Examination of Witnesses (Questions 440
- 459)
WEDNESDAY 9 JULY 2008
Dr Nicholas Ridley
Q440 Chairman:
I welcome Dr Nicholas Ridley before us today from the John Grieve
Centre, London Metropolitan University. As you were sitting at
the back you will have heard me say that this will be on the record,
we will send a transcript to you at the end of it and please do
feel free to add any further information once you have corrected
the transcript as our aim is to get accurate information from
our witnesses. You will also have heard me say that we should
be most grateful if you could speak up as the acoustics are particularly
poor. Perhaps we could start the evidence session by you introducing
yourself and then we can move on to questions.
Dr Ridley: My name is Nick Ridley. I
am a former intelligence analyst. I was 23 years as an intelligence
analyst, first at New Scotland Yard in Special Branch and the
Anti-Terrorist Section of Counter-Terrorist Command, then I was
seconded to NCIS briefly before going to Europol where I was an
intelligence analyst employed by Europol for 14 years. I am now
a senior lecturer at the John Grieve Centre for Policing and Security
at London Metropolitan University.
Q441 Chairman:
Can you explain the work of a crime analyst and how it benefits
organisations like Europol and the Member States working with
it?
Dr Ridley: I would suggest that an analyst
at Europol is working on diverse and complex intelligence by research
and interpretation with the objective of assisting in establishing
and identifying exactly what criminality is occurring, who is
involved, to what extent they are involved, as much new information
as possible about those individuals and any other new intelligence
which can be gleaned for such research and interpretation. It
is disseminated in the form of analytical reports, sometimes illustrated
graphically with either criminal association charts or finance
flow or quite often important sequences of events highlighting
important periods within the inquiry. The format of the reports
or dissemination is comparatively unimportant; they can be informal
and preliminary, that is preliminary analysis with follow-up questions
to the investigators or completed analytical reports. I would
suggest that the key aspect about analysis is that it gives added
value; it gives new information or new lines of inquiry or new
interpretations to enhance and move that operational inquiry forward.
Working at Europol the advantages and opportunities are tremendous
in the sense that it gives multinational information intelligence;
it is an opportunity to tie up operational intelligence from different
Member States and to make salient connections, to disseminate
this information quickly. It is an opportunity to identify hitherto
unknown modus operandi particularly in criminal finances
and, to a lesser extent, in terrorist financing. The analyst is
enhanced by a superb speedy data-mining system, the AWFs. They
are beyond reproach in terms of instant retrieval and instant
connections of intelligence. I would suggest the disadvantages
are what may have been touched on already by the two previous
speakers in a benevolent way. There tends to be a misperception
of the concept of AWFs. An AWF is nothing more or nothing less
on the advantageous side than an electronic storage receptacle
of intelligence, instantly available to the analyst. The downside
is that possibly analysis is held back by data input cumbersome
procedures. No analysis intelligence can be worked on until it
is actually inputted into the AWF, which causes delays in speedy
reaction in real time information exchange. There is possibly,
from the analytical point of view—and I can only speak from
an operational analysis point of view—over-regulational
bureaucracy. A particularly telling point was made by the former
Director of Europol in 2004, that is half a decade after Europol
was established, where he cited the fact that up to 2004 there
were more individuals internationally empowered to look at and
supervise what Europol was doing in intelligence terms than the
entire staff of Europol itself, which for a criminal intelligence
agency is quite a good point in terms of holding it back. Finally,
the downside, the disadvantage of analysis is the dissemination.
The handing to different Member States means that they have a
caveat on where that information can go and have to be consulted
before that is placed in reports and also, particularly in terrorism,
there is the issue of non-EU Member States having access to data
or whether data from certain non-EU Member States can be accepted
and worked upon. Terrorism is international yet there are some
regulations where certain data cannot be accepted.
Chairman: Thank you very much for that
substantial reply.
