knowledge_base/knowledge_base_jsonl/knowledge.jsonl

{"source":"UPLOAD TO CHAT.pdf","category":"Doctrine","text":"The US Army's intelligence doctrine restricts thinking to conventional asymmetric scenarios. Its HUMINT is limited to elicitation, interrogation, document exploitation, tactical questioning, reconnaissance, and surveillance, and its counterintelligence is focused on defensive security measures at fixed installations. No doctrine exists for a proactive, coordinated intelligence offensive. In contrast, the 5D Intelligence Framework introduces five active phases (Detect, Deny, Deter, Deliver, Destroy) to guide comprehensive intelligence operations. This framework acts as an advanced warning and force-protection system that penetrates local populations and counters asymmetric enemy battle systems.","tags":["US Army","HUMINT","Counterintelligence","5D Intelligence","Asymmetric Warfare","BOS"],"summary":"Critiques US Army intelligence limitations and presents the 5D Intelligence Framework (Detect, Deny, Deter, Deliver, Destroy) as a more proactive, holistic approach for asymmetric warfare."}
{"source":"SOP INT SECTION.pdf","category":"SOP","text":"The battalion intelligence section\u2019s mission is to provide timely, relevant, and accurate intelligence to the battalion commander, staff, and company commanders while ensuring operational security. Key tasks include collecting, collating and analyzing information about the current situation; conducting Intelligence Preparation of the Battlefield (IPB) to develop situational awareness; prioritizing force protection through ranked target assessment; planning reconnaissance and surveillance; preparing intelligence products for operations; and disseminating those products to commanders and units.","tags":["Battalion Intelligence","Mission","IPB","Situational Awareness","Force Protection","Reconnaissance","Surveillance"],"summary":"Defines the battalion intelligence section\u2019s mission and core tasks such as IPB, situational awareness, force protection target assessment, recon planning, and intelligence dissemination to support operational commanders."}
{"source":"SOP INT SECTION.pdf","category":"SOP","text":"Tactical decision-making follows the 1/3\u20132/3 rule: no more than one-third of the available time should be spent on planning. Three planning timelines are defined based on notification: Elaborate TDP (notification >72 hours before execution; planning completed within 24 hours of notification), Compressed TDP (notification 24\u201372 hours before execution; planning in 8\u201324 hours), and Urgent TDP (notification <24 hours before execution; planning time set to one-third of remaining time). These constraints ensure efficient allocation of time for mission planning and execution at the battalion level.","tags":["Planning","Tactical Decision","Timeline","TDP","Time Management"],"summary":"Explains time management for battalion planning: use the 1/3\u20132/3 rule and defines elaborate, compressed, and urgent planning timelines based on notification time."}
{"source":"SOP INT SECTION.pdf","category":"SOP","text":"When a mission is received, the S-2 initiates intelligence preparation (IPB). The S-2 studies the situation, formulates intelligence requirements, and prepares an initial briefing. The S-2\u2019s deputy (2IC) collects intelligence and reconnaissance data from brigade sources, tasks surveillance assets, and creates the initial situation template. An IPB officer manages the intelligence process by nominating requirements, deploying HUMINT and reconnaissance assets, and updating intelligence and force protection assessments. Junior staff (JCOs) compare higher-echelon intelligence with battalion needs to identify gaps, perform terrain analysis, maintain target folders, and compile threat and vulnerability assessments. The S-2 then conducts mission analysis, refines intel tasks, briefs an initial intelligence report (covering general situation, terrain, enemy strength and dispositions, likely enemy COAs), and completes the intelligence estimate to support friendly COA development.","tags":["Mission Planning","IPB","Intelligence Requirements","Threat Assessment","Terrain Analysis","Vulnerability"],"summary":"Describes the battalion S-2 section\u2019s mission planning process: roles of the S-2, IPB officer, and subordinates in collecting intel from higher HQ, identifying gaps, analyzing terrain and threats, and producing the intelligence estimate."