Protective Intelligence in Practice: Threat Assessment & Operational Experience

Protective Intelligence is applied in circumstances where threats to people, organisations, assets or operations require specialist intelligence development, threat assessment and, where justified, operational intervention.

Drawing on specialist government and military intelligence, investigation and protective intelligence experience, Specialist Investigative Support has assisted client requirements involving sophisticated hostile targeting, organised criminal activity, insider threats, behavioural threat detection, stalking and the protection of individuals, commercial interests, locations and events.

Our sanitised examples illustrate how SIS integrates intelligence, evidence and risk to guide operational decisions, proportionate intervention and the management of changing threats. 

Whilst circumstances vary, the requirement, integrated framework and professional continuity remains consistent: understand what is happening, assess what may happen next, establish what can be evidenced, mitigate risk throughout the process and support defensible decisions.

Organisational and financial risk

SIS has, to date, assisted organisations in identifying and mitigating more than £40 million of risk.

Our operations have assisted in identifying suspected fraud, theft and dishonesty, insider threats, information compromise, vulnerabilities in processes and people, organised criminal targeting, hostile reconnaissance, adverse targeting, unattributed hostile intelligence collection beyond that anticipated in the commercial sector, blackmail, disruptive activism, safeguarding concerns and stalking.  

In each case, the immediate concern represented only part of the requirement. 

Understanding the people, behaviours, associations, activity and developing risk was necessary to determine an appropriate response.

Adverse and sophisticated targeting

SIS has supported prominent individuals, families and organisations exposed to sophisticated adverse targeting.

This has included identifying, monitoring and evidencing activities that were inconsistent with tradecraft ordinarily anticipated within conventional commercial or private sector environments. 

Attribution is not always possible or necessary. 

Protective decisions still have to be made on the intelligence and evidence available.

Other assignments have involved organised criminal networks, blackmail within a diplomatic context and the identification of targeting behaviour that was mitigated before its purpose or potential consequence was fully understood.

Identifying threat before it reaches the target

Specialist behavioural detection has been used within crowded environments to identify individuals presenting indicators of concern amongst thousands of people.

During one major protected event, an individual identified through behavioural detection was covertly monitored and subsequently intercepted by law enforcement before reaching the event. 

Their status as a 'subject of interest' was subsequently confirmed.

The value was not timely detection.

It was creating an opportunity to assess, covertly monitor, confirm and intervene while options remained available.

Stalking, obsessive and fixated behaviours, and threats to individuals

Protective intelligence has also been applied where the threat was known but its behaviour and potential for escalation required continual assessment.

In one case involving a violent and unpredictable individual, SIS provided evidential protective surveillance to safeguard a family, their home and workplace while simultaneously developing intelligence and evidence in support of ongoing proceedings.

Protection, intelligence collection and evidential development are not separate activities. 

Each informed the assessment and management of risk.

When the protected person changes the risk

Protective arrangements themselves do not remove threat, and the behaviour of the person being protected can materially alter vulnerability.

SIS has encountered circumstances where established protection arrangements were being deliberately circumvented to pursue private activities. 

In doing so, the individual created vulnerabilities extending beyond personal safety, including exposure to abduction and consequential risk to wider family interests.

The protection team had not failed.

The environment in which it was expected to manage risk had changed.

This is one reason protective intelligence operates beyond the immediate security operation.

When specialist support may be required

Organisations and private clients may encounter circumstances where an imerging or escalating threat, concerning behaviours or suspected adverse targeting cannot be adequately understood or addressed through existing security arrangements, internal investigations or available information. 

The concern may involve an unidentified source of hostile activity, suspected insider threats, stalking or harassment, sophisticated targeting, or circumstances where protective intervention could create further operational, legal or personal consequences. 

We offer informal confidential advice to establish what is known, what is suspected and whether specialist involvement is appropriate. 

When risk escalates

When risk escalates, often without warning, the requirement for timely and reliable intelligence in high consequence incidents may become critical to wider risk management strategies and decisions being made. 

Within a formal crisis management structure, Crisis Management Teams may require reliable fast-time intelligence from hostile or controlled environments to establish fact, understand developing threat and inform decision making while simultaneously managing legal, reputational, operational and personal high risk incidents.

That requirement forms part of SIS specialist operational support to Crisis Management Teams through pre-existing and defined agreement. 

Developing Protective Intelligence Capability - Organisational Resilience

Developing the ability of personnel to recognise indicators of concern, understand risk within their operating environment and respond appropriately can strengthen organisational resiliance and create opportunities for early intervention.

SIS has delivered specialist training within the media and broadcasting sector, developing awareness  and identification of indicators of concern, understanding and confirming developing threats, together with the use of environments and techniques to evade hostile targeting. 

The Head of Global Security - national broadcasting company, described the training as among the best received all year. The combination of theory, practical demonstration and participant-led exercises was particularly valued for developing understanding of how to respond to risks associated with their roles.

Intelligence. Evidence. Risk.

Specialist Investigative Support.