Q442 Lord Dear:
I want to ask a question about the definition of the words "assembly",
"processing" and "utilisation". As we understand
it, the Europol definition of analysis, therefore your work, is
" ... the assembly, processing or utilization of data with
the aim of helping a criminal investigation". If you could
revisit that in the future, would you leave it as it is as a definition
or seek to see it changed? It would help us to know how you perceive
those words.
Dr Ridley: From an analytical point of
view—and it is a definition of analysis—I would suggest
it is not only out of date, it is retarding analysis. What it
is doing is equating, confusing, commingling and mixing the intelligence
process with intelligence analysis. The assembly and processing
of data is part of the intelligence process; it is separate from
analysis. Analysis is part of the intelligence process. May I
briefly outline the five stages?
Q443 Lord Dear:
Yes, it would help us if you did.
Dr Ridley: The intelligence process is
quite simply gathering, getting the stuff in, working on it and
disseminating it or the five stages: intelligence collection;
collation, putting it together; evaluation; analysing it then
disseminating that analysis product. The assembly, the processing,
that is the actual processing and evaluating and inputting the
data, is nothing to do with actually working on it.
Q444 Lord Dear:
Are you saying "assembly" is the capture out on the
street, so to speak? Is that right.
Dr Ridley: Indeed; the assembly is capturing
on the streets, collating it, placing it in the work files.
Q445 Lord Dear:
And there is a whole science out there of the way in which one
would go about that.
Dr Ridley: Indeed.
Q446 Lord Dear:
Technological means, visual means; we understand that. You are
saying that is not part of your task, that is the capture.
Dr Ridley: That is intelligence gathering,
that is investigation and intelligence gathering. I would suggest
analysis is having the intelligence data evaluated or making an
evaluation and then working on it. Part of that definition is,
in the context of analysis or the AWF, actually processing it,
that is actually inputting it into the work files, the electronic
architecture, in accordance with Member States' wishes and data
protection. I would suggest that is not part of analysis.
Q447 Lord Dear:
This is critical and it might be helpful, if you also consider
it helpful to us, to let us have a note later setting this out
in detail because the slices are quite close together. I can see
that. If you agree, that would be helpful.
Dr Ridley: Yes, I would be happy to assist.
Q448 Lord Dear:
You are going to use terminology of course, so define, if you
would, each term precisely and then show how they fit together.
That would be extraordinarily helpful.
Dr Ridley: And suggest its place in the
context of AWF because that is what we are talking about. Is that
acceptable?
Lord Dear: Indeed.
Q449 Lord Marlesford:
It would be interesting to know whether this technique, this approach
is purely a British one or whether it is used by the Americans
and others as well; the distinctions, the methodology you have
been describing. Is this a UK methodology or an international
methodology used by the CIA and all those people?
Dr Ridley: It has always been the ideal
standard intelligence set-up, ideally that the intelligence gatherers
and the intelligence capturers, collectors, should be separate
from those actually working on the data to avoid preconceptions.
Obviously there would be some interface because the context in
where and how the data was captured would be of crucial value
and the investigator's opinion is of crucial value in terms of
the individual. That is where the evaluation process partly comes
in. There is some interface, but I would suggest that it is a
separate process.
Q450 Lord Dear:
I can see a parallel with another world I inhabit from time to
time of forensic science where the collection of the evidence
at the scene is deliberately kept very separate from what is called
search and recovery, which is a laboratory process, and then goes
to scientific analysis, and there is a deliberate split from the
capture of the evidence.
Dr Ridley: Yes, I agree.
Q451 Lord Dear:
I can see that model in my mind and understand why you are espousing
it and you do agree with that, do you?
Dr Ridley: Yes, I fully agree with that.
Q452 Baroness Garden of Frognal:
Can you describe the connections between the strategic assessments
that exist at Level 3 in the UK National Intelligence Model (NIM)
and SOCA's UK Organised Crime Threat Assessment/Control Strategy
and the Europol Organised Crime Threat Assessment/COSPOL projects?
