How Intelligence Actually Forms: From Raw Data to a Finished Intelligence Product
The Intelligence Fundamentals Project
Defining the building blocks
Before examining how intelligence forms, it is necessary to establish clear definitions for data, information, reporting, and intelligence as they are used across military, intelligence, and law enforcement doctrine. These terms are often used interchangeably in practice, but doctrine treats them as distinct concepts with specific roles in the intelligence process.
Data is consistently defined as raw, unprocessed observation. Joint doctrine describes data as raw bits collected by a sensor, without interpretation or context (Joint Staff 2013). Army doctrine defines data as unprocessed observations detected by a collector of any kind, including human, mechanical, or electronic entities, specifically in support of decision making (Army 2023). International law enforcement guidance similarly defines data as raw and uninterpreted observations and measurements, including features of criminal activity that are easily quantified (OSCE 2017). NATO extends this concept to the open-source environment, describing open-source data as raw print, broadcast, oral debriefing, or other information obtained directly from a primary source prior to editorial handling (NATO 2002).
Across these frameworks, data reflects that something was observed. It has not been evaluated, contextualized, or assessed for reliability or meaning.
Information is data that has been processed into an intelligible or usable form. Joint doctrine defines information as data collected from a sensor that has been processed so it can be understood (Joint Staff 2013). Army doctrine describes information as data that has been organized and processed to provide context for further analysis (Army 2023). International law enforcement doctrine characterizes information as data placed into context and empowered with meaning, giving it greater relevance and purpose (OSCE 2017). United Kingdom policing doctrine uses a broader definition, treating information as all forms of material obtained, recorded, or processed by police, including personal data and intelligence (ACPO 2005). NATO defines open-source information as data that has undergone an editorial process involving filtering, validation, and presentation management (NATO 2002).
While definitions vary in scope, they converge on a shared principle: information is processed and contextualized data. It may describe events, conditions, or entities, but it has not yet been evaluated or interpreted to support a decision.
Reporting refers to the act of conveying data, information, or intelligence to a recipient. International law enforcement guidance identifies reporting as the delivery mechanism through which intelligence products are disseminated, typically in clearly structured and concise formats (OSCE 2017). Army doctrine distinguishes reporting from intelligence by defining combat information as highly perishable reporting provided to a commander when there is insufficient time to process it into intelligence before use (Army 2023). NATO doctrine explicitly states that reporting is a delivery mechanism rather than intelligence itself, noting that reports may represent the end of the traditional classified intelligence process while serving as the starting point for open-source intelligence work (NATO 2002). United Kingdom doctrine treats reports as a primary means for judging the effectiveness of a police intelligence unit, as they are the mechanism through which intelligence is recorded and acted upon (Global 2003). Within the Intelligence Community, reporting and analysis derived from document and media exploitation are formally recognized as intelligence products once analysis has occurred (IC 2007).
Across doctrines, reporting is not defined by content maturity. A report may contain raw observations, processed information, or finished intelligence. Reporting does not determine whether something is intelligence. It determines how material is delivered.
Intelligence is defined as the assessed product created through analysis in response to a requirement. Joint and Army doctrine define intelligence as the product resulting from the collection, processing, integration, evaluation, analysis, and interpretation of available information concerning operational environments, threats, or areas of interest (Joint Staff 2013; Army 2023). Intelligence is explicitly described as a decision-support mechanism that enables comparison of courses of action and supports anticipation or prediction of future situations (Joint Staff 2013). Army doctrine further emphasizes that intelligence is requirements-driven and focused on supporting commanders and staffs through situational understanding, visualization, and targeting (Army 2023).
International law enforcement guidance defines intelligence as data, information, and knowledge that have been evaluated, analyzed, and presented in a decision-making format for action-oriented purposes (OSCE 2017). United States law enforcement doctrine describes criminal intelligence as credible information combined with quality analysis and used to draw conclusions (Global 2003). United Kingdom policing doctrine defines intelligence as information that has undergone defined evaluation and risk assessment processes to support police decision making (ACPO 2005). Republic of Serbia doctrine similarly defines criminal intelligence as collected, evaluated, processed, and analyzed data that forms the basis for informed policing decisions (Republic of Serbia 2016). NATO doctrine defines open-source intelligence as information deliberately discovered, discriminated, distilled, and disseminated to a select audience in response to a specific question (NATO 2002).
