Building an Intelligence Collection Plan

No two internet investigations are the same. A corporate due diligence investigation requires different information from an executive protection assessment. A missing person enquiry has very different priorities from an insurance fraud investigation or an organised crime operation. Despite these differences, the process of planning intelligence collection remains remarkably consistent.

Before any searches are conducted, analysts should develop a collection plan. This acts as a roadmap for the investigation, ensuring that collection activities remain focused on the intelligence requirement rather than becoming an exercise in gathering as much information as possible.

A well-designed collection plan identifies the questions that need answering, the information required, the most appropriate sources, and how the findings will be recorded and evaluated. It also helps investigators avoid unnecessary work, identify intelligence gaps and demonstrate a structured approach should the investigation later come under scrutiny. While collection plans vary between organisations, most follow the same core principles.

Step 1: Define the objective

Every collection plan begins with a clearly defined objective. This should describe the decision that the intelligence will support, rather than simply the subject of the investigation.

For example:

• Assess whether an individual poses a credible threat to a company executive.
• Identify the organisers of a protest planned for next month.
• Determine whether a supplier presents financial or reputational risks.
• Identify the owner of an online account.
• Support an insurance fraud investigation.
• Locate potential witnesses to an incident.
• Identify assets belonging to a debtor.
• Develop an intelligence picture of an organised crime group.

A vague objective such as "Research John Smith" provides little direction. A specific objective immediately shapes the collection process and helps determine which information is relevant.

Step 2: Define the intelligence requirements

Once the objective has been agreed, break it down into the questions that need answering. These become the intelligence requirements. For an executive protection assessment, the requirements might include:

• Does the subject have a history of violence or threatening behaviour?
• Can the subject be linked to extremist groups?
• Does the subject know where the executive lives or works?
• Has the subject discussed attending future events?
• Are there indicators that the threat is escalating?

For a due diligence investigation, the questions would be entirely different. By defining the questions first, analysts avoid collecting information that has little bearing on the final assessment.

Step 3: Think in entities

One of the simplest ways to structure an investigation is to think in terms of entities. Almost every intelligence investigation revolves around a relatively small number of entity types, each with its own attributes and relationships.

People

Depending on the investigation, relevant information may include:

• Full legal name
• Aliases and previous names
• Date of birth
• Current and previous addresses
• Email addresses
• Telephone numbers
• Social media usernames
• Employment history
• Family members and associates
• Vehicles
• Languages spoken
• Hobbies and interests
• Photographs and physical description

Not every investigation requires every attribute. The objective should determine what is collected.

Businesses and organisations

Relevant information may include:

• Legal name
• Trading names
• Company number
• Registered address
• Operational locations
• Directors and officers
• Persons with Significant Control (PSCs)
• Parent and subsidiary companies
• Employees
• Contact details
• Websites
• Social media accounts
• Brands and logos

Locations

Locations are often just as important as people. Depending on the investigation, consider collecting:

• Address
• Coordinates
• Satellite imagery
• Street-level imagery
• Public CCTV
• Recorded crime
• Local news
• Nearby transport links
• Businesses
• Previous planning applications
• Known associates linked to the address

Events

Many investigations revolve around planned or historical events. Useful attributes include:

• Date and time
• Venue
• Organiser
• Expected attendees
• Speakers or performers
• Estimated attendance
• Security arrangements
• Previous incidents
• Crowd sentiment
• Funding or sponsors

Thinking in entities ensures collection remains organised and makes it easier to identify relationships later during analysis.

Step 4: Identify the best sources

Once the intelligence requirements and entities have been identified, the next step is selecting the most appropriate sources.

These may include:

• Internal intelligence systems
• Social media
• Public records
• Company registers
• Court records
• Commercial intelligence platforms
• News reporting
• Financial records
• Government publications
• Mapping services
• Satellite imagery

Different sources provide different levels of reliability, coverage and timeliness. Rather than relying on a single source, analysts should seek opportunities to corroborate important findings wherever possible.

Step 5: Choose your collection methods

Having identified the sources, decide how information will actually be collected. Collection methods might include:

• Search engine research
• Database queries
• Social media searching
• Reverse image searching
• Username enumeration
• Geospatial analysis
• Historical website analysis
• Document analysis
• AI-assisted research
• Manual review

The choice of method should always reflect the intelligence requirement rather than simply using familiar tools.

Step 6: Identify intelligence gaps

No investigation begins with complete information. As collection progresses, analysts should continually identify what remains unknown. Some questions may prove impossible to answer through publicly available information. Others may require additional sources, specialist support or further collection.

Rather than viewing these gaps as failures, they should be documented. Intelligence gaps often become recommendations for future collection and help decision-makers understand the limitations of the assessment.

Step 7: Validate your findings

Collection should never end with simply finding information. Before relying upon any source, analysts should ask:

• Can this information be corroborated?
• How reliable is the source?
• Is the information current?
• Could it have been manipulated?
• Does it answer the intelligence requirement?

Only after information has been evaluated should it be incorporated into the assessment.

Step 8: Capture and manage evidence

Information has little value if it cannot be located or justified later. Throughout the investigation, analysts should capture sufficient information to support their findings. This may include:

• URLs
• Screenshots
• Archived webpages
• Dates and times of collection
• Intelligence grades
• Notes explaining analytical decisions
• Copies of relevant documents
• Metadata where appropriate

Maintaining good records improves transparency, supports peer review and allows the investigation to withstand future scrutiny.

Step 9: Plan the next steps

A collection plan should conclude by considering what happens after collection. Questions worth asking include:

• Have the intelligence requirements been answered?
• What intelligence gaps remain?
• Are additional collection activities required?
• Does the information support operational action?
• Should the investigation move into analysis or continue collecting?

Collection planning should remain a living process throughout the investigation rather than a document completed once and forgotten.

A simple collection planning template

Although organisations develop their own formats, most collection plans contain similar information.

Objective	Intelligence Requirement	Entity	Source	Collection Method	Priority	Status
Identify whether the subject poses a threat	Does the subject have a history of violence?	Person	Court records	Public record search	High	Complete
Assess capability	Does the subject own vehicles?	Person	DVLA, Social media	Database search	Medium	In Progress
Identify likely locations	Where does the subject spend most of their time?	Location	Social media, Electoral roll	Public record search	High	Pending

This type of matrix provides structure without becoming overly complicated and can easily be adapted to suit investigations of any size.

Good investigations begin with good planning

Experienced analysts rarely begin by opening a search engine or logging into a database. They begin by deciding exactly what they need to know and how they intend to obtain it.

A well-constructed collection plan keeps investigations focused, improves efficiency and ensures that every search contributes towards answering the intelligence requirement. It also provides a clear audit trail, making it easier to explain why particular sources were used, how decisions were reached and where important intelligence gaps remain.

Ultimately, a collection plan helps analysts to collect the right information in a structured, defensible and repeatable way.