Dr Ridley: Yes. There are indeed connections,
there are indeed links and you can see the parallel and complementary
thought process or methodology between the SOCA threat assessment
and the OCTA, the Europol Organised Crime Threat Assessment. The
methodology addressing the concept of criminal groups is the same.
The OCTA used the phrase "oriented clusters with common aims";
SOCA uses the words "the criminal core groups with varying
outsiders". It distinguishes quite categorically the SOCA
criminal groups, for example, in terms of drug trafficking it
identifies three quite separate sets of groups which are impacting
on the UK, the Turkish, those based in the Netherlands as a secondary
supply, also the UK-based groups, not merely as receivers but
also as facilitators. The OCTA, on a wider scale, identifies the
oriented clusters as those indigenous organised crime groups,
non-EU crime groups—and they call them intermediate—who
are integrating themselves in the EU. There is also a connection
on the geo-spatial methodology of the nexus points in illegal
immigration and the OCTA methodology on the regional hubs where
it divides them north-west, south-west, north-east, south-east,
with different crime priorities. Also there is a connection between
the financial specialists, the exploitation specialists for money
laundering and terrorist financing in both reports. Having said
that, the connections are spasmodic and not continuous. If for
no other reason, may I suggest that the threat assessment of SOCA
appears to have a different objective to that of the OCTA. I do
not want to sound patronising here as I am looking at it from
an academic point of view, but in all credit to SOCA they have
cited their objectives in the threat assessment as to develop
the threat posed to the UK, the importance of improving knowledge
and, they have said, improving the understanding of the nature
of organised crime. If you like, they are concentrating on the
changing dynamics of organised crime and the threats posed to
the UK. OCTA is more operationally orientated; in its own words
the OCTA threat assessment states that it helps close a gap between
strategic findings and operational activities. It allows the EU
system to develop complementary measures to countering organised
crime, linking ministerial and policy levels with those of practitioners
and law enforcement agencies which operate at the front line.
The unfortunate thing is that OCTA is not really operationally
orientated. Having said those objectives, it does go on to state
that it needs to be realised that OCTA is not detailed enough
to pinpoint specific criminal investigations. If a threat assessment
is not doing that, it is not bridging the gap or it is not assisting
operational inquiries. I would suggest that from a strategic overview
point of view the OCTA is a magnificent document, it is précising
information gathered over a year from 27 Member States. It is
précising, boiling it down and making it a cohesive whole.
In terms of accepting information and analysing it and synthesising
it, it is a magnificent tour de force from an academic,
strategic analysis point of view, speaking as an academic. To
an operational analyst working in a police organisation, there
is little or no operational value in the Europol OCTA. Does that
answer your question?
Q453 Baroness Garden of Frognal:
Is there a common understanding of terminology in your work amongst
these different bodies?
Dr Ridley: I think so; they are looking
at the dynamics of organised crime, they are looking at threat
levels, the impact, they are trying to make common threat levels,
trying to discern common solutions and identify priorities. SOCA
achieves that in a far more specific way than OCTA.
Q454 Lord Young of Norwood Green:
Listening to your analysis or comparing the two it seems to me
that it is almost impossible for OCTA to do what SOCA do because
it is 27 Member States and they are boiling down and synthesising
a mountain of information. Is there any way that it could be changed
to make it more operationally focused as well as being strategic
or is it impossible?
Dr Ridley: I would suggest that in its
present form it would be extremely difficult were it to be broken
down into operational segments and strategic reports dealing with
operational priorities but then operational priorities would have
to be identified in more specific detail.
Q455 Lord Young of Norwood Green:
The Europol Work Programme 2009 shows a heavy investment in analytical
effort. Can you explain the strengths and weaknesses of analysis
in the fight against organised crime and terrorism? When you were
talking about capture it seemed to me that evaluation was a key
area and I cannot help feeling that if it is junk in you are going
to get junk out, so the evaluation process must be key to the
analytical. I may be wrong.
