Part 02 — Self-Tasking and Intelligence Requirements

BLUF

The independent analyst operates without the structural function that, in institutional intelligence, defines what counts as a legitimate product: the consumer. There is no J2, no NIO, no policy desk that issued the requirement, will receive the assessment, and will reject it if irrelevant. The independent analyst issues the requirement, executes the collection, performs the analysis, and disseminates the product — all four steps of the Intelligence Cycle executed by the same operator. This chapter specifies the discipline required to prevent that consolidation from collapsing into self-confirmation. Its operative content is a rigorous specification of what constitutes a well-formed Priority Intelligence Requirement under independent conditions, and the procedural countermeasures that prevent self-tasking from drifting into commentary.

The chapter does not re-derive PIR doctrine. JP 2-0, FM 2-0, and the Priority Intelligence Requirements reference note are presupposed. What follows addresses what changes when the analyst is also the consumer.

1. The Tasking Problem

Institutional analysts receive PIRs from above. A combatant command’s J2 issues collection priorities derived from the commander’s decision space. A national-level analyst writes against requirements traceable to a policy customer with an identified decision pending. The requirement is exogenous to the analyst. This is not a bureaucratic feature — it is the structural mechanism by which intelligence is distinguished from research. Intelligence is produced against a question someone other than the analyst needs answered to make a decision.

The independent analyst inherits no such question. The newsletter subscriber, the podcast listener, the OSINT-curious follower on X — none of these constitute a consumer in the doctrinal sense. They have no decision pending against which the analytical product can be measured. They have preferences, attention spans, and engagement metrics. None of these is a PIR.

Assessment (high confidence). Without an external consumer to reject an irrelevant product, the independent analyst loses the primary external feedback loop on whether intelligence requirements map to real decisions. The audience cannot reject the product on relevance grounds because the audience has no operational stake in relevance. Engagement metrics are a signal of audience interest, not analytical utility. An analyst optimizing on engagement is producing a different artifact than an analyst optimizing on decision-relevance; the two artifacts converge only by accident.

Three failure modes follow directly from this structure:

Interesting-not-decision-relevant drift. Self-tasking allows the analyst to work on what is intellectually interesting rather than what is decision-relevant. Institutional analysts are protected from this by the requirement chain; independent analysts are not. The discipline must be installed deliberately.
Diffuse-consumer ambiguity. The market of publication audiences is diffuse. The Russia/Ukraine analyst, the Sahel specialist, the CTI practitioner, and the financial-crime investigator each write for different audiences with different decision domains. Gauging “consumer need” across a diffuse audience requires explicit modeling — who is the decision-maker this product is written against, even if that decision-maker is hypothetical and not a paying customer?
Topic-as-requirement substitution. The independent analyst typically begins with a topic (“Wagner in the Sahel,” “PRC influence operations in Latin America,” “ransomware ecosystem”) rather than a question. Topics are not requirements. Without explicit conversion of topic to question, the analyst produces topic-coverage — a survey of what is known — rather than intelligence — an assessment of what a decision-maker needs to know to act.

The structural distinction this chapter installs is between a research agenda — the long-term topic orientation of an analyst’s practice — and an intelligence requirement — a specific, atomic, time-bounded, decision-linked question extracted from the agenda when triggering conditions justify it. Treating these as the same artifact is the most consequential procedural error in independent practice. Section 3 specifies the distinction operationally.

2. Anatomy of an Analytic Intelligence Requirement

A well-formed PIR under independent conditions satisfies six properties simultaneously. The absence of any one of them is sufficient to disqualify the requirement and return it to the analyst for redrafting. The properties are not stylistic preferences; they are the conditions under which an intelligence product can be evaluated against its requirement at all.

Property 1 — Singular. A PIR addresses one specific question, not a topic or a cluster. “What is the trajectory of Russia-DPRK military cooperation?” is a topic. “Will DPRK deploy a second tranche of personnel to Russian operations against Ukraine before 1 September 2026?” is a singular question.

