortage of weapons, but the gradual accumulation of state management fatigue in the conditions of a long war, and precisely the ability to transition from reactive management to strategic forecasting will determine whether Ukraine can maintain resilience and turn into a modernized European security state. 
A detailed forecast through the prism of the law enforcement function and the risks of weak strategic analytics shows that the problem is not a lack of tactical effectiveness, but a gap between operational effectiveness and the strategic ability to forecast the transformation of threats. This becomes critically important in wartime, as crime quickly adapts, the economy radically changes, new risk markets emerge, and the adversary actively uses criminal and corruption ecosystems as an element of hybrid warfare. In particular, regarding risk trends in the activities of individual law enforcement agencies. 
The National Police of Ukraine has significantly strengthened its tactical capabilities since 2022 thanks to digital analytics, work with telecom data, criminal analysis, OSINT, and international cooperation, but its strategic weakness lies in the fact that the system sees individual groups but does not forecast the formation of new criminal ecosystems. This creates a risk of the emergence of military organized crime, the infiltration of criminals into the recovery sphere, and the use of combat experience in criminal networks, which can lead to the formation of a hybrid military-criminal economy. 
The National Anti-Corruption Bureau of Ukraine remains a strong institutional mechanism with a high level of financial investigations and international support, but its weakness lies in the lack of strategic forecasting of corruption risks. The greatest danger lies in the post-war recovery economy, where the volume of funds will be unprecedented, and if NABU remains only an investigative institution, the state risks fighting the consequences rather than preventing systemic models of corruption. 
The Economic Security Bureau of Ukraine was supposed to become an analytical institution of economic security, but in practice, it gravitates towards the old model of force response, is overloaded with operational work, and has a fragmented analytical architecture. This creates risks of the shadowing of the military economy, sanctions evasion, and the exhaustion of legal business due to excessive pressure without strategic prioritization, which can undermine the mobilization economy and the financial stability of the state. 
The general integrated conclusion is that Ukraine is gradually creating strong tactical law enforcement institutions, but has not yet formed a full-fledged strategic architecture of an analytical state, and that is exactly why the main hidden risk is shifting into the plane of strategic shortsightedness. In the short term, this does not create an immediate collapse, but in the long term, the risk accumulates in the areas of the defense economy, recovery, mobilization resilience, cybersecurity, and the criminal adaptation of war. 
Developing scenarios through the prism of the law enforcement function, the formation of the following development scenarios is possible: 
A positive scenario assumes that law enforcement agencies will maintain tactical effectiveness, but at the same time integrate strategic forecasting, create foresight and risk governance mechanisms, which will allow Ukraine to turn into a modern security state capable of anticipating and preventing threats. 
A negative scenario means that institutions will remain tactically strong but strategically weak, will react to media noise and individual cases, but will miss systemic risks, which will lead to management fatigue, institutional overload, and a gradual decrease in resilience in 2026–2027. 
An optimal scenario consists of combining strong tactical analytics with a gradual buildup of strategic analytics, where the state maintains operational efficiency but at the same time forms institutions of long-term forecasting, integrates risk-based management, and creates mechanisms for early warning of social and economic crises, which allows avoiding excessive politicization of law enforcement structures and ensuring a balance between security and democratic competitiveness. 
Thus, in the next six months, Ukraine will likely maintain operational resilience and international support, however, the main risk zone is gradually shifting from the frontline to management complexity, and exactly the ability to develop strategic analytics will determine whether the state will be able to maintain long-term resilience in the war and post-war recovery. 
Conclusions
Ukraine is gradually forming strong tactical law enforcement institutions that demonstrate high operational efficiency in documenting criminal groups, countering cyber threats, and investigating corruption cases. However, strategic analytics remains fragmented, which creates a risk of strategic shortsightedness. Identified risks include a delay in detecting systemic threats, weak forecasting of enemy infiltration, incorrect prioritization of resources, loss of time in an adaptation war, and overload of public administration. All these factors can gradually accumulate, turning hidden problems into systemic crises. 
A positive development scenario is possible only under the condition of transitioning from tactical to strategic analytics, integrating foresight and risk management, which will allow Ukraine to become a modern European security state capable of anticipating and preventing threats. A negative scenario foresees the preservation of a declarative strategic level, which will lead to management fatigue, institutional overload, and a gradual decrease in resilience in 2026–2027. An optimal scenario consists of combining strong tactical effectiveness with a gradual buildup of strategic analytics, which will allow avoiding excessive politicization of law enforcement structures and ensuring a balance between security and democratic competitiveness. 
Thus, the main hidden risk of the coming years is not a frontline collapse or even a shortage of weapons, but the gradual accumulation of state management fatigue in the conditions of a long war. Exactly the ability to transition from reactive management to strategic forecasting will determine whether Ukraine can maintain resilience and turn into a modernized European security state. In this context, it is especially important to conduct regular analytical foresight sessions that will take into account current changes and their impact on the future, ensuring a systemic vision of risks and timely adjustment of state policy. 
 