Dr Ridley: I fully agree with you. It
is a trade-off. If you have masses of information, you cannot
seek to evaluate every single piece, but what you can do is break
down and identify your essentials, A1s if you like, or 4x4 or
5x5. The problem with 27 Member States is inevitably that they
will have different methods of evaluating, even if they have a
common evaluation system, how that is applied, the 5x5 or, in
the European Union, the 4x4 system. How that is applied in each
Member State remains the domain of the Member State and also the
exigencies of actually gathering the information and disseminating
it. If they have no time they will do without the evaluation rather
than sacrifice real time in order to pass it on.
Q456 Lord Young of Norwood Green:
What about the strengths and weaknesses of the analysis process?
Dr Ridley: You are looking at different
evaluated systems, different evaluated segments of information
but the strength of analysis is the magnificent AWF data mining
and data cross-referencing. As a piece of electronic architecture—I
do not wish to be too detrimental to AWFs—it had to happen
in the early stages of Europol because there was so much information
coming in. It helps to assuage Member States' fears or caution
about giving over information because each Member State still
has sole access and control over its contributions within each
work file. Only the analyst can see all the different Member States'
contributions and pull them together. In a sense it is an ideal
tool for obtaining information, voluntary data capture; the problem
is in dissemination and also accepting information from those
Member States not part of the work file. I have an example, if
I may cite an example without naming Member States, a case in
2002 where one Member State had a group of criminals engaged in
criminal financing and they were clearly sending finances overseas
by various means to two or three locations in the Gulf region
which eventually impacted on the situation in Somalia. The inquiry
proceeded and it went so far. Had it been allowed to proceed further
without the trammelling of the data protection AWF regulations
this would have been a useful indicator and we could have been
ahead of the game about what is happening in Somalia now. The
second thing which was missed was a modus operandi—I
cannot go into details—of terrorist financing which only
came to light later as a result of subsequent research outside
Europol. The third aspect was that there was information to hand
from the United States. At the same time as those terrorist finance
transfers were going to the Gulf region, there were parallel transfers
of comparable amounts going to the same financial institutions
in the Gulf region from the United States at exactly the same
time and that was missed because it was not permitted to be included
in the general context. Had that been included at the time it
would have enhanced the inquiry. It is a small example, but I
cannot go into more details.
Q457 Lord Mawson:
I am always interested in people who deal with the practical details
of life and how it really works because you see very different
things. If you were to suggest three things which need to happen
with Europol to make it a far more effective organisation, what
would be your top three things?
Dr Ridley: Thank you; it is always nice
to be given the opportunity to be king, as it were. I suppose
ideally split the function of data collection and data inputting
from the analysis function. I am sure that has happened, but when
I was at Europol, there were concerns about sharing data with
other agencies, particularly Eurojust. I am sure it is happening
now as that was four years ago, but there should be more two-way
flows of information with Eurojust because that is a vital tool
in terms of not merely exchanging information about terrorism
but actually bringing terrorists or potential terrorist suspects
to court and charging them with the right offence. There are two.
Q458 Lord Mawson:
Do you have a third?
Dr Ridley: Two out of three.
Q459 Chairman:
Could you just explain something? Earlier you mentioned methods
of evaluation being 5x5 and 4x4. Could you lift me out of my ignorance
there? What does that actually mean?
Dr Ridley: I apologise. The 4x4 system
is where both the source and the information itself given by that
source are evaluated. The source codes are four—now five
in the UK but four in the European Union; they are A, B, C and
X. The codes for the actual information given by that source are
1, 2, 3 and 4. Therefore, if I give you information which is from
an impeccable source, I would hope myself, and it is absolutely
reliable it would be A1. It is a common misconception but the
last category is not the worst type of information. They are not
graded according to scale of reliability. The worst type of information
is C3 because on the majority of occasions C source is generally
unreliable and 3 is generally not reliable. X4 is an unknown quantity.
X4 can be subsequently upgraded by other corroborative information
and can be absolute gold dust. That is a brief answer.
Chairman: That is very helpful. Thank
you very much.
Lord Young of Norwood Green: Perhaps
that could be expanded in a note.
| 
