OSINT Analyst Course

sources

4 min read

Source Canon (six-book)

The doctrine the course distils from. Cards list these source IDs in frontmatter sources: and may add optional chapter pointers for deep dives. Heavy .full.md converted texts are gitignored, read in place — paths below point to where they live on disk. Where a chapter-split layer exists, it lives under *.assets/chapters/ (also gitignored) for easier mining; the flat .full.md remains the whole-book source.

owns = what this source authoritatively leads on. Reinforcing sources are noted per module in 00-architecture/course-architecture.md §2.

Canon IDs: kahneman · bazzell · clark · heuer-psych · sat · mcdowell.

Military doctrine (ATP / JP stubs) and the former systems shelf (Meadows, Tetlock, Cynefin) are out of canon as of 2026-07-29. ICD 203 / 206 / 208 remain external public ODNI standards (see bottom).

The six books

kahneman — Thinking, Fast and Slow

  • Author / origin: Daniel Kahneman (with the Amos Tversky collaboration; Nobel 2002), Farrar Straus & Giroux, 2011.
  • Authority: civilian (cognitive science / behavioral economics) · Currency: stable
  • On disk: resources/sys/thinking-fast-and-slow/…assets/…full.md (chapter splits under …assets/chapters/ when present)
  • Owns: the System 1 / System 2 dual-process model; cognitive ease & WYSIATI; the heuristics-and-biases catalogue — anchoring, availability, representativeness & base-rate neglect, substitution, the law of small numbers, illusion of validity, the planning fallacy (inside vs outside view), regression to the mean, framing / loss aversion.
  • Feeds: F1 (lead on F1-01–F1-04; reinforces F1-05); reinforces L4 (bias mitigation).
  • Key concepts: the two-systems architecture · WYSIATI · the substitution table · the anchoring index · the Tom W / Linda / regression demos.

heuer-psych — Psychology of Intelligence Analysis

  • Author / origin: Richards J. Heuer Jr., CIA Center for the Study of Intelligence (1999, public)
  • Authority: civilian · Currency: stable (foundational; does not rot)
  • On disk: resources/civ/civ-heuer-psychology-of-intelligence-analysis/…assets/…full.md
  • Owns: ACH (the 8-step origin), evidence diagnosticity, mirror-imaging, mental-model/mind-set framing, satisficing, premature closure, verbal-probability uncertainty (the NATO dot-plot, Fig 18), the deception hypothesis.
  • Feeds: F1-05 (mental models & mindsets — lead); reinforces F1 biases; L4 (ACH, diagnosticity, estimative language).
  • Key figures: Fig 15 ACH matrix · Fig 18 probability dot-plot · Fig 10 complexity-vs-variables.

sat — Structured Analytic Techniques (Heuer & Pherson)

  • Authority: civilian · Currency: stable
  • On disk: resources/civ/civ-heuer-pherson-structured-analytic-techniques/…assets/…full.md
  • Owns: the six-families SAT taxonomy, Key Assumptions Check, indicators (generation/validation/evaluation), deception detection (MOM/POP/MOSES/EVE), premortem & structured self-critique, multiple-scenarios (2×2), the cognitive-limitations taxonomy (18 traps), STEMPLES+, network-charting technique guidance.
  • Feeds: L1 (indicators), L3 (network charting), L4 (SATs, KAC, deception, scenarios), G (scenario generation).
  • Note: ACH here is a 9-step variant — reconcile against Heuer 8 in L4-03.

clark — Intelligence Analysis: A Target-Centric Approach (Robert M. Clark)

  • Authority: civilian · Currency: stable
  • On disk: resources/civ/civ-clark-target-centric-approach/…assets/…full.md
  • Owns: the target-centric (network-centric) process; strategies-to-task decomposition; target-model taxonomy; gap→collection-strategy overlay; prediction methodology (extrapolation/projection/forecast); convergent vs divergent phenomena; SNA for intelligence; evidence-evaluation three-step; estimative language.
  • Feeds: F2 (cycle vs target-centric), L1 (gap analysis), L3 (SNA, target model), L4 (evidence eval), L5 (briefing), G (prediction).
  • Key figures: Fig 1-2 target-centric process · Fig 8-4/8-5 Abacha laundering model + collection overlay · Fig 14-3 SNA.

mcdowell — Strategic Intelligence (Don McDowell)

  • Authority: civilian (LE/strategic) · Currency: stable
  • On disk: resources/civ/civ-mcdowell-strategic-intelligence/…assets/…full.md
  • Owns: strategic intelligence cycle (12-step flowchart); conceptual modelling; Terms of Reference; strategic work plan / critical path; indicator development cycle (Fig 12.1); the Intelligence Collection Plan (ICP); the 4×4 source-reliability/data-validity grading (house standard); strategic assessment report layout.
  • Feeds: F2 (what intelligence is, the cycle), L1 (ICP, TOR, indicators), L4 (4×4 grading), L5 (assessment-report layout).

bazzell — Open Source Intelligence Techniques (Michael Bazzell)

  • Authority: civilian (OSINT tradecraft) · Currency: ⚠ PERISHABLE — tooling/methods change fast (operator notes much has shifted since 2024). Treat concepts as durable, specific tools/sites as needing live re-verification.
  • On disk: resources/civ/civ-bazzell-osint/…assets/…full.md (chapter PDFs in …assets/pdfs/)
  • Owns: covert-account / sock-puppet construction; VM OPSEC & host isolation; the six target-pivot chains (Email→Username→Real Name→Telephone→Domain→Location); managed attribution stack; OSINT investigative lifecycle; breach/leak/stealer-log exploitation; EXIF/image geolocation; report anatomy.
  • Feeds: F2-04 (analyst OPSEC intro), L2 (all — ⚠ live), L3 (pivots, EXIF), A (person workflow), F (breach data), L5 (case report).

External standards (cited, not in the six-book bundle)

ICD 203 (analytic standards & estimative probability), ICD 206 (sourcing — full product rigor is taught as course content in L5-03 and required of student products), ICD 208 (writing for maximum utility / BLUF). Pull current text via live research when building L5.

Graph View

Backlinks