Read more
Cyber Warfare 2022–2026: From Chaos Tactics to Strategic Attrition

Cyber Warfare 2022–2026: From Chaos Tactics to Strategic Attrition

Cyber Warfare 2022–2026: From Chaos Tactics to Strategic Attrition I had the honor of presenting the analytical report of the Institute for Cyber Warfare Research at the main stage of the Kyiv International Cyber Resilience Forum 2026. Today, cyberspace is not an "add-on" to war; it is a full-scale theater of operations where Ukraine fights daily for the digital independence of the entire world. Our team presented a unique analytical model for risk assessment. Key takeaways from my speech: • Evolution of the enemy: We are witnessing the aggressor's transition from mass destructive attacks to deep espionage and cognitive operations. • Systemic gap: National coordination in Ukraine is at the highest level, yet there is a critical need to strengthen the resilience of local communities and individual cyber hygiene. • Energy sector under fire: The energy sector requires an immediate transition from passive defense to active risk management. My main conclusion: Our primary challenge today is not a lack of knowledge, but the unevenness of its implementation. Ukraine already has the analytical foundation; now is the time to transform it into the operational viability of every city, enterprise, and citizen. I am grateful to the organizers for this powerful platform and to my colleagues for the synergy. The cyber war continues, but we know our enemy and we are working ahead of the curve. Together toward digital victory! 
#CyberResilience #KyivCyberForum2026 #CyberWar #CyberSecurity #UkraineDigital #InstituteForCyberWarfareResearch
 

Read more
DIGITAL SECURITY AS A HUMANITARIAN TASK: THE UKRAINIAN VECTOR OF IOCTA IMPLEMENTATION

DIGITAL SECURITY AS A HUMANITARIAN TASK: THE UKRAINIAN VECTOR OF IOCTA IMPLEMENTATION

In today’s world, digital security increasingly emerges not only as a technical or law enforcement function, but as a complex humanitarian task that directly affects people’s lives, institutional stability, and societal trust. With the expansion of digital infrastructure—especially under conditions of war and hybrid threats—the need for a systemic understanding of online security has moved beyond narrow technical solutions. It has become an interdisciplinary challenge, where technology, law, ethics, social responsibility, and public policy converge.

Ukraine, facing full-scale aggression, has become a testing ground for new forms of digital vulnerability: from mass disinformation campaigns and targeted cyberattacks on critical infrastructure to the spread of online violence, phishing schemes, and manipulative content aimed at citizens, military personnel, journalists, and activists. In such circumstances, digital security is no longer just about technology—it becomes about protecting dignity, freedom, and vital stability.

Against this backdrop, the European IOCTA (Internet Organised Crime Threat Assessment) methodology, developed by EUROPOL, serves as an important reference point for systemic analysis of digital threats and coordination of interagency actions in the field of online safety. At the same time, directly transferring IOCTA into the Ukrainian context requires deep adaptation—taking into account not only the specifics of war, the legal framework, and institutional maturity, but also the humanitarian dimension of digital reality.

The digital environment has become part of the humanitarian landscape: it is where trust or fear is formed, support or isolation, informational resilience or loss of orientation. Accordingly, digital security analytics must not only identify risks, but also propose development scenarios that protect the human face within the technosphere. Analytical products must include ethical assessment, consider vulnerable groups, and offer solutions based on transparency, cultural sensitivity, and cross-sectoral collaboration.

In this context, Ukraine’s implementation of IOCTA can become a unique opportunity—not merely to integrate into European cybersecurity standards, but to demonstrate a model where security is viewed as part of the humanitarian agenda: the protection of life, freedom, civil rights, and development.

The aim of this article is to outline an analytical framework for such implementation, combining IOCTA’s conceptual approaches with the realities and humanitarian needs of Ukraine’s digital environment. The focus is on interdisciplinary analysis that incorporates legal, social, ethical, and analytical factors capable of ensuring resilience, transparency, and humanity in Ukraine’s digital space.

Methodological Evolution: From IOCTA to the Ukrainian Framework

The methodological evolution of digital analytics—from the IOCTA framework to a Ukrainian humanitarian model—reflects not only the adaptation of tools but a paradigm shift in thinking about the nature of digital threats, the role of analytics, and the values that guide it. Strategic analysis based on the IOCTA (Internet Organised Crime Threat Assessment) methodology, developed by EUROPOL, relies on centralized collection of law enforcement data, analysis of criminal group network activity, transactions, cryptocurrency flows, digital infrastructure, and methods of digital exploitation. Its institutional logic is oriented toward preventing organized crime, with key tools including network intelligence, forensics, threat categorization, and preventive assessments by offense type.