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"The 5D framework (Detect, Deny, Deter, Deliver, Destroy) provides multi-dimensional guidance for intelligence-driven crime investigations, especially when evidence is missing or destroyed. Instead of relying on physical clues alone, it uses layered intelligence, counterintelligence, and operational tactics to unearth hidden evidence and intent. Investigators combine HUMINT, surveillance, forensic analysis, and perception management to reveal the criminal network by exploiting multiple channels of information.","tags":["5D Framework","Intelligence Policing","HUMINT","Surveillance","Network Analysis"],"summary":"Introduces the 5D framework for crime investigation when evidence is absent: a layered intelligence approach that forces hidden intent and evidence into the open."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"Phase 1 \u2013 DETECT: Establish initial contact with hidden threats when direct evidence is missing. Techniques include interviewing staff or bystanders (e.g., hospital workers, security guards, vendors) and conducting covert site reconnaissance for anomalies (fresh plaster, displaced items). Investigators may secure and search concealed areas (basements, ducts) to uncover hidden evidence, and apply micro-forensic methods (chemical residues, dust patterns, CCTV timing analysis) to detect signs of tampering.","tags":["Detect","HUMINT","Reconnaissance","Surveillance","Forensics"],"summary":"Details the Detect phase: using interviews, covert searches, and micro-forensics to find initial clues and concealed evidence when none is immediately visible."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"Phase 2 \u2013 DENY: Frustrate the criminals\u2019 ability to hide evidence or control the narrative. Conduct counterintelligence to identify insider leaks or suspicious behavior, and enforce strict OPSEC on interrogation details and forensic plans. Restrict access to key facilities (morgues, medical records, staff areas) and digital logs. Control information flow to prevent premature assumptions. By denying adversaries freedom of movement and information, false narratives and tampering are prevented.","tags":["Deny","Counterintelligence","OPSEC","Information Security","Investigative Security"],"summary":"Explains the Deny phase: security and counterintelligence measures to prevent suspects from tampering with evidence or influencing the investigation."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"Phase 3 \u2013 DETER: Shape adversary behavior by creating anticipation of consequences. Deploy visible measures such as increased patrols, unexpected inspections or audits, and psychological operations that highlight the thoroughness of the investigation. Lawfully question potential collaborators repeatedly to signal that silence won\u2019t protect them. Hardening actions include securing records, enforcing CCTV redundancy, and off-site data backups. Use tactical HUMINT to engage insiders who may cooperate under pressure. These actions cause the criminal network to hesitate or inadvertently reveal themselves.","tags":["Deter","Psychological Operations","HUMINT","Target Hardening","Preventive Security"],"summary":"Describes the Deter phase: using overt pressure (patrols, inspections, questioning) and security hardening to make criminals anticipate consequences and hesitate or expose themselves."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"Phase 4 \u2013 DELIVER: Separate innocent stakeholders from the criminal nexus and rebuild trust. Conduct transparent communication and community engagement to show that investigations are independent and fair. Support threatened personnel or civilians (safe channels for whistleblowers, protective measures). Exploit intelligence to distinguish coerced individuals from actual collaborators. Quickly prosecute minor facilitators to demonstrate certainty of justice. These actions reassure the public and encourage more people to provide intelligence.","tags":["Deliver","Community Engagement","Trust Building","Prosecution","Whistleblower Protection"],"summary":"Covers the Deliver phase: actions to protect and reassure civilians and insiders (public communication, safe reporting) and to ensure justice, thereby drawing out more intelligence sources."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"Phase 5 \u2013 DESTROY: Dismantle the criminal network\u2019s structure. Map and encircle all components of the network (leadership, facilitators, safe houses, logistic links). Execute precision raids on identified nodes to seize hidden evidence (digital devices, documents, communication records) guided by intelligence. Conduct wide-area sweeps in suspected zones (e.g., disposal areas, storage rooms) for additional evidence. Prosecute in layers: target both front-line operatives and back-end supporters simultaneously, ensuring the network cannot reconstitute.","tags":["Destroy","Network Disruption","Raids","Evidence Seizure","Layered Prosecution"],"summary":"Summarizes the Destroy phase: coordinated raids and prosecutions to break and dismantle the criminal network based on the intelligence gathered."