Property 2 — Atomic. A PIR cannot be decomposed into smaller questions each of which must be answered before the PIR itself can be addressed. If the requirement implicitly demands prior answers to sub-questions, those sub-questions are themselves PIRs and the parent question is a research agenda. Atomicity is what makes collection planning possible.

Property 3 — Decision-centric. A PIR explicitly names what decision will be informed by the answer. For an independent analyst with no formal consumer, the decision-maker is named hypothetically — a national-security policy desk, a corporate security officer, a CTI consumer, a journalist’s editorial decision. The hypothetical decision-maker is not a fiction; it is a discipline. It forces the analyst to write against a real decision shape rather than against audience attention.

Property 4 — Time-bounded. A PIR specifies temporal scope. “Within the next 90 days,” “before the next NATO ministerial,” “during Q3 2026.” Without temporal bounds, the requirement has no closure condition and collection cannot be declared complete.

Property 5 — Falsifiable. The answer to a PIR must be definitively expressible as Yes, No, or a stated conditional. “It’s complicated” is not an answer; it is a refusal to engage the requirement. If the question, properly specified, cannot resolve to a falsifiable assessment under available evidence, the PIR is malformed.

Property 6 — Calibrated to source availability. If the question is not answerable from open sources at any defensible confidence level, this must be flagged at PIR inception, not discovered after collection has been expended. The independent analyst should not commit collection time to requirements that the all-OSINT constraint cannot satisfy. The proper output for such cases is “this PIR is not collectable from open sources at material confidence” — itself a useful analytical product.

2.1 Worked PIR Examples

The discipline is best demonstrated by contrasting malformed and well-formed pairs across the four assessment domains an independent analyst typically operates in.

Geopolitics — offensive timing.

Bad: “What is Russia’s plan for the 2026 summer campaign?” — Failure modes: not singular (encompasses force generation, axis selection, political objectives, escalation thresholds); not atomic; not falsifiable (a “plan” is not a discrete observable); not time-bounded with closure condition.
Good: “Will Russian forces initiate a corps-level offensive operation in the Pokrovsk-Kostiantynivka axis before 1 August 2026, defined as committed forces of brigade strength or larger executing breaching operations against prepared Ukrainian defensive lines?” — Singular (one axis, one operational level, one type of action); atomic (no prior PIR required); decision-centric (informs a Ukrainian operational reserve allocation decision, hypothetically); time-bounded (1 August 2026); falsifiable (Yes/No on observable event with stated definition); collectable from OSINT (commercial imagery, geolocated combat footage, force-disposition reporting).

Geopolitics — strategic indicator.

Bad: “Is China preparing to invade Taiwan?” — Not singular (encompasses force generation, political signaling, intent); not atomic; not falsifiable on any defensible timescale; treats a multi-year decision as a binary event.
Good: “Has the PLA Eastern Theater Command initiated readiness-cycle indicators consistent with a Joint Island Landing Campaign within the next 180 days, defined as the presence of three or more of the following: extended mobilization of reservists in coastal MRs, civilian shipping requisition orders, port-clearing of dual-use vessels, sustained Type 075/071 amphibious force concentration in southeastern ports, and emergency-stockpile drawdown signals?” — Singular question with defined indicator set; time-bounded; falsifiable against named observables; calibrated to OSINT (commercial imagery, AIS, PRC official notices, Taiwan MND reporting).

Cyber CTI — infrastructure deployment.

Bad: “What is APT28 doing now?” — Topic, not requirement.
Good: “Has the cluster tracked as APT28/Forest Blizzard deployed new staging infrastructure using the ‘Headlace’ implant family against NATO-state defense-industrial targets between 1 January 2026 and the date of this assessment, where ‘new infrastructure’ is defined as domains or IPs not previously published in CERT-EU, Microsoft MSTIC, or Recorded Future reporting?” — Singular cluster, named TTP, named target set, time-bounded, falsifiable, OSINT-collectable (passive DNS, certificate transparency, vendor reporting, sandbox telemetry from Triage/ANY.RUN, MISP/OpenCTI feeds).