In contrast, the Ukrainian methodological framework—shaped under conditions of war, disinformation campaigns, and social tension—draws on a fundamentally broader field of sources: open data, expert interviews, humanitarian observations, social media, narrative content, and signals from communities. This enables not only the identification of threats but also an understanding of their impact on citizens, their emotional responses, levels of trust in institutions, and adaptive capacity. Comparative analysis shows that the Ukrainian model expands the analytical scope from technical assessment to holistic analysis of the social context of threats, which is crucial for strategic management of the digital environment.

A key innovation in Ukrainian analytical practice is the emergence of new criteria for analytical validity—emotional credibility, social relevance, and narrative depth. In the context of hybrid warfare, numbers and facts lose their power if they do not explain how information affects behavior, beliefs, and the psychological resilience of communities. For example, reporting on cyber incidents without analyzing the emotional response of the population or prevalent interpretations fails to provide a full picture of the effectiveness of the informational response. This shift—from formal accuracy to deep explanation—is fundamentally important in post-conflict risk governance.

Within this evolution, the concept of “trust analytics” is emerging, countering the classical “control analytics.” While IOCTA has historically focused on institutional response and monitoring, the Ukrainian model aspires to build cross-sectoral collaboration, where analytics becomes a platform for dialogue rather than vertical management. Trust analytics is based on openness, ethics, clarity, and citizen participation: it does not merely report threats but explains them, informs about consequences, proposes courses of action, and mobilizes collective response. This approach requires new formats: strategic briefs, multimedia cases, educational materials, and visualizations accessible to broad audiences.

Thus, methodological evolution is not only a transition from IOCTA to a localized model, but from formalism to humanism, from vertical analytics to partnership-based analytics, from the language of control to the language of co-participation. The Ukrainian school of digital analytics is emerging as a synthesis of technical precision and human depth, where data are not merely objects of analysis but tools for strengthening communities, resilience, and national development.

Analytical Ethics and the Humanitarian Dimension

Analytical ethics, as the foundation of a new humanitarian analytics in Ukraine, is being shaped in response to the challenges of post-conflict reality—where data are no longer neutral objects but actively influence trust, resilience, and collective action. In this context, digital analytics emerges not merely as a technical tool for processing information, but as a form of contemporary humanism—capable of protecting human dignity, ensuring freedom of choice, enhancing psychological endurance, and fostering cross-sectoral cooperation.

The guiding principles—dignity, freedom, resilience, cooperation—form the value-based framework of analytical practice. They define not only ethical boundaries but also strategic orientations: what is analyzed, for whom the analytical product is created, and what its format and tone should be. These principles are embedded at every stage—from data collection to the presentation of findings in a form that mobilizes collective action rather than generating fear or division.

Within the humanitarian approach, particular importance is placed on integrating emotional intelligence, social empathy, and psychological sensitivity into the methodology of analytical work. This means not only accounting for the psychosocial context of data, but also the analyst’s ability to detect nonverbal signals of anxiety, calls for help, or invitations to collaborate—contained in narrative materials, comments, and public discourse. Such analytical sensitivity ensures a higher level of relevance, as the results not only inform but also support, inspire, and create space for national dialogue.

Ultimately, humanitarian analytics does not reject technical precision—it complements it with ethical foresight. It seeks to ensure that every analytical conclusion contributes to strengthening human potential, social cohesion, and moral leadership in the recovery process. The Ukrainian school of analytics, grounded in this ethic, can serve as an example for other countries undergoing complex transformations and lay the foundation for new standards of professional culture in the digital age.

Multisectorality and Communicative Design

The multisectoral approach in contemporary Ukrainian analytics transforms it from a narrowly professional domain into a public strategic instrument—capable of fostering interdisciplinary interaction, enhancing citizen awareness, and contributing to institutional renewal. This evolution is driven by the need not only to respond swiftly to risks, but also to communicate them in ways that support democratic processes, social cohesion, and cultural identity in transitional and crisis contexts.

At the same time, this transformation reshapes the nature of analytical products—from technical reports to formats tailored to the needs of diverse audiences: strategic briefs for decision-making, case studies as examples of practical response, multimedia presentations for public discourse, and educational materials for building analytical literacy. This approach not only expands the communicative impact of analytics but also turns it into a tool for changing mindsets and behaviors.

In this context, the role of the analyst also evolves: they become not only a generator of data, but a communicator of meaning, a moderator of public dialogue, and a bearer of professional and humanitarian culture. The analyst begins to function as a mediator between spheres of knowledge, power, and civil society, helping to shape a shared language of strategic thinking. Their ability to convey complex information in an accessible, ethical, and substantively rich form becomes critically important for strengthening institutional trust, mobilizing collective action, and fostering sustainable development.