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"These phases form a systematic escalation: begin at Detect (even if no evidence is visible) and move sequentially through Deny, Deter, Deliver, Destroy. This forces investigators to look beyond physical evidence into intent, deception, and network structure. The model integrates intelligence, counterintelligence, and policing into one continuum. It prevents prematurely closing cases by ensuring each channel is fully exploited, so hidden leads aren\u2019t overlooked.","tags":["Crime Cycle","Investigative Process","Counterintelligence","Sequential Strategy","Hidden Evidence"],"summary":"Explains that the 5D phases create a step-by-step approach to investigation, ensuring every aspect (evidence, deception, networks) is considered before concluding the case."}
{"source":"5D_Crime_Analysis.pdf","category":"Threat Framework","text":"When evidence is absent or destroyed, the 5D framework becomes the operational compass. By sequentially applying Detect, Deny, Deter, Deliver, Destroy, investigators conduct a comprehensive intelligence operation rather than relying on forensic clues alone. This method targets intent, deception and network vulnerabilities until the truth is uncovered.","tags":["Intelligence Strategy","Evidence Loss","Operational Planning","Investigation","Network Analysis"],"summary":"Concludes that without hard evidence, investigators should use the 5D intelligence strategy (detect, deny, deter, deliver, destroy) as a guiding method to uncover hidden threats."}
{"source":"Threat_Lens_Report_updated.pdf","category":"Ops Guidance","text":"Intelligence Summary: Three terrorists are sighted near a military convoy route close to an army camp, indicating a high risk of ambush on convoys or personnel. Mission: Assess and neutralize this terrorist threat while ensuring the safety of friendly forces. Commander\u2019s Intent: Proactively detect and deny hostile intent, and neutralize the threat with minimal collateral damage to preserve freedom of movement. Enemy Situation: A 3-person hostile cell (likely a reconnaissance/ambush team) is present, equipped with small arms, likely IED capability, and basic support. Friendly forces include the convoy and a nearby camp (2 km west) with quick-reaction capability. Constraints: Rules of Engagement with civilians, limited ISR coverage, and potential enemy concealment. Terrain & Human Terrain: The area is a road corridor with vegetation and structures offering ambush cover. A mixed civilian population of unknown loyalties is in the area, complicating ISR placement and engagement decisions.","tags":["Threat Assessment","Terrorism","Convoy Security","ROE","Reconnaissance","Ambush"],"summary":"Presents an intelligence snapshot of terrorists near a convoy path with ambush potential. It includes the intelligence summary, mission and intent, enemy threat details, friendly forces and constraints, and terrain/human terrain considerations for planning a response."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Doctrine","text":"Traditional planning models (Intent+Capability=Action) are extended by incorporating the enemy\u2019s Propensity to attack. The proposed situational awareness formula is: Confirm/deny intelligence on both anticipated courses of action (COAs) and potential surprise attack options. In other words, planners must validate intel for expected enemy plans and separately evaluate surprise scenarios. Propensity (the adversary\u2019s motivation to act) multiplies their intent, ensuring that both will and conventional factors are considered in estimates.","tags":["Situational Awareness","Enemy Intent","Propensity","COA","Threat Modeling"],"summary":"Defines an augmented SA model: incorporate enemy 'propensity' and explicitly consider both anticipated and surprise attack plans in intelligence estimates."