The Monitoring of War Indicators

18 SEPT 95


XXXXXX XXXXXX XXXXX XXXXX XXX the U.S. strategic warning watchtower still under construction.


Thomas J. Patton

To provide warning of any surprise attack against the United States and its allies is our first national intelligence objective, but one, it has been our experience, that cannot be adequately served by the normal processes of estimative or current intelligence. We have therefore found it necessary to develop a somewhat specialized intelligence effort for advanced strategic early warning. This effort, which we have termed "indications intelligence," seeks to discern in advance any Soviet or other Communist intent to initiate hostilities, whether against the United States or its forces, its allies or their forces, or areas peripheral to the Soviet Orbit. It also seeks to detect and warn of other developments directly susceptible of enemy exploiting action which would jeopardize the security of the United States; and this effort has been extended in practice to any critical situation which might give rise to hostilities, whether or not there is an immediate threat of direct US or Soviet involvement.

We maintain a sharp distinction between this intelligence early warning - a strategic warning in advance of military operations, based on deductive conclusions about Soviet preparations - and operational early warning, tactical conclusions from information on Soviet operations now obtained largely by mechanical means. I like to think of the indications activity as having four aspects:

First, it is the cultivation of a mental attitude which leads to first assessment of all Soviet or Communist action in terms of preparation for early hostilities.

Second, it is the development of a body of doctrine which can serve as guidance for the collection of warning information, for its physical handling, and for its evaluation. Basically this is the isolation of those actions which would be most likely to constitute preparations for hostilities, whether deliberate or in response to the immediate international situation. It is the creation, through experience, of a body of "common law" applicable to the selection, evaluation and analysis of information pertinent to warning.

Third, it is the development of new techniques and methods for the collection, processing, evaluation, and analysis of information significant principally or solely for purposes of strategic early warning. These techniques and methods range from finding new sources to analysis by electronic devices. With the development of missiles and the consequent sharp reduction in the time lag between an enemy decision to attack and the attack, we must give this aspect of the activity increased attention. The alternative would be a degree of abdication by intelligence to "operations," with a consequent loss to national flexibility.

Fourth, it is the organization of the intelligence community at all levels so that it can process most rapidly and effectively information from every source which could provide insight into Soviet preparation for hostilities. This processing involves every step from initial screening, or even collection, to the reporting of conclusions to responsible officials of the executive arm of the government. This continuous process is an integral part of, and yet different from, the current intelligence and estimative processes. When a threat appears great, as in moments of considerable crisis, the indications process tends to coalesce with both the current intelligence process and the estimative process, at least at the national level.

Before treating these aspects in detail I shall outline the organization and procedures for advance strategic warning which have evolved in the United States. Far from perfected and still evolving as they are, they will at least illustrate one national effort to provide intelligence indications of threatening war.


The Watchers and Their Work-Week

The Director of Central Intelligence and the US Intelligence Board, who have the ultimate national responsibility for this warning, have in effect delegated the function to the USIB Watch Committee. The Watch Committee is composed of sen.or intelligence officers at the general officer of senior colonel level representing the major intelligence agencies, and is chaired by the Deputy Director of Central Intelligence. Although it meets only weekly during normal times, or perhaps daily during crises, its function is continuous, exercised through frequent liaison and contact and through a constant routine exchange of information and evaluations, formal or informal.

Serving the Committee is a permanent staff in the National Indications Center, the physical locus of Committee functions. The NIC staff of 25 is composed of intelligence officers at the colonel or naval captain level representing each of the major intelligence agencies, assisted by administrative, communications, and graphics personnel. The Center itself is linked by electrical communications to the major agencies. It receives from the USIB agencies a flow of possible indications information, both on a routine across-the-board basis and as evaluated and selected for possible pertinence. It has a 24-hour intelligence duty officer who is in frequent contact with duty officers in other agencies and with members of the staff. Through these contacts and communication links there is a constant interchange of information and views, but formally the Watch Committee functions on a weekly cycle which can be telescoped during crises to a matter of minutes. The cycle is rather elaborate, and while imperfect it at least aims at thoroughness. It runs roughly as follows:

Friday to Monday noon: Screening and processing information, in the NIC and in each member agency.

Monday afternoon: The NIC staff reviews available information, compiles a preliminary agenda for the Wednesday Watch Committee meeting, and teletypes it to member agencies.

