A Thoughtful, Analytical Approach to NGO Security

Analytical Techniques

Analysis of Competing Hypotheses Software

I came across a very useful little piece of software last week while I was grappling with a particularly sensitive analytical problem. I couldn’t afford to be wrong and I was worried that my biases might mislead me. With that in mind I decided to use Analysis of Competing Hypotheses (ACH). Unfortunately there were so many little bits of evidence that the pen and paper method soon bogged down. A quick search on Google however led me to PARC ACH.

PARC ACH is a rather utilitarian little piece of software. There is no glitz. The UI is basic. Little glitches are inclined to spring up. I can’t seem to get it to print on my MacBook Pro. But what it does it does well.

Screenshot of PARC ACH software

The dirty work of ACH is much easier with the PARC software. It handles both inconsistency and weighted inconsistency scores. You can sort evidence by order addedd, diagnosticity, type, credibility, relevence, or even user criterion. Best of all it comes with a built in ACH tutorial that will guide you through the process if you are a newbie or just a little rusty.

If you hooked your laptop to a large screen monitor or multimedia projector PARC ACH would make a good collaborative tool. The whole team could readily see the effects of changes without being slowed by the need for someone with neat handwriting.

Did I mention that it is free?

Learning to Think Analytically with Video Games

According to Wired US intelligence agencies are using custom video games to teach analytical thinking. Despite what the graphics might suggest the games' emphasis is on critical thinking skills and the use of the analytical process rather than violence.

I'd love to see an NGO version of something like this. It shouldn't be too hard to come up with an interesting story with a humanitarian slant that would challenge the players reasoning. Perhaps based on Darfur with the player attempting to shift through opposing claims and counter claims. Or how about a scenario based in Gaza?

Only the eight principles of intelligence analysis can save him? Oh my Gawd! I don't remember them! I'm hoping that its Richards J. Heuer's eight step Analysis of Competing Hypotheses otherwise little DIA dude is doomed.

Black Swan Lessons - You Can't Graph the Future

Something about most UN and NGO security reports has always made me uneasy. Don’t get me wrong. It’s not that they aren’t thorough. A lot of work goes into fact checking and ensuring that what they say is ’correct’. It’s just that the typical security report is a comprehensive list of recent past incidents combined, if we are lucky, with their assessed causes. Incident statistics are then charted and 'trends' are identified. This always made me a little nervous.

To be fair I never really knew why it made me nervous until I read “The Black Swan”. Nicholas Taleb raises several points that help explain my unease.

The first is that more information is not necessarily better. Its very easy to get bogged down in detail that has no real relevance to the issue at hand.

The second factor is what Nicholas calls the Ludic Fallacy. In brief this is the assumption that the unexpected can be predicted by extrapolating from statistics based on past observations. Nicholas argues that while this holds true for theoretical models based on games of chance it seldom holds true in the real world for the following reasons:

We don’t know what we don’t know. (See the Unknown Unknown)
Very small (perhaps imperceptible) changes in the variables can have a huge impact in the outcome. This is commonly referred to as the Butterfly Effect.
Theories based on experience are fundamentally flawed as events that have not occurred before (or are outside living memory) cannot be accounted for.

The Washington Post graphic below, which shows the frequency and lethality of suicide attacks since 1981, illustrates the problem. If we had examined the chart in 2000 would it have led us to predict 9/11(a classic Black Swan)? If we had re-examined it in 2003 would it have led us to predict the sudden increase in the frequency of attacks in 2007? What does 2007 tell us about 2008? Looking at the trend from 1981 to 1989 how many researchers would have concluded that suicide attacks were in decline and opined that such attacks were ineffective in accomplishing the attackers goals.

Darfur, Afghanistan, Beer, and Breakfast

Google Trends can be a useful tool for context analysis. If you've ever wondered why your security budget is dwindling despite the rise in security incidents or why the head office seems to have forgotten you it can be a pretty useful tool.

For those who haven't seen it before Google Trends compares the relative Google search frequency of up to five user specified terms. For example if you want to compare relative search interest in various hot beverages you might enter "coffee, tea, cocoa" and press search. Google Trends returns a nice neat chart that shows how many searches were made for each term over time. It also shows a "news reference volume" chart, or in other words the frequency with which the term has shown up in the media.

Relative frequency of search terms Darfur, Iraq, Afghanistan, Congo and Sweden

The chart above was generated when I compared relative interest in Darfur, Iraq, Afghanistan, and the Congo, with Sweden as a control.
The results were pretty interesting. Searches for Iraq seem to correspond with increases in media coverage. No surprises there. The big surprise for me was Sweden. Google user are more interested in Sweden than they are in Darfur, Afghanistan, and the Congo. Talk about forgotten conflicts!