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Threat Framework","text":"Mazumdar identifies five attack target modes that cause tactical surprise: (1) High-Priority Targets (HPTs) \u2013 high-profile figures or sites whose loss would severely shock the enemy; (2) High-Value Targets (HVTs) \u2013 key personnel or assets whose disruption cripples enemy operations; (3) Mass-Effect Targets \u2013 attacks designed to maximize casualties and terror (large-scale bombings or coordinated assaults); (4) Recognizability Targets \u2013 symbolic sites or leaders whose attack has outsize political or cultural impact; and (5) Running Targets \u2013 opportunistic hits on troops or convoys. Each mode reflects different motivations and tactics.","tags":["Target Selection","Terrorist Strategy","Ambush","Casualties","Symbolic Attack"],"summary":"Lists five surprise target types (HPT, HVT, Mass-Effect, Recognizability, Running) used by terrorists to maximize shock and impact, describing each mode\u2019s characteristics."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Doctrine","text":"The concept of Propensity is broken into four variables (Movement, Tactics, Target, Time) abbreviated MTTT. Sudden changes in any of these can cause surprise. For example, an unexpected change in enemy movement (new approach routes) or tactics (switch to suicide attacks instead of rifles) can invalidate intelligence. Similarly, changing targets (attacking a less-defended location) or timing (attacking much earlier or later than predicted) drives surprise. MTTT provides a structured way to analyze and predict how adversaries might alter their plans in these four dimensions.","tags":["MTTT","Propensity","Threat Variables","Enemy Adaptation","Surprise Attack"],"summary":"Introduces the MTTT framework (Movement, Tactics, Target, Time) as the set of variables whose unexpected changes by the adversary generate tactical surprise."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Doctrine","text":"Each MTTT factor can directly trigger surprise: \u201cUnexpected Movement\u201d means the enemy shifts approach at the last minute; \u201cUnexpected Tactics\u201d means using methods (e.g., suicide bombers) outside predicted patterns; \u201cUnexpected Target\u201d means hitting a different, softer objective than expected; \u201cUnexpected Time\u201d means attacking at a non-predicted time. Any of these unpredictable shifts can undermine even accurate intelligence, so planning must anticipate changes in movement, tactics, targets and timing.","tags":["Surprise","MTTT","Enemy Tactics","Adaptive Strategy","Intelligence Limitations"],"summary":"Explains how unexpected changes in each MTTT variable (movement, tactics, target, time) by the enemy cause true surprise and upset planning assumptions."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Doctrine","text":"High-Priority Targets (HPTs) are adversaries with a known history of threatening terrorist operations (e.g., a prominent commander). These are targets that terrorists are willing to sacrifice heavily to attack, even if they are well-defended. HPT assaults involve concentrated group attacks with automatic weapons, aimed at penetrating the target\u2019s strong defenses quickly. The goal is to achieve surprise by exploiting complacency under high security (for example, an ambush inside a fortified command post):contentReference[oaicite:0]{index=0}.","tags":["High Priority Target","Ambush","Security Lapse","Leadership","Motivation"],"summary":"Describes High-Priority Targets (e.g., key leaders) and how attackers mount sudden, forceful assaults despite heavy security to achieve surprise."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Doctrine","text":"High-Value Targets (HVTs) are key figures or assets critical to enemy operations (plans, supply, intelligence). Terrorists often attack mobile or accessible HVTs rather than fortified installations, using ambush tactics with automatic weapons. An HVT strike might target a moving convoy or patrol containing a high-value officer. These attacks exploit the target\u2019s operational importance and typically involve hitting a target where it is unexpectedly vulnerable:contentReference[oaicite:1]{index=1}.","tags":["High Value Target","Ambush","VIP Attack","Operational Node","Intelligence"],"summary":"Defines High-Value Targets as critical enemy figures/assets; explains they often attack on the move via ambushes, leveraging the target\u2019s operational importance."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Doctrine","text":"Mass-Effect Targets are designed to inflict maximum casualties and psychological impact (for example, large-scale IED attacks). Running Targets involve sporadic, opportunistic strikes on troops or convoys from multiple directions using small arms and IEDs, intended to harass and demoralize over time. Recognizability Targets involve attacks on symbolic locations or high-profile individuals (e.g., at religious sites or public monuments). Such attacks (often suicide bombings) aim for high social or political impact despite limited scale:contentReference[oaicite:2]{index=2}:contentReference[oaicite:3]{index=3}:contentReference[oaicite:4]{index=4}.","tags":["Mass Casualty","Guerrilla Attack","Symbolic Target","Suicide Bomb","Public Morale"],"summary":"Combines Mass-Effect, Running, and Recognizability target types: explaining large casualty attacks, random hit-and-run ambushes, and symbolic attacks (often suicide) on civilians or landmarks."}