Tuesday: "Pre-watch" meetings in each member agency, attended also by NIC staff members, at which available information is reviewed and selected for the Watch Committee meeting. Final agenda and graphics are prepared in the NIC.

Wednesday morning: Watch Committee meeting. All intelligence and operational information considered pertinent and its interpretation is reviewed, orally and graphically, in a two- to three-hour session. The Committee drafts its conclusions at the table.

Afternoon: Watch Committee members check its conclusions individually with USIB members. The conclusions, when coordinated through the medium of the NIC, are then published as USIB views and transmitted to responsible government officials and other recipients around the world. NIC prepares the draft body of the Watch Report, a summarization of the evidence considered by the Committee, and sends it by courier or teletype to USIB member agencies.

Thursday morning: The draft Watch Report is reviewed, updated, and commented on by USIB members and by responsible analysts at the desk level in all major agencies. Afternoon: The NIC staff, on the basis of agency comments, prepares a final draft report and submits it to USIB members for approval.

Friday morning: The printed report is disseminated to all recipients; all concerned breathe deeply and plunge into the cycle again.

This fairly exhaustive procedure is complex, sometimes ponderous and time-consuming. But in addition to the production of the formal Committee reports, it has served another very important purpose: it has accustomed all those involved to the joint hammering-out of all the issues, including minor or particular ones. This means that when time is pressing and the issues really urgent we can arrive at joint evaluations and conclusions very quickly. Upon occasion a Committee conclusion has been passed to the White House less than an hour after the Committee was summoned to meet.

Within most of our agencies, the normal internal intelligence processes and organizations are relied on to flush out and evaluate the information which is passed to the NIC or utilized by Watch Committee members at their meetings. Several agencies, however, maintain small internal groups whose sole function is to screen out warning information and seek or stimulate evaluations of it. They are parallel pieces, by way of insurance, to the normal internal intelligence organization and process. In Air Force, for example, a 24-hour indications center is maintained to serve USAF Headquarters and to act as central for a net of small indications centers in the major geographical air commands.

Each of our major joint military commands outside the continental United States has a replica of the national Watch Committee. These are responsible to the theater joint commander, but forward their reports to Washington, where they are regularly considered by the Watch Committee. Thus in our national intelligence warning process the Watch Committee cycle has its concurrent parallels abroad dealing similarly with local warning problems. In some instances the timing of the process abroad has been adjusted to that of the Watch Committee.

With these mechanics as a background, I return to the four aspects of indications intelligence which I mentioned earlier: mental attitude, doctrine, the development of techniques, and organization. My remarks constitute an amalgam of the experience and ideas of a small number of us who have worked in indications intelligence for some years. Some of these ideas have yet to be adopted throughout our community, but our experience leads us to believe that in time they may be more widely accepted.


Attitude of the Watcher

Ideally, for the purposes of indications intelligence, some or all of the following assumptions must be made as basic working hypotheses, though each can be legitimately challenged in any given situation:

The Soviets, together with the other Communist states, are seeking an opportune time to initiate hostilities to achieve their ends.

The attack will attempt maximum surprise, possibly during periods of international calm.

The decision to initiate hostilities may be made without the military capability which we would consider requisite. Any estimates which argue from other assumptions may be quite wrong.

If intelligence officers dealing at any stage with potential warning information can be conditioned to these assumptions, we feel that we have a greater chance of detecting that pattern of developments which may attend preparations for an attack. Intelligence officers need not be ruled by these assumptions, but they should be conscious of them when any possibly relevant information is considered: for instance, military exercises should always be considered as deployments and as changes in degree of military readiness or as rehearsals for an impending attack.

We must instill and maintain this attitude in all personnel dealing with potential warning information, particularly during non-critical periods or during the fading days of a crisis. This is a difficult task, especially in a large intelligence organization with a high degree of specialization and compartmentalization. There are two obvious alternative ways of going about it. One is to wage a relentless educational campaign among the body of our intelligence personnel. This method faces some of the obstacles of a highway safety campaign or a campaign against sin; and it is possible that in laying extensive general stress on the warning problem we might overdo it and give rise to unbalanced or unduly alarmist intelligence reporting and estimates.