Flag B is interesting. It marks George Bush's call for more NATO troops in Afghanistan and clearly shows an increase in media coverage of Afghanistan. It even overtook coverage of Iraq for a short while. However, the general public took no notice.

Headlines associated with country comparison

Relative search frequency by region

The regions chart is enlightening. Americans are predominantly interested in Iraq and seem to have forgotten about Afghanistan. The Canadians, who have troops in Afghanistan but not Iraq seem equally interested in both countries. And finally, the Swedes seem to be totally obsessed with Sweden.


Not without trepidation replaced Sweden with "beer" in my search terms. I shouldn't have. I now know that your average computer using westerner is more interested in beer than they are in Iraq and Afghanistan combined. "Darfur?... never heard of it... do they have good beer?"

If you are feeling particularly masochistic try breakfast or worse boobs. For a brief while in 2004 your average Google user was more interested in what was happening in Iraq than what they were going to have for breakfast. That aberration hasn't repeated itself since. Its also interesting to note that while American's seem equally fascinated by Iraq and breasts, Canadians have a distinct preference for the later.

Pakistan: Shifting Targets?

Kidnapped Aid Workers Reportedly Killed in Afghanistan

Aid workers Cyd Mizell and Muhammad Hadi have apparently been killed in Afghanistan according to this statement by Asian Rural Life Development Foundation. The pair had been kidnapped by armed men in Kandahar while they travelled to work in the morning.

Our prayers are with the families and friends of Hadi and Cyd.

A Periodic Table of of Visualization Methods

Visual-literacy.org has a great periodic table of visualization methods. You can find something here to help tackle the most complex of analytical problems.

table of visualization methods
Periodic Table of Visualization Methods

Thanks Rick!

Smart Clothes for Disaster Relief

Disaster relief workers may soon benefit from a new 'smart' suit being developed by I-Garment. The suit is intended to help remedy safety and communications problems faced by fire fighters but I can see its utility for humanitarian disaster response as well.


The suit is intended to address three familiar problems;

1. the unavailability of standard communications means during disasters,
2. the lack of information as to the whereabouts and safety of relief workers during emergency efforts, and
3. the problem of acquiring and distributing timely geospatial data during an emergency.


If one were to combine the suit with CSIRO’s proposed power generating shirts it could even be self powered.

Twitter Tracking for Security and an Answer

Twitter has added the ability to track keywords. Now whenever someone sends a public update containing your word or phrase of interest you’ll receive a copy of the update. How is this useful for NGO security officers? I’m currently tracking several towns in trouble areas, Tsunami, and a variety of other keywords. You’re only limited by your creativity. One word or warning though: you’ll get ALL public updates with the search term, even ones in languages you don’t speak.

I've also finally added the solution to our geographic distribution analysis problem.

Geographic Distribution Analysis Tools - Old School

You don’t need the latest and greatest GIS program to do Geographic Distribution Analysis. While working in the Allai valley after the Kashmir earthquake we initially used a hand drawn map to plot community sizes and locations, IDP movements, NFRI distribution data, helicopter landing zone locations, and security incidents. The original map was reproduced by the simple expedient of tracing it on to new paper. For several weeks it was the most accurate and most used map of the valley.

How to make an all-weather, no power, low failure, Geographic Distribution Analysis system.

Step 1 - Assemble the following items:

• A map of the appropriate area
• Clear transparent self-adhesive laminate – Sometimes it is sold as shelf paper in the house wares section of department stores. Con-Tact or any similar brand will work.
• Chinagraph pencils – Also known as grease markers, Chinagraph pencils can be used on almost any surface, including Con-Tact paper.
• Paper – Ruled paper makes creating sketch maps easier.
• Toilet paper
• A large re-sealable plastic freezer bag.

Step 2 - Cover the map with the laminate. Its easier if you work with a partner. Cut a piece of laminate slightly larger than the map. Separate the laminate from its backing and slowly lower the laminate onto the printed side of the map. You’ll need to let it sag slightly in the middle so that your partner can press the laminate to the map starting at the centre and working slowly to the edges. If you practice a couple of times on a large sheet of paper you should be able to do it without trapping any air bubbles or making a lot of wrinkles.

You’ll now be able to use the Chinagraph pencils to mark the covered map. The annotations are waterproof but they can easily be removed by rubbing them with a bit of the toilet paper.

Step 3 - Fold the map.

Step 4 - Place everything inside the re-sealable bag.

That's all there is to it. Put the whole thing in your field bag or cargo pant pocket and it'll be ready whenever you need it. You can plot security incidents, checkpoints, IDP locations, damaged infrastructure, photo locations or any other location based data.

Tip: You might be tempted to use permanent markers on your Con-Tact covered map. Don't. The marker will slowly bleed into the soft plastic eventually leaving a permanent stain that even rubbing alcohol will not be able to remove.