Cyber CTI — capability question.

Bad: “Are ransomware groups using AI?” — Not singular, not falsifiable, not atomic.
Good: “Among the top-ten ransomware affiliates by victim count tracked on DLS sites between 1 January and 1 May 2026, is there observable evidence in leaked-internal-comms (Conti-style leaks), affiliate-recruitment posts on RAMP/Exploit, or victim-recovery telemetry that LLM-assisted social engineering is being operationally deployed at the initial-access stage?” — Defined population, defined evidence channels, defined stage of the kill chain, time-bounded.

Financial crime — corporate structure.

Bad: “Who really owns Company X?” — Topic. Beneficial-ownership questions are typically multi-PIR research agendas.
Good: “Does the ultimate beneficial owner of [Cyprus-registered entity X] include any natural person designated under EU Council Regulation 269/2014, on the basis of corporate filings retrievable from the Cyprus Registrar of Companies, OpenCorporates, OCCRP Aleph, and leaked-records databases (Pandora Papers, ICIJ Offshore Leaks, FinCEN Files) as of [date]?” — Named entity, named designation regime, named source set, time-bounded, falsifiable, OSINT-collectable (with explicit recognition that the answer may be “indeterminate from available filings,” which is itself a defensible analytical output).

Financial crime — sanctions evasion typology.

Bad: “How is Russia evading sanctions?” — Encyclopedia article, not PIR.
Good: “Within the dataset of EU-flagged vessels conducting STS transfers in the Lakonikos Gulf between 1 March and 1 May 2026 (per AIS and commercial-imagery confirmation), what proportion is operationally linked — via shared manager, shared P&I club, or shared beneficial-ownership documentation — to entities sanctioned under OFAC SDN or UK OFSI Russia regimes?” — Defined dataset, defined linkage criteria, defined sanctions regimes, time-bounded.

Fact-checking / verification.

Bad: “Is the video of the strike real?” — Underspecified. “Real” how — authentic capture, accurate caption, correct attribution, contemporaneous timestamp?
Good: “Does the video circulated on Telegram channel [X] on [date] depicting an alleged strike on [target] (a) geolocate to the claimed location, (b) chronolocate to within 24 hours of the claimed strike time on the basis of shadow analysis and weather correlation, and (c) correspond to a strike event reported by either the Ukrainian General Staff or Russian MoD on the claimed date?” — Three separable, falsifiable sub-claims, each independently testable against OSINT.

The pattern across all eight examples is consistent: the bad PIR is shorter, more interesting-sounding, and more publishable. The good PIR is longer, narrower, and more boring. This is not coincidental. The properties that make a question analytically tractable are the same properties that make it less rhetorically appealing. The discipline is to write the boring version.

3. Research Agenda vs. Intelligence Requirement

The research agenda is the analyst’s standing topic orientation — the geographies tracked, the actors monitored, the technologies followed, the issue areas under continuous low-level collection. The PIR is the tactical question extracted from the agenda when a triggering condition makes the question decision-relevant on a specific timescale. Conflating the two is the single most common procedural error in independent practice.

Structural distinction.

	Research agenda	Intelligence requirement
Time horizon	Years; reviewed quarterly	Days to months; closure-dated
Specificity	Topic, geography, actor cluster	Singular, atomic question
Collection mode	Standing monitoring, low-tempo	Surge collection, time-boxed
Output	Briefing background, situational awareness	Finished assessment against decision
Trigger	None — continuous	Specified condition or scheduled review
Closure	Never; topics retired by review	Yes/No/Conditional at decision date

3.1 Structuring a Research Agenda

A research agenda is operationally maintainable when it is tier-structured by priority. A two-tier or three-tier structure works at solo scale; deeper tiering imposes overhead that is not recovered.

Tier 1 — Primary domain. Two to four topic-actor-geography clusters under continuous monitoring. For an analyst specializing in hybrid threats, this might be: (a) Russia-Ukraine war and its escalation indicators; (b) PRC gray-zone operations in the first island chain; (c) Sahel security architecture post-French withdrawal; (d) Russian and Chinese influence operations in Latin America. Daily collection touch; weekly synthesis; quarterly agenda review.