The other approach, which I favor, is to develop a small group of indications intelligence officers, either working together as a body or spread among various organizations but maintaining close contact. Such officers would consider information from the warning point of view only, would provide continuity in the development of doctrine, would serve as missionaries among both collectors and analysts, and would keep pressing for adequate attention to fragmentary information of potential but not necessarily apparent significance to warning. Such officers need not achieve great depth in any regional or functional intelligence field, since they could rely on experts for the necessary support. It has been our experience that intelligence officers given this responsibility become enthusiasts, if not zealots, of the indications hunt, and extremely sensitive to those visceral signals which in the last analysis may well be the vital factor in our judgment as to the imminence of a Soviet attack.

In the United States several intelligence agencies have made use of this approach to a greater or less degree. Others depend largely upon having their representatives in our National Indications Center and upon the fact that our major joint current intelligence committee, the Watch Committee, focuses on indications of hostilities and does not spread its consideration to all matters of general intelligence significance. Although it might appear that this specialization could develop a predisposition to a too-frequent crying of "wolf," we feel that the joint nature of the considerations which precede the forwarding of our warnings tends to preclude the danger. In practice, we have found that the nature of our system has served to reduce the number of alarmist "flaps" which arise, particularly outside intelligence circles, from undeliberated interpretation of developments.


Doctrine of the Watch

In the development of a doctrine to guide and assist us to provide warning of an attack, we have sought first to identify in advance those actions which would constitute preparations for hostilities. Such pre-identifications, useful to both analysts and collectors, we have compiled into Indicator Lists. An indicator we define as a major action which the Soviets must take before they are ready for hostilities, whereas an indication is evidence that such an action is being or has been taken. The distinction is an essential one which all of us tend to lose sight of in common usage.

In isolating those actions which we designate as indicators or potential indicators, we are seeking answers to several key questions

What are the essential steps the Soviets and their allies must take in their preparation for early major hostilities?

Which of these steps represent a degree of national commitment which would only, or most likely, follow their decision to initiate hostilities?

In the light of the nature of information currently available to us, or which can be expected, what sort of information will we accept as evidence that these preparatory or implementing steps are being taken?

How do we distinguish, during periods of crisis, between those actions which are precautionary and those which are preparations for deliberate hostilities?

What actions constitute evidence that the Soviet decision making process is in action, possibly considering the question of hostilities?

We have attempted to distinguish a series of preparation phases representing progressive steps toward a decision to attack or progressive commitment of the enemy state to war. We group the indicators in four such stages as follows:

Long Range: Actions involved in the intensified achievement of specific military capabilities; often is offensive or defensive, essential to the prosecute no general hostilities which are either generally anticipated or deliberately planned.

Medium Range: Actions or developments which might accompany or follow a decision to ready the nation or the military forces generally for any eventuality, or which might follow a deliberate decision for war but precede formulation, issuance or implementation of specific operational plans and orders.

Short Range: Actions which might follow or accompany the alerting and/or positioning of forces for specific attack operations or to meet an estimated possible US attack.

Immediate or Very Short Range: Actions which might accompany or immediately precede a Soviet attack (frequently combined in practice with the preceding stage).

These stages can, and have been, defined at greater length or quite differently, but the purpose is the same-to arrive at a listing which groups at one end those actions which may represent long-range preparations for hostilities, but not necessarily a commitment to them, and at the other end those actions which, by their urgency and costliness, appear to connote a commitment of the enemy state to war. It also gives us a sensing of the imminence associated with such indications as we may detect, and of the phasing in time among them.

In our listings we attempt to give not only the major actions which constitute indicators, but also some of the contributory indicators which, if noted in concert, would comprise evidence of a major indication otherwise undetected. Our phased approach also serves to isolate actions by which we hope to gauge the extent and danger of Communist reaction to a particular, perhaps seemingly localized, crisis.

Our proposed schedule of lists will include

First, a general indicator list stating in broad terms the major actions we would expect.

Second, a series of functional lists in much greater detail. There will be separate lists for Long Range Air Force preparations, ground force preparations, political and diplomatic activities clandestine activities, civil defense, military medicine, weather service, etc.