Analysis 101: Geographic Distribution Analysis 2

As Paul pointed out it would be beneficial to compare our office location (the blue square) with the IED incidents. We’ve also added military installations (the green squares) and the primary military convoy routes (marked in orange dashes) as these are likely targets.

Geographic Distribution Example Map 2

A search for more information reveals the following:

You have two small low-key programs operating in town.
The bulk of programming takes place in other areas of the country but staff travelling to the field offices are forced to take one of the major roads.
The main road to the east is the only viable route to access offices in the east.
Local staff travel back and forth to work by public transport or personal vehicles using all the main roads.
International staff travel to and from work in agency vehicles.
The first military convoys of the day are usually between 0600 and 0900.

Analysis 101: Geographic Distribution Analysis

Geographic distribution analysis is a method of examining the occurrence of security incidents or the distribution of entities over a particular geographic area to determine what can be concluded about the incidents or entities. The analysis is usually performed on a map but the final results can also be expressed in a descriptive manner, as in a written report.

To complete a distribution analysis, data on the locations of violent incidents, entities of interest, etc. should be collected and plotted on a map that covers the area in question. Next the map is reviewed to produce a summary and to draw conclusions about what it might mean.

At its simplest geographic distribution analysis might only represent one dataset e.g. a plot of violent incidents on a city map. While this can be useful in itself, as a weekly briefing update perhaps, we can delve much deeper by synthesizing two or more datasets on the same map. We could compare a plot of violent incidents and criminal activities against a plot of proposed office and residence locations. As another example we could compare the locations of narcotic growing areas and smuggling routes with an overlay of violent incidents targeting NGOs.

To illustrate lets look back at our previous problem. As you’ll recall we did a time series analysis of a series of IED attacks. Although we were able to make some basic and tentative conclusions we knew we needed to do further analysis and geographic distribution is a good next step.

After plotting the IED incidents you come up with a map that looks like this.

Geographic Distribution Example Map

What are your conclusions now? Would you change or amplify your advice?

Analysis 101: Time Series Analysis Answers

Earlier in Analysis 101: Time Series Analysis I introduced an analytical problem and asked a few questions. You can find some possible answers here. CtJ also has some hypotheses that might serve as a good starting point for further analysis.

Analysis 101: Times Series Tools

Old School

To do basic time series analysis all you really need is graph paper and a pen or pencil. The down side is that this method is very labour intensive and as the dataset becomes larger most of us can’t cope.

Middle of the Road

The next step up is to use something like Excel. There are some useful free or low cost tools that can simplify time series analysis. In a previous post we saw how to use Excel to do some simple analysis. The sample templates we used are located here.

I’ve developed a Cumulative Security Incident workbook that I use to track longer-term trends. It is available on the downloads page. It’ll produce charts like this one.

casualties by month

Vertex 42 has a free Excel template that can help you create simple timelines. While it might seem to be better suited to presenting a final analytical product it can also be used in the analytical process. Back in the days of the First Gulf War I used a timeline similar to this in an effort to gain a better understanding of Saddam Hussain.. Above the line I plotted significant events in Saddam Hussain’s personal life. Below the line I plotted significant historical impacting Iraq. The exercise proved very revealing and shed light on the man behind the myth.


Some people use Gantt Chart software to do time series analysis but I find it awkward and time consuming.

Bleeding edge

If you are going to do a lot of time series analysis or if you need to analyse large quantities of data you should probably consider a product like Analyst’s Notebook by i2. It can handle a time series of several thousand incidents with relative ease. It is also beneficial in many other types of analysis so you’ll probably here me refer to it again. Be warned though, it is expensive.

Analyst's Notebook

Analysis 101: Time Series Analysis

A time series analysis is a security analysis technique that is used to examine the occurrence of similar security incidents over time. In this case time refers not only to time of day but also day of the week and the day of the month. Longer-term analysis can also include month and season.

By way of example let us imagine that during the past month there have been twelve Improvised Explosive Device attacks in the district where your organization is working. The attacks have occurred at ten separate locations. Victims have included soldiers, police officers, and civilians alike. The only apparent pattern seems to be that the attacks have all taken place on or near main roads. To make matters worse your country director wants to be briefed in four hours.

To aid your analysis we will make a quick Excel chart with the time of day on one axis and the incidents on the other. For each incident we put an X the the row that represents the time of day that the IED attack occurred. The chart should look something like this one.

time series TOD

Examining the chart we see that most of the incidents have occurred between 0600 and 0900. Of these half occurred between 0800 and 0900. We'll highlight these incidents in blue to remind us that they seem to be part of a grouping. There are also four incidents that don't fit the general pattern. We've marked these in red.

With the information you have now what assessment can be made? What would you advise the country director?