Across all domains, intelligence is consistently treated as an analytic product rather than raw material or reporting output. It is created through evaluation and interpretation, shaped by requirements, and intended to support decisions.
With these definitions established, intelligence formation can be examined as a process rather than a label.
The intelligence cycle and its purpose
With the core terms established, intelligence formation can be discussed as a process rather than a label applied to collected material.
This process is commonly referred to as the intelligence cycle. Across military, intelligence, and law enforcement practice, the intelligence cycle provides a shared framework for turning raw data and information into intelligence that supports action (OSCE 2017). It gives practitioners a consistent way to structure analytic work so that observations are refined through deliberate steps before they inform a decision.
Joint guidance describes the intelligence process as a set of interrelated activities designed to create shared procedures and terminology, organized into six functional areas that support operations (Joint Staff 2013). Army guidance presents a similar structure using four primary steps supported by continuing activities that keep intelligence aligned with operational needs (Army 2023). While the structure and labels differ, the purpose remains the same. The process exists to inform leaders, describe the operating environment, and support planning and execution (Joint Staff 2013).
Rather than focusing on rigid steps, the intelligence cycle explains how material moves from collection to decision support in a controlled and repeatable way. It helps ensure that observations are evaluated and interpreted before they are treated as intelligence.
From data to information through processing
The progression starts with data.
Across sources, data is defined as raw, uninterpreted observations or measurements. This includes raw bits collected by sensors and unprocessed observations detected by human, mechanical, or electronic collectors (Joint Staff 2013; OSCE 2017; Army 2023). At this stage, nothing has been assessed or placed into context. Data reflects that something was observed, not what it means or whether it matters.
Data becomes information through processing. Army guidance describes information as data that has been organized and processed to provide context for further analysis (Army 2023), while joint guidance emphasizes converting collected data into forms that can be readily used by analysts and decision-makers (Joint Staff 2013). This transition happens through processing and exploitation, which converts and refines collected data into usable information and makes it available for analysis (Army 2023).
Processing and exploitation include activities such as data conversion, correlation, document and media translation, and signal decryption (Joint Staff 2013). Through this work, raw observations gain enough structure and context to support recognition of patterns and relevance, which distinguishes information from unprocessed data (OSCE 2017). In the open-source environment, NATO describes information as data that has gone through editorial handling such as filtering, validation, and presentation management (NATO 2002).
At this point, information can describe events, locations, or conditions. It has meaning, but it has not yet been evaluated or interpreted to support a specific decision.
From information to intelligence through analysis and production
Information becomes intelligence during analysis and production. This is where meaning is assessed rather than just described.
At this stage, processed information is brought together and examined as a whole. Information from different sources is integrated so relationships, gaps, and inconsistencies can be identified across the broader picture rather than within isolated data points (Joint Staff 2013; OSCE 2017). Integration allows analysts to move beyond individual facts and start understanding how pieces relate to one another.
Once information is integrated, it is evaluated. Evaluation focuses on the reliability of the source and the credibility of the information itself (Joint Staff 2013; OSCE 2017). This step matters because not all information carries the same weight. Evaluation helps ensure that analysis is grounded in material that can reasonably support conclusions rather than being driven by volume, novelty, or assumption.
Analysis follows evaluation. Analysts compare integrated and evaluated information against known facts, existing understanding, and working assumptions. Through this comparison, they identify patterns, trends, and developments that help explain what is happening and what may happen next (Joint Staff 2013; Army 2023). Analysis turns descriptive material into assessed understanding.
Interpretation applies judgment to that analysis. Information and assessments are considered in relation to existing intelligence and current requirements to determine their significance (Joint Staff 2013; Army 2023). This is where implications are identified and where intelligence begins to support anticipation rather than simple awareness.