Ultimately, multisectorality and communicative design are not merely means of delivering analytics—they are key mechanisms for building an inclusive informational environment, where analytics serves not only as a source of solutions, but also of meaning, inspiration, and cultural leadership.

Practical Application: Cases, Models, Challenges

The practical application of humanitarian analytics in the Ukrainian context encompasses a wide range of scenarios that respond to the challenges of the digital age and post-conflict transformation. Among the most relevant areas are ensuring digital security for communities, countering disinformation, and providing strategic support for regional reconstruction processes. In each of these cases, analytics serves not only as a tool for risk assessment but also for mobilizing action, creating trust-based mechanisms, and supporting population adaptation to change.

The application of humanitarian analytics faces a number of systemic challenges. Key among them are low levels of institutional trust, fragmentation of cross-sectoral communication, and insufficient competence in ethical analysis among professionals. Overcoming these barriers requires the creation of an environment in which analytics is recognized not merely as a technical tool but as a shared value-based resource—a means of enhancing civic engagement, fostering critical thinking, and cultivating strategic culture.

In response to these challenges, a model of the Ukrainian school of analytics is emerging—one that integrates education, the development of strategic thinking, and the consolidation of the analyst’s societal role as an ethical communicator and cultural leader. This school is grounded in a multidisciplinary approach, where analytical skills are complemented by knowledge of humanitarian principles, practices of social listening, and the art of adapting complex information to the needs of diverse groups. Key components include simulation cases, strategic workshops, interactive modules on countering disinformation, and institutional strengthening of digital resilience.

Ultimately, the practical application of humanitarian analytics is not merely a matter of tools—it is the embodiment of a new type of professional responsibility, where the analyst becomes a driver of social renewal, a bearer of interdisciplinary dialogue, and an architect of trust in the digital environment.

Conclusions and Invitation to Action

The formation of a new identity for the analytical profession in Ukraine is not only an institutional process but also a cultural shift—one that combines technical competence with moral leadership. Analytics is no longer confined to data collection and classification; it is evolving into an integrative discipline that assumes responsibility for strategic thinking, societal empathy, and ethical foresight. In this context, the Ukrainian analyst emerges as a figure capable of merging digital expertise with a humanistic vision, shaping new standards of professional culture.

The creation of a morally and strategically grounded school of analytics is a key step in this process. It is not merely about expanding technical tools, but about laying philosophical foundations that define the meaning and purpose of analytical activity. Such a school should move analytics beyond narrow instrumental application and view it as a source of societal maturity, mutual responsibility, and trust-building in times of uncertainty. It must be based on a multidisciplinary approach, where economic, social, technological, and humanitarian dimensions are integrated into a unified framework of strategic vision.

In this light, an invitation to action is declared—to the academic community, government institutions, and civil society—to jointly cultivate a culture of thoughtful analytics. This culture entails not only high-quality information processing but also a deep reflection on its role in shaping social order, democracy, and human dignity. This invitation is an open call for co-participation, where each sector becomes not only a consumer of analytical products but also a co-creator, a bearer of strategic vision, ethical standards, and civic responsibility. Ukrainian analytics in this dimension is not merely a profession—it is a new form of service that combines precision of thought with depth of care.
 

Read more
THE PROFESSIONAL STRENGTH OF AN ANALYST: SEEING DEEPER, ACTING SHARPER

THE PROFESSIONAL STRENGTH OF AN ANALYST: SEEING DEEPER, ACTING SHARPER

On the occasion of the professional recognition day for law enforcement analysts in Ukraine

In a world where noise often outweighs substance, the role of the analyst becomes not just important—it becomes vital. Today we honor those who can see deeper, think strategically, and act responsibly. A law enforcement analyst is not simply a specialist in data and facts. They are architects of trust, engines of change, carriers of steady logic in a complex reality.

Analytics acknowledges: explanations are not always for everyone. But transparency is always the foundation of change. We don’t waste resources convincing those who refuse to listen. We focus on outcomes that speak for themselves. Analytics creates an environment where action—not emotion—drives progress.

True strength lies in analytical calm. Amid loud debates, it’s silence and precision that deliver results. We choose development over noise. Ukraine’s analytical community grows through depth, systems thinking, and the resilience of its values.

Maturity is revealed not through proof, but through deeds. Those who work with risk, conflict, and evidence every day choose dignity, integrity, and strategy. We don’t just react—we shape security policy, public order, and transparency.

Because analytics is a path. A way of thinking. The ability to see connections where others see randomness. It’s the intellectual courage to ask difficult questions and build the future based on meaning, not chaos.

And we know: analysis is not about persuasion—it’s about creation. We don’t seek applause or victory in debate. We create systems where decisions matter. Because substance always outlasts noise. And the community of analysts is crafting a new standard of justice in Ukraine.

With gratitude to everyone who chooses depth, precision, and principled action—today and every day. Happy professional day to you!

Read more