Tier 2 — Adjacent watch. Six to twelve topics on lower-tempo monitoring, scanned weekly, surged to Tier 1 when triggering conditions occur. Examples: cable-cutting incidents in the Baltic; Houthi maritime targeting in the Red Sea; PRC Coast Guard activity around Second Thomas Shoal; Iranian proxy escalation cycles. Weekly collection touch; ad hoc synthesis when material develops.

Tier 3 — Standing curiosities. Open-ended topics retained without dedicated tempo. Reviewed at quarterly agenda review for promotion or retirement.

Trigger conditions. A topic on the agenda becomes an active PIR when a specified condition occurs. Triggers should be defined at agenda-review time, not invented mid-event:

Threshold event: named escalation, named designation, named breach, named incident.
External demand: a journalist contact, a commissioning editor, or a paid-research customer requests work on a defined question within the topic.
Calendar trigger: scheduled summit, anniversary, election, exercise cycle.
Hypothesis maturation: standing monitoring accumulates evidence that a previously latent question is now answerable.

Review cadence. Quarterly agenda reviews are the appropriate cadence for independent practice. Monthly is overhead-heavy; annual loses too much resolution. At each review:

Retire Tier 1 topics where the originating condition has resolved or where two consecutive quarters produced no Tier-1-grade output.
Promote Tier 2 topics where triggering conditions are now active.
Cull Tier 3 ruthlessly. Standing curiosities that produce no PIR-grade question in 12 months should be retired or explicitly re-justified.

The agenda review is, structurally, the only mechanism by which the independent analyst forces themselves to confront the question of whether their portfolio is still aligned to their original analytical purpose. It is not optional administrative work; it is the substitute for the institutional process that, in a J2 shop, is performed by the chain of command rebalancing collection priorities.

4. Collection Management at Solo Scale

Once a PIR is defined, the analyst must perform collection management — the function that, in institutional intelligence, belongs to a dedicated collection manager and that, at solo scale, falls back on the analyst. The discipline is procedurally explicit; ad hoc collection is the default failure mode.

4.1 The Per-PIR Source Register

For each active PIR, the analyst maintains a source register specifying:

Sources monitored. Named outlets, accounts, datasets, feeds.
Cadence. Daily, weekly, on-event, on-alert.
Alert thresholds. What constitutes a “collection event” worth recording — not every mention, only material new evidence.
Coverage class. Whether the source is primary, primary-state-aligned, secondary, or aggregator. (See OSINT and Part 04 of this series.)
Language. Per the multi-lingual OSINT standing rule, native-language primary sources for the principal actors involved.

The source register is the single artifact that distinguishes structured collection from “checking the feeds.” Without it, the analyst is performing news consumption with analytical aspirations.

4.2 Collection Closure

A PIR is “collected” when one of three conditions obtains:

Evidentiary saturation. Additional collection from registered sources is no longer changing the assessment. The marginal information return has approached zero.
Decision-date forcing. The temporal bound of the PIR (Property 4) has arrived. The analyst must produce the assessment with available evidence, labeled to its actual confidence.
Source exhaustion with named gap. Every accessible source has been collected; remaining requirements would require inaccessible sources (classified, paywalled-prohibitive, denied-area). The PIR is closed with explicit gap-labeling.

The most common collection-management failure is the absence of an explicit closure condition. The analyst keeps collecting because something more might surface. At solo scale, this is indistinguishable from never publishing.

4.3 Gap Identification

Gaps must be enumerated in the analytical product, not absorbed into hedged language. A gap is a source that would be consulted in an ideal collection plan but cannot be — typically because it is classified, paywalled at prohibitive cost, in a language not credibly covered, or located in denied physical or digital space. The labeled gap is itself an analytical product: it tells the consumer what residual uncertainty cannot be reduced under the all-OSINT constraint.