{"source":"ATTN LAW ENFORCEMENT HOW TO AVERT SURPRISE ATTACK BY CRIMINAL OR ENEMY (1).pdf","category":"Doctrine","text":"MTTT analysis should be used proactively. Analysts review six-plus months of historical enemy activity (movement patterns, tactics used, targets chosen, timing) to predict possible changes in adversary plans. Incorporating these surprise indicators into planning reduces errors in anticipating enemy actions:contentReference[oaicite:5]{index=5}:contentReference[oaicite:6]{index=6}. The text emphasizes that even accurate intelligence can fail if situational awareness is wrong; leaders must explicitly plan for unexpected shifts in MTTT variables to avoid surprise.","tags":["MTTT Analysis","Predictive Planning","Historical Trends","Situational Awareness","Surprise Planning"],"summary":"Recommends using historical MTTT analysis in planning to anticipate unexpected changes, and notes that even accurate intelligence requires preparation for surprise to avoid mission failure."}
{"source":"intel_battle_plan_doctrine.pdf","category":"Doctrine","text":"Situation: Organized drug networks function as adaptive, networked adversaries with cell leadership, logistics, protection, and local support. They exploit communications and community networks to operate covertly. Current counter-drug efforts are often reactive and rely on isolated leads. To counter this, forces must treat intelligence as a primary combat arm and proactively shape the environment. Mission: Establish and maintain a persistent intelligence posture that identifies, shapes and degr...
","tags":["Drug Networks","Intelligence Operations","Proactive Strategy","Interagency","Civilian Rule of Law"],"summary":"Describes how drug networks act as adaptive, information-savvy adversaries, and sets the mission to use continuous intelligence operations to systematically disrupt them lawfully."}
{"source":"intel_battle_plan_doctrine.pdf","category":"Doctrine","text":"Commander\u2019s Intent: Purpose \u2013 Reduce the operational reach, coordination and control of organized drug networks. Method \u2013 Employ continuous, multidisciplinary intelligence collection and analysis (reports, open-source info, lawful investigations, authorized technical means) to identify key decision nodes and vulnerabilities; then execute coordinated non-kinetic and lawful enforcement measures to disrupt them. End State \u2013 Networks are disrupted, key decision-makers are removed or neutralized through lawful means, and community safety and the rule of law are measurably improved.","tags":["Commander\u2019s Intent","Network Disruption","Intelligence Fusion","Lawful Enforcement","Community Safety"],"summary":"Specifies the commander\u2019s intent: continuously gather and act on intelligence to disable the key nodes of the drug network through lawful means, achieving network dismantlement and safer communities."}
{"source":"intel_battle_plan_doctrine.pdf","category":"Doctrine","text":"Concept of Operations (Phased): Phase I (Prepare/Shape) \u2013 Build an integrated intelligence picture from multiple lawful sources; establish command structures and legal oversight; define objectives, success metrics and risk measures. Phase II (Detect & Analyze) \u2013 Maintain continuous, layered analysis to spot patterns and precursors of drug activity; produce prioritized intelligence products (threat assessments, target nominations) that guide planning. Phase III (Disrupt) \u2013 Use intelligence to coordinate lawful actions (investigations, prosecutions, financial disruption, regulatory measures) across agencies; ensure timing and authority are synchronized. Phase IV (Consolidate & Hold) \u2013 After disruption, follow up with sustained law enforcement presence, community engagement and social services to prevent network reconstitution; institutionalize lessons learned into doctrine and training.","tags":["Operations Phases","Intelligence Fusion","Threat Detection","Lawful Enforcement","Stability Operations"],"summary":"Outlines the phased operation: 1) prepare with fused intelligence and planning, 2) detect patterns and generate intel products, 3) disrupt networks via coordinated enforcement, and 4) consolidate gains with community and stability measures."}