Lets take it one step further and make a new chart that plots the incidents against the day of the week.

time series DOW

At first glance there doesn’t seem to be much of a pattern here but on closer examination you'll notice that all of the ‘red’ events that were highlighted earlier fall on a Friday except for one that occurred early on Saturday morning. The remaining events all occurred on weekdays (Friday and Saturday are considered the weekend where you are working).

What does this new information suggest to you? What can you tell the country director? What recommendations can you make? What additional information do you need to seek out? What additional analysis can you do?

The Analysis Gap

There is a real gap in the availability of good analytical training and resources for NGO security officers. Most NGO security manuals introduce the topic by stressing the importance of good analysis and an understanding of the local context. They might then go on to briefly cover actor mapping, and if we are lucky incident plotting. Beyond that the reader is left to his or her own devices.

Admittedly there have been a number of recent analytical studies that examine the patterns of violence against NGOs. These studies come replete with multiple regression analysis and complex equations like this one; "Sec100k = -1.384 + 1.691*BorderPak + -0.00011*Poppy + 0.036*Homeradio". I’m sure these studies are useful for developing policy and keeping underemployed academics out of the soup lines. However, they are unlikely to provide much solace when the country director wants to know how he can safely keep program running despite the recent spate of IED attacks.

In order to try and address these shortcomings I am opening the conversation on security analysis for NGOs. We’ll start with simple, robust, and inexpensive tools and techniques that can be used anywhere under any conditions. We’ll also examine more advanced tools that take advantage of the latest in ICT.

Anyone who wants to share tips and techniques should feel free to do so. It doesn’t matter to me whether you do your analysis on the back of an empty cigarette package under a sputtering lantern or on the latest networked GIS platform in a brightly light office. The goal is to identify and share best practices and to encourage the development of new tools and techniques.

I'll post the first technique shortly.

Data Visualization

Smashing Magazine has an excellent summary of current innovative data visualization techniques that’ll leave your PowerPoint presentations crying in the corner. There are plenty of ideas and links to get the analytical juices flowing. I’ve run across several of the resources before and for me two stand out.

The first is Dr Hans Rosling’s now legendary talk at TED wherein he explains a new approach to presenting complex statistical data. His Trendalyzer software turns decades of complex data into colourful animations that make world trends come to life. He takes mountains of publicly funded information, normally squirreled away in UN data silos, and turns it into knowledge that can be acted upon. Watch the whole video and see if it doesn’t change some of what you think you know.

The second is newsmap. This enlightening application displays the dynamic content of Google News as blocks. The more websites and news services that carry a headline the larger the block becomes. As the creator points out newsmap displays the underlying patterns in the news media, reflecting and highlighting it bias. How is this useful? Well consider this. The headlines that make it onto the newsmap display are the ones that are bombarding the senior decision makers, donors, and general public. Where does your particular issue fit in? Has it made the headlines?


Silobreaker - Online Analyical Tool

Online research can be a great tool but as anyone who has used Google can attest there is a lot of information out there and most search tools just dump out an endless list of links. Sorting through it, discarding the irrelevant, and putting the remainder into some usable form is a task left to the user. Any tool that allows the already busy Security Officer to spend less time searching for information and more time assessing and analysing it is of value. Silobreaker is one of these tools. In the words of Silobreaker, "Silobreaker looks at the data it finds like a person does. It recognises things - companies, people, topics, places - and puts them in context".

While I was testing the public Beta I quickly discovered its utility. A basic search for the term 'suicide bomber' brought up the type of content you might expect but with some preliminary organization. There was a top stories pane, a search result timeline frame, an entity list, a "Quotes" pane, a more traditional search results list and a network visualization diagram. The sidebar also has a list of entities related to your search; cities, people, companies etc.

Since I'm currently in Sri Lanka I "drilled down", as Silobreaker calls it, to Sri Lanka. The result were now much more relevant and lo and behold there were items of interest and relationship that hadn't captured my attention before.

As one would expect with a Beta there is still some work to be done. Even on my relatively fast connection the site seemed slow at times. One very useful feature that counters the sluggishness is the liberal use of hover overs allowing a quick preview of content before you commit to clicking on a link or entity.

Silobreaker is currently allowing free public access to its online Beta. I recommend you give it a try and see if it meets your needs.

Other Stuff

Subscribe to Patronus in a feedreader
Subscribe to Patronus Analytical RSS Feed by Email

Low on bandwidth? Try this low graphics version

Lijit Search

Bloggers' Rights at EFF Global Voices: The World is Talking, Are You Listening?

Support CC - 2007

Creative Commons License
This work by Kevin Toomer is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 2.5 Canada License.
Jun 2008
May 2008
Apr 2008
Mar 2008
Feb 2008
Jan 2008
Dec 2007
Nov 2007
Oct 2007
Sep 2007
Aug 2007
Jul 2007