While the intelligence cycle itself is well established, the difficulty lies in a mismatch between how intelligence operates as a connected, evolving system and how most environments are designed as fragmented, case-based systems.
Criminal networks operate as connected systems, and intelligence teams are expected to understand and disrupt them.
That means tracing how people, events, assets and organisations relate to one another, across investigations and over time. While the intelligence cycle itself is well established, the difficulty lies in a mismatch between how intelligence operates as a connected, evolving system and how most environments are designed as fragmented, case-based systems.
Across forces, particularly where investigations draw on multiple sources and systems, the same constraints recur. Information is fragmented. Tools operate in isolation. Exploring connections at depth becomes slow and technically demanding. New material requires preparation before it can be examined, and as complexity increases, the strain on workflows becomes more visible.
Individually, these issues can be managed. Together, they create persistent friction that slows organisations’ ability to produce timely intelligence, limits how fully relationships can be explored, and reduces the effectiveness of AI, which benefits from connected, well-contextualised data rather than fragmented inputs.
This article examines five structural constraints that consistently hinder intelligence work, and why addressing them matters if teams and agencies are to keep pace with constantly adapting criminal networks.
Where friction enters the intelligence cycle
1. Data is spread across multiple systems
In practice, collecting data is rarely the problem. The challenge lies in connecting and contextualising what has already been gathered.
Case management systems, intelligence reports, communications data, digital forensics extractions, financial intelligence, and open-source material are typically held across separate environments, each with its own access routes, formats, and restrictions.
Before meaningful analysis can begin, analysts must identify what is relevant, retrieve it from multiple sources, and assemble it into a usable view. That effort is essential, but it takes time and must often be repeated whenever a new line of enquiry emerges.
As a result, significant energy is spent assembling the picture before the relationships within the data can be properly examined. Each investigation ends up reconstructing context that already exists elsewhere, rather than building on a shared and evolving intelligence picture.
2. Analysis is split across different tools
Even once relevant data has been identified and gathered, the analytical work itself is often fragmented across multiple tools.
Analysts often have to extract data from source systems, reshape it for one tool, export the results and reformat them to combine with other data. This pattern repeats across the workflow, with each step loosely connected rather than part of a single analytical environment.
When analysis is fragmented like this, shared context becomes harder to preserve. Reasoning can be difficult to trace, collaboration becomes more complicated, and teams end up repeating work because the full picture is not available in one place.
This reflects a broader pattern where work is organised around individual investigations rather than a shared, persistent intelligence picture.
3. Exploring deeper connections becomes difficult
Many intelligence questions require going beyond direct links.
It’s rarely enough to know that two individuals are connected. The more important question is how that connection fits within a wider network. Who else is involved? What infrastructure is shared? How does money or communication flow across the group?
Most policing systems are built to store records efficiently. They’re less suited to exploring multiple layers of relationships across time and data sources.
As queries become more complex, they become slower and harder to manage. In practice, time and system constraints mean it’s not always possible to explore connections beyond the immediate, increasing the risk that wider relationships within the network remain unseen.
4. Datasets require repeated preparation
Investigations rarely follow a fixed template. Each one can introduce new data that was not anticipated at the outset.
A device download, a partner agency spreadsheet, or a financial dataset may need to be examined quickly. These sources often arrive in formats that do not align neatly with existing systems.
Analysts must check reliability, reconcile names and identifiers, standardise formats, and load the data into their working environment before meaningful analysis can begin.
This preparation work is repeated throughout an investigation and across cases, even when similar data has already been processed in previous investigations.
5. Increasing volume adds pressure to manual processes
Modern investigations involve large data volumes. Communications records alone can reach a substantial scale. Add financial transactions, surveillance logs, and open source material, and complexity rises further.
At the same time, much of the intelligence lifecycle still relies on manual handling. Information has to be reviewed, assessed, and structured before conclusions can be drawn and reports produced.
When large volumes of fragmented data intersect with systems that require repeated manual effort, analytical time is reduced. The effort required to manage data begins to compete with the effort required to interpret it. At scale, this limits not just analyst productivity, but the organisation’s ability to maintain a coherent, up-to-date view of how criminal networks evolve.
The risk for policing in an adaptive threat landscape
Individually, these frictions can be worked around. Analysts do it every day. The challenge is that criminal networks do not stand still. Roles can change after arrests. Communication patterns shift to avoid detection. Financial routes are redirected. Infrastructure that supports one form of criminality can reappear in another form, and new actors may enter existing structures.
These changes rarely reveal themselves in single records. They become visible through patterns in relationships and how those relationships evolve over time.
Without tools that maintain visibility of those changing relationships, analysts are forced into repeated cycles of reconstruction, limiting continuity of intelligence across investigations. When every new lead requires rebuilding context to understand how it fits the wider picture, depth is sacrificed for speed.
In slower or less complex environments, that delay may have a limited impact. In fast-moving and adaptive networks, it can narrow visibility at precisely the moment broader awareness is needed.
What structural alignment looks like
Addressing these constraints does not mean redesigning the intelligence cycle or changing established tradecraft. It means ensuring the systems supporting that work reflect its relational nature.
In practical terms, that means:
- If intelligence analysis depends on understanding how entities connect and how those connections evolve, then those relationships need to be a core part of the data model and persist across investigations, rather than being reconstructed for each case.
- If investigations regularly introduce new material, analytical environments need to absorb it without structural disruption so that new information extends the existing context rather than creating disconnected views.
- If operational questions require exploring several degrees of separation, that depth needs to be accessible without becoming technically burdensome.
Reducing friction is therefore not simply about working faster. It is about structuring environments so they support cumulative, connected analysis. Systems should allow context to persist across cases and teams, reasoning to build progressively, and connections to remain visible as cases develop.
When that foundation is in place, analysts spend less time constructing the picture and more time testing assumptions, identifying structural patterns, and recognising how networks evolve. Professional judgement remains central, but it is exercised with greater continuity and clearer visibility.
Intelligence systems must evolve with the threat
Criminal networks adapt through relationships. Intelligence work depends on understanding those relationships, across time, cases and evolving structures. Environments that fragment context or limit relational exploration make that work harder than it needs to be.
As criminal networks become more distributed and adaptive, systems that limit how connections can be explored risk narrowing analysts’ visibility.
To keep pace with adaptive networks, intelligence environments need to move beyond supporting individual investigations to building a shared, evolving intelligence foundation. Only then can organisations retain context, understand change over time, and respond with the depth and speed required.
For organisations looking to move from fragmented, case-based workflows to connected intelligence environments, further detail on graph-powered intelligence analysis and its practical application in policing is available in our ebook, Three Steps to Intelligence Led Policing.
