ATP 2-33.4, page 63

Core Army Analytic Techniques 18 August 2014 ATP 2-33.4 5-9 complete intelligence assessments in a timely and accurate manner. Link analysis software programs are standard components on the Army’s intelligence processors from theater down to the company level. 5-30. Having seen its success in aiding law enforcement agencies in analyzing criminal organizations, the U.S. military now uses link analysis in analyzing terrorist and other complex networks. Link analysis is used by intelligence personnel to identify connections between individuals, organizations, and activities in order to determine associations. 5-31. There are three types of visualization tools used in link analysis to record and visualize information: the association matrix, the activities matrix, and the link diagram. Link Analysis Done Without Automation Although most link analysis is done using automation, a different approach to link analysis is to use small sticky notes of paper on a white board. The analyst labels the notes and places them on the white board. Connections are drawn on the board between different entities and nodes, using markers. This method has several benefits: • A potentially larger picture can be seen on a white board than what may be seen on a computer monitor; many automated systems present limited views. • It allows movement of the entities, quick redrawing of links, and color coding using different markers. • It allows for a team of analysts to work together to develop analysis. 5-32. Link analysis generally follows the order shown. Analysts must understand that steps 1 and 2 are often interchanged and/or done concurrently. Each of these steps is discussed below:  Step 1. Construct an association matrix.  Step 2. Construct an activities matrix.  Step 3. Construct a link diagram. ASSOCIATION MATRIX 5-33. An association matrix is used to identify the existence and type of relationships that exist between individuals as determined by direct contact. Direct contact is determined by a number of factors, including but not limited to—  Face-to-face meetings.  Telephonic conversation.  Membership in a group or organization. Note. It is important to know that using the association matrix without modification will show only the existence of relationships not the nature, degree, or duration of those relationships. Facts 5-34. A known association between individuals is depicted on the matrix by a dot or filled-in circle. Suspected associations are depicted on the association matrix by an open circle. The rationale for depicting suspected associations is to get as close as possible to an objective analytic solution while staying as close as possible to known or confirmed facts. If a suspected association is later confirmed, the appropriate adjustment may be made on the association matrix simply by filling in the open circle. A secondary reason for depicting suspected associations is that it may give the analyst a focus for requesting to task limited intelligence collections assets in order to confirm the suspected association. Suspected associations between persons of interest are considered to be associations which are possible or even probable, but cannot be confirmed using the above criteria. Examples might be—  A known party calling a known telephone number. (The analyst knows to whom the telephone number is listed, but it cannot be determined with certainty who answered the call.)  A face-to-face meeting where one party can be identified, but the other party can only be tentatively identified.