4.4 Time-Boxing

The independent analyst must impose a hard collection deadline at PIR inception. Forty-eight hours, two weeks, one month — the duration is calibrated to the question’s tempo, but the deadline is not optional. Indefinite collection is the structural equivalent of never publishing, and the cost of never publishing is the loss of the entire analytical enterprise’s reason to exist. A defensible assessment shipped within its decision window is operationally superior to an exhaustive assessment shipped after the decision has been made.

5. Preventing the Drift into Commentary

The most common terminal failure mode for independent analysts is the drift from intelligence into commentary — the production of opinion shaped for audience engagement rather than assessment derived from evidence. The drift is rarely deliberate. It accumulates through three mechanisms.

Mechanism 1 — Velocity pressure. Newsletters, podcasts, and social platforms reward consistent output. Audiences trained on weekly or daily cadence experience cadence breaks as defection. The analyst, perceiving the cadence pressure, ships product that is not yet collected or analyzed to the standard the analyst’s own discipline requires. Each instance of velocity-driven shipping shifts the analyst’s baseline of acceptable evidence downward. Within months, the analyst is operating to a standard they would have rejected at the outset of their practice.

Mechanism 2 — Confirmation bias in self-tasking. Without an external consumer issuing requirements, the analyst generates PIRs they are already inclined to find specific answers to. The PIR is written to elicit a conclusion already half-formed. The analytical process, performed honestly, then confirms the half-formed conclusion. The analyst experiences this as analytical rigor. It is not. It is the structural failure that ACH (Analysis of Competing Hypotheses) was designed by Richards J. Heuer Jr to mitigate, applied here at the tasking layer rather than the assessment layer.

Mechanism 3 — Audience feedback loops. Audiences reward confident, congruent conclusions. They penalize “indeterminate” assessments and hedge-laden products. The reward signal is in engagement metrics — likes, replies, subscriber growth, retention. The analyst, even when not optimizing for these consciously, is exposed to the signal continuously. Over months, the conclusions that perform are reinforced; the conclusions that do not perform are quietly retired. The analyst’s published distribution of assessments shifts toward the audience’s preferences. This is selection on a non-analytical fitness function.

Structural countermeasures. The drift is not preventable by good intentions. It is mitigated by procedural design.

Write the PIR before collecting evidence. The PIR must be drafted, dated, and locked before the source register is built. Any modification to the PIR after collection begins is logged with reason. The discipline is to commit to the question in writing before the answer is observable.
Falsifiability test, applied to one’s own draft. Before publication, the analyst answers in writing: “What evidence would change this conclusion?” If no evidence would change it, the product is opinion, not intelligence. The analyst must either reframe the product as opinion or return to the assessment.
Separate publication channels with separate standards. Analytical channels (newsletter analysis posts, long-form assessments, Quartz longreads) and opinion channels (social commentary, podcast remarks, blog editorial) must be structurally distinct outputs with different evidence thresholds and different labeling. The audience must be able to tell which artifact they are consuming. The analyst must be able to tell which artifact they are producing.
Adversarial review against one’s own draft. Even at solo scale, structured pre-publication review (Part 06) imposes a step where the draft is read against red-team prompts: what is the strongest counter-hypothesis, what evidence am I dismissing, what is my confidence claim sensitive to. This is not the same as institutional peer review, but it is the procedural minimum that recovers some of its function.

6. Managing Funding-Source Influence on Tasking

Independent analysts who accept retainers, grants, commissioned research, or consulting engagements introduce a tasking-layer relationship with a funder. Funders have interests; interests shape questions; shaped questions, absent countermeasures, produce shaped conclusions. The Berkeley Protocol on Digital Open Source Investigations and the GIJN Investigative Journalism Manual both treat this as a primary integrity question; the discipline transfers directly to independent intelligence practice.

Three principles, operationalized.