Third, a series of lists which address themselves to specialized sources, including the technical sources. These lists, in effect, are an application of the preceding lists to information provided by individual sources, particularly to changes in a routine take whose warning significance might not be immediately apparent. One such list addresses itself to monitored changes in the conduct of Soviet broadcasting. Another might concern radar monitoring. Another would cover observations our embassy personnel in Moscow might make in the normal course of their daily routine: closure of some subway stations for example, and an absence of fire engines from normal stations might provide confirmation for suspicions that latest age civil defense preparations were under way. A similar list for legal rail travelers would include actions observable from a train window which might fit into indicator patterns.

Fourth, a series of target lists naming those installations or outfits by whom or at which certain activity would be of major significance, and those by whom or at which any activity would have major significance. Examples of the latter might be an elite Long Range Air Force unit or an air transport unit suspected of a role limited to the ferrying of nuclear "pills" to operational commands.

This is an ambitious program, reflecting primarily the paucity of available information, particularly information on the major instruments of Soviet attack. When completed, it will be a massive document. We also plan, however, a highly condensed one-sheet version of each list, perhaps in tabular form. Such lists must be looked on only as guides, and quite often they rapidly become obsolete. In some instances we have failed so far to come up with anything really satisfactory most notably in the missile field. But when we have had sufficient experience with our own missiles and with information on Soviet missile operations, we expect to be able to list actions which would serve to indicate the operational readying of the Soviet missile system.

Another aspect of doctrine is formulation of the answers to these questions:

How early, or at what stage, and how often in a given situation do we inform officials of the executive arm of the government?

What general criteria do we use to determine that a warning situation exists?

Our first premise is that we should provide executive officials with the earliest warning possible. This means, in effect, a progressive of warnings-from a generalized one, perhaps conveying only our sense of uneasiness, through a contingent one pointing out that if certain further actions take place it may be that hostilities are imminent, to an unconditional one conveying our conviction that an attack is forthcoming.

The criteria of a warning situation he in patterns, in configurations of Soviet or Communist activity which might be consistent with some stage in preparations for early war. Once an apparent pattern is detected, giving an indications situation although not necessarily an alert situation, the hypothetical patterns which we have constructed in the preparation of our indicator lists suggest further developments to look for. If information on such developments is subsequently received, we have then progressed toward an alert situation.

When we note apparent patterns of preparation we alert our field collection, particularly to our need for information on major indicators. When we receive information on the accomplishment of one or more isolated major indicators, we also alert the field, this time to our need for information on those other indicators we might expect to see patterned with them. In both instances we feel that we have the basis for some form of warning to the government, even though we may have no conviction that a pre-war situation exists.

The pattern approach is particularly applicable to the surprise attack; it has limitations in situations of localized tension, where the buildup for a limited attack may be as complete as it will ever be, but where there may have been no political decision to make the attack. The indications effort may suggest refinements in our collection, and it may assist in narrowing the field we must search in order to detect evidence of the decision; but it cannot go a great deal further. Subsequent developments are sometimes almost exclusively matter for tactical or operational intelligence. Indications intelligence is looked to, however, for warning of preparations to broaden a localized situation or to cope with an expected broadening.


Techniques and New Techniques

Our attempt to develop techniques has thus far been aimed at facilitating the processing and analysis of information and the detection of patterns, and at exposing areas requiring further analytical investigation or more extensive collection efforts. We have used extensively the more orthodox methods, although despite their usefulness we have had to abandon some because of their expense in time and personnel. To describe a few:

Card files of information extracted only for apparent or potential indications significance-one item to a card in three separate files, according to functional fields, date, and the apparent axis or targets of Soviet/Communist attack.

Running lists constituting highly condensed summaries of apparently significant developments arranged according to the apparent axis of attack.

"Shelf-paper" rolls of charts with summarized information of apparent indications significance entered according to date of activity, area and functional field, or in other arrangements.

Highly condensed summaries of apparent current indications, negative and positive, bearing on particular situations.

Quarterly summaries of indications, including only selected developments of apparent medium- or long-range significance.

There have also been efforts, some only experimental, at posting developments on display charts or boards categorized variously according to area, functional field, date of activity, and degree of imminence or hypothetical length of pre-attack time remaining. Through the use of colors and other devices, such displays serve to call attention to possibilities which need further investigation. The Air Force, which has been the most active among our departments in the development of indicator techniques, devised such an indicator display board for use in all Air Force indications centers and is now experimenting with other graphic means of calling attention to trends and potential warning situations.