These activities are often described collectively as fusion. Fusion examines all available sources together to produce a coherent assessment rather than parallel or disconnected observations. At this point, intelligence exists because information has been evaluated, analyzed, and interpreted in a way that supports decision-making.
Collection, processing, and reporting within the process
Collection, processing, and reporting each play a role in intelligence formation, but they serve different functions.
Collection provides the raw data needed to address requirements. Processing converts that data into a usable form that can be examined and analyzed. These activities depend on one another, but neither produces intelligence on its own (Joint Staff 2013; Army 2023).
Reporting is how material is delivered to a recipient. Reports can contain raw observations, processed information, or finished intelligence depending on operational needs and time constraints. International law enforcement guidance notes that intelligence products are commonly disseminated through structured and concise reports (OSCE 2017). In the United Kingdom’s National Intelligence Model, reports are used as a primary measure of how intelligence units support decision-making (Global 2003). NATO guidance highlights that reports may represent the final output of a classified process while serving as the starting point for open-source intelligence work (NATO 2002).
What matters is not whether something is written in a report, but whether the analytic work needed to support decisions has occurred. Reporting is a delivery mechanism. Intelligence is the assessed product.
Requirements and decision support
Intelligence work begins with requirements.
Requirements identify what decision-makers need to know about an environment, activity, or threat. These requirements shape what is collected, how it is prioritized, and how analysis is focused (Joint Staff 2013; Army 2023). In military settings, requirements are formalized through Priority Intelligence Requirements that support broader Commander’s Critical Information Requirements (Joint Staff 2013).
Law enforcement frameworks reflect the same structure. Intelligence-led policing emphasizes analysis as the foundation for objective decision-making, particularly when prioritizing crime patterns, locations, and offenders (OSCE 2017). Across domains, intelligence exists to support decisions by providing assessed understanding rather than raw information.
Because intelligence is requirement-driven, the same information can lead to different intelligence products depending on the question being addressed. Intelligence products are shaped by the decisions they are intended to support.
The role of timeliness
Timing affects whether intelligence is useful or not.
Information and analysis must reach decision-makers while there is still an opportunity to act. Guidance consistently notes that intelligence delivered too late to influence planning or execution loses its value regardless of analytic quality (Joint Staff 2013; Army 2023).
In fast-moving environments, analysts may need to provide assessments before all information is available. Guidance recognizes that a timely and accurate assessment is often more useful than a more detailed product that arrives after the decision window has passed (Army 2023). For this reason, intelligence processes emphasize continuous flow, updates, and reassessment rather than one-time delivery (Global 2003).
Models that describe the progression
Several models help illustrate how this progression works in practice.
International law enforcement guidance describes a hierarchy moving from data to information to knowledge and finally to intelligence, with intelligence defined as evaluated material presented in a format that supports action (OSCE 2017). NATO’s open-source framework distinguishes between open-source data, open-source information, and open-source intelligence based on how much refinement and analysis has occurred and whether the output addresses a specific question (NATO 2002).
The 4-i model explains the relationship between decision-makers and analysts through intent, interpretation, influence, and impact, showing how intelligence connects analytic work directly to outcomes (OSCE 2017). Joint guidance reinforces this view by describing intelligence as the result of comparing and relating information across sources to draw conclusions that support decisions (Joint Staff 2013).
Across these models, the logic remains consistent. Intelligence forms through structured refinement, evaluation, and interpretation rather than through collection alone.
Bringing it together
Understanding how intelligence forms helps clarify what different parts of the process are actually responsible for.
Data and information provide raw material. Processing makes that material usable. Analysis and interpretation turn it into intelligence that supports decisions. Reporting delivers the result, but it does not define its quality.
When these roles are understood and applied consistently, intelligence work becomes more focused, more defensible, and more useful to the people who rely on it.
Tomorrow’s topic:
What qualities turn information into intelligence and the criteria analysts use to make that transition defensible.