Funders may define topic domain; they may not define analytical conclusion. A retainer to “monitor PRC influence operations in Latin America” is legitimate. A retainer to “produce evidence that PRC influence operations in Latin America are escalating” is not. The distinction is not always articulated by the funder; the analyst must impose it at engagement-negotiation time, in writing, in the engagement letter.
Analyst veto over indefensible conclusions. The engagement letter must specify that the analyst retains the right to deliver an analytical conclusion the funder did not anticipate, including the conclusion that the funder’s prior is incorrect or that the question is indeterminate from available evidence. Funders who will not accept this clause are not commissioning intelligence; they are commissioning advocacy. The relationship is structurally incompatible with the analyst’s professional standing and must be declined.
Mandatory disclosure when funding stake intersects analytical domain. When the funder has any operational, financial, or political stake in the analytical domain, disclosure in the published product is not optional. This applies to public analytical products derived from funded work; it also applies, in attenuated form, to public commentary on topics the analyst has been commissioned to work on, even when the commissioned product is private.

Red lines. Some funder relationships are structurally incompatible with analytical independence and cannot be made compatible by disclosure:

Funder is a party to a conflict the analyst publicly assesses.
Funder has a financial position in markets affected by the analyst’s published assessments.
Funder requires pre-publication approval of analytical conclusions, not merely factual review.
Funder requires non-disclosure of the funding relationship itself.

These are not edge cases to be navigated. They are categories of engagement that the independent analyst declines as a condition of remaining an analyst rather than becoming a contracted advocate. Part 10 (Part 10) develops the ethical infrastructure in detail.

7. Cadence and Publication Discipline

The independent analyst’s output is not a single product type. It is a portfolio of product types with different evidence thresholds, different audiences, and different decision relationships. Treating the portfolio as undifferentiated is a category error.

Tiered output framework.

Tier	Product type	Evidence threshold	Cadence	Confidence labels
T1	Social-platform post / thread	Single confirmed observable, or contextualization of public reporting	Daily-weekly	Implicit; explicit on novel claims
T2	Newsletter brief / weekly analysis	Multiple corroborating sources; standing-monitoring synthesis	Weekly	Explicit confidence vocabulary on key judgments
T3	Long-form analytical assessment	Source-graded primary collection; ACH or competing-hypothesis discipline applied	Monthly-quarterly	Full confidence model; gap labeling; alternative-hypothesis treatment
T4	Commissioned report / expert testimony	T3 evidence base plus adversarial pre-publication review; legal review where applicable	On engagement	Full IC-equivalent labeling; documented methodology section

Mapping products to their correct tier is the analyst’s responsibility. A T1 social post that asserts a T3-level conclusion has overrun its evidence base and should be retracted or downgraded. A T3 product that delivers only T1-level evidence has under-claimed and is failing its consumers.

The cost of silence. The opposite failure of premature publication is perfectionist withholding. An assessment that is ready, defensible, decision-relevant, and time-bounded, but is held back because the analyst is uncertain whether it is “good enough,” imposes a real cost: the decision-maker the product is written against — even hypothetically — makes their decision without it. Silence is not the safe choice. It is a different failure mode with the same root cause as over-publication: the analyst optimizing on personal-risk minimization rather than on consumer-decision relevance.

Calendar discipline. Pre-publication review must be built into the calendar before draft completion, not appended after. The structural design of the publication calendar — when drafts close, when review windows open, when ship dates are committed — is the procedural substrate that prevents both velocity-driven over-publication and perfectionism-driven under-publication. Part 06 (Part 06) develops the review architecture; the calendar is where it is enforced.

Assessment (high confidence). The independent analyst’s long-term reputation is determined less by the quality of any single product than by the consistency of the analyst’s tier-discipline across products. An analyst whose T1 posts and T3 reports are visibly held to different standards, and whose audience can tell which tier they are consuming, accumulates trust. An analyst whose tiers are conflated — whose social posts read as definitive and whose long-form work reads as social posts — accumulates engagement at the cost of analytical standing. The two trajectories are not reconcilable. The choice between them is made at the tasking layer, not at publication.

Intelligence notes

Explorer

Independent Intelligence Analysis — Part 02: Self-Tasking and Intelligence Requirements