There have been a number of suggestions for the use of electronic devices which could store information so coded and weighted that when queried they would respond with a "temperature" reading and a predicted area and time of danger. We have been hesitant to plunge into this sort of thing, because the information fed in would in many cases be so uncertain, and its weighting-which would reflect immediate judgment as to its significance-even more uncertain. I do not believe, however, that we should rule out this approach forever. In many respects, our most important warning information is becoming more and more fragmentary and more and more of a technical nature. It is hard information, such as detection of radar emanations, but difficult to evaluate, analyze and record by our conventional methods. It may be that an imaginative and judicious use of machines will enable us to put such information quickly into meaningful patterns which can contribute to our warning.

In developing these techniques we are merely seeking aids to analysis and to presenting the situation. In no sense do we believe that intelligence warning can be performed mechanically, although there are a surprising number of people who believe that this is possible or that it is what we are trying to do.

There is also a need for development of new collection techniques for warning purposes. One thing that can be done is to formulate a coordinated series of collection requirements and reporting directives which would be put into effect only during periods of alert or international crises, when certain types of information would assume new significance. Another is to direct a series of routine monitoring-type missions against selected targets for indications purposes only, with a view to detecting any changes from normal activity. The targets themselves might be of minor importance, but changes in their activities might reflect far more important activities elsewhere. A series of somewhat riskier pre-planned monitoring type missions could be reserved for periods of alert, when the risks could be justified by the depth of our suspicions.

It may be possible to devise new technical collection systems or adapt some now in use to the purposes of warning intelligence. Electronic intelligence, for example, I understand now produces chiefly information on capabilities, new technical developments and order of battle. We must rethink it to see if it can produce unique information on changes in day-to-day activities which would be meaningful to indications intelligence. Early in the development of any new collection device its possibilities for indications intelligence should be examined. This is frequently done far too late.

There is also a need, presumably through communications techniques, for reducing the time lags between collection of information and its effective presentation for evaluation. Our air defense has found it necessary to develop methods for automatic or semi-automatic presentation, and even analysis, of tactical air warning information. But intelligence warning information, although we have been able to cut down actual transmission times for a few highly select messages from field collection points, is too often subject to completely unacceptable, even though understandable, delays.


Organizational Devices

I have touched in the foregoing sections on some of the organizational devices introduced in the National Indications Center and member agencies in support of the Watch Committee's function, devices which range from the establishment of the NIC itself and the USIB coordination mechanism to the creation of small parallel indications staffs in individual agencies. I believe that certain other organizational measures might in some form or combination further facilitate our warning efforts. One would be a sort of national directory of intelligence assignments which would locate and fix responsibility for analysis and reporting of potential warning information for every segment of our intelligence coverage, no matter how minor.

Then there might be created a body of collection experts, perhaps even supported by a collection coordination center, which would work in harness with the Watch Committee and the National Indications Center. This might assist, particularly during moments of crisis when time is short, in the coordinated search for missing elements of information or in the rapid clarification of uncertain information.

Finally, we could organize against emergencies a thoroughgoing phased national intelligence alert, making provision for availability of intelligence personnel, extent of 24-hour staffing, availability of administrative support (including communications), comprehensive situation reporting by field collection and by intelligence agencies, and the initiation of preplanned collection measures such as the assignment of new priorities and targets and the activation of reserve or one-shot sources. Such a total alert would be very difficult to arrange and to keep current, but it could save precious hours.

There is such great change either present or impending in methods of warfare and the balance of power between East and West that the task of providing warning is increasingly difficult. The two major factors in this increasing difficulty are a) the accelerating compression in time between the enemy decision to launch an attack and its launching and between the launching and its delivery, and b) the concurrent reduction in the amount and variety of discernible pre-attack activity. It seems to me that now, as never before, we must subject our intelligence organization and processes for collection and evaluation to continuing scrutiny, and must improve or adapt them to cope with the changing conditions. We must ensure that we are collecting and considering the proper information and that we eliminate every possible delay in the processing of the potentially vital information. Furthermore, in order to provide warning, no matter how contingent, at the earliest possible stage, we must improve our understanding of Soviet Bloc decision-making and strategic doctrine.


Historical Document
Posted: May 08, 2007 07:15 AM
Last Updated: Aug 03, 2011 03:37 PM