{"source":"intel_battle_plan_doctrine.pdf","category":"Doctrine","text":"Tasks (conceptual roles): Intelligence Element \u2013 integrate multi-source analysis, maintain legal evidence chains, and advise commanders on information needs. Operations/Enforcement Element \u2013 coordinate lawful actions based on intelligence, ensure all actions have proper legal authority and oversight, and provide visible, accountable enforcement to stabilize operations. Investigations/Prosecution Element \u2013 convert intelligence into admissible evidence and coordinate timing of actions to preserve evidence and due process. Counterintelligence/Oversight Element \u2013 monitor adversary intelligence threats, enforce legal/ethical safeguards, and protect sources. Civil Affairs \u2013 maintain communication with affected communities and provide interventions to reduce demand. Logistics/Support \u2013 provide technical and legal support, and ensure data systems are secure and compliant.","tags":["Organizational Tasks","Interagency","Intelligence Role","Legal Oversight","Community Support"],"summary":"Lists the roles of different elements: how intelligence, operations, investigations, counterintelligence, civil affairs, and logistics teams each contribute to the counter-drug effort."}
{"source":"intel_battle_plan_doctrine.pdf","category":"Doctrine","text":"Command & Coordination: Establish a clear, lawful chain of command for intelligence production and operations. Use a fused center or joint cell for shared situational awareness and deconfliction. Embed legal counsel in all phases where investigative or enforcement action is considered. Rules/Ethics/Legal: All collection, analysis and operations must comply with domestic law and human rights; minimize civilian harm; maintain oversight. Maintain audit trails of decisions, collections and actions. Risk Management: Identify major risks (civilian harm, legal exposure, community erosion, adversary retaliation). Apply mitigation: legal review of tactics, transparency to oversight, community liaison, evidence protection. Continuously reassess risks before, during and after operations.","tags":["Chain of Command","Fusion Center","Legal Compliance","Risk Management","Civilian Protection"],"summary":"Emphasizes lawful command structure and oversight, strict legal/ethical rules, and ongoing risk management (civilian harm, legal exposure, etc.) in the operation."}
{"source":"intel_battle_plan_doctrine.pdf","category":"Doctrine","text":"Measures of Effectiveness: Track indicators like reduced violent incidents and public harm attributable to targeted networks, increased lawful prosecutions from sustained intelligence, and decline in network capacity indicators (e.g., disrupted logistics, reduced coordination signals) based on aggregated analysis:contentReference[oaicite:7]{index=7}. Also monitor improved community confidence and cooperation with authorities. Intelligence Principles: Persistency \u2013 intelligence collection and analysis must be continuous, not merely reactive. Fusion \u2013 combine multiple lawful sources for a comprehensive, defensible picture. Proportionality \u2013 choose responses that fit the objective and minimize collateral harm. Accountability \u2013 record and justify decisions and maintain auditable evidence chains. Adaptability \u2013 regularly update methods based on adversary adaptation and oversight feedback.","tags":["Effectiveness Metrics","Intelligence Principles","Adaptability","Accountability","Community Confidence"],"summary":"Specifies success metrics (reduced incidents, more prosecutions, network degradation, community trust) and key intelligence principles (persistent collection, multi-source fusion, proportionality, accountability, adaptability)."}
{"source":"intel_battle_plan_doctrine.pdf","category":"Doctrine","text":"Training & Organizational Change: Train multidisciplinary teams in legal collection methods, open-source analysis, evidence handling, and interagency coordination. Establish standing intelligence support units within enforcement agencies to provide commanders with timely, lawful assessments. Institutionalize after-action learning loops to refine doctrine; adapt training and policy based on lessons learned. Emphasize organizational change to build a culture of intelligence-led, lawful enforcement.","tags":["Training","Interagency Cooperation","Legal Intelligence","After-Action Review","Organizational Change"],"summary":"Recommends training and structural reforms: train multi-skilled intelligence teams, establish permanent intel support cells, and use lessons learned to update doctrine."}