As Global Threats Spiral, Companies Have a New Weapon: Military-Grade Intelligence

Russia's unprovoked invasion of Ukraine, and Ukraine’s subsequent response, is the first major military mobilization and operation we have observed in a new era characterized by the widespread availability of commercially generated intelligence. For the first time, commercially generated intelligence has changed not only the way combatants and governments interact in a time of war, but also provided unprecedented amounts of detailed information, in near real-time, to all global citizens. For example, the many images flowing from both private citizens and commercial providers has brought a level of understanding and transparency of wartime operations not normally experienced in wartime. Against this backdrop, companies are beginning to see the potential value in leveraging such intelligence for additional insights into decision making and risk mitigation.   

Commercially generated intelligence refers to information that is produced, collected, aggregated and analyzed by a privately owned entity to support decision making and risk mitigation. Throughout history, with few exceptions, only governments had the resources and assets to produce, collect and aggregate this type of information for intelligence purposes, and what was generated was almost always classified. This has changed. Within the last ten years, innovators have launched technologies that allow commercial enterprises to generate, analyze and disseminate data at scale. Examples include advanced sensor technologies now available with commercial space technologies; commercial unmanned platforms; and commercial ground-based sensor technologies. Today, there are also many devices, applications and services that can collect information, including signals, and that information is used to make conclusions on location, activity, associations, etc. New commercial ecosystems can meanwhile collect, store, analyze and exploit data and information at speed and scale for decision-making—both human and machine, and all the combinations thereof—and disseminate it through cloud, edge devices and everything in-between. 

The result: We have entered a new era of data ubiquity where commercial enterprises can now create or buy their own intelligence structures and functions, which they can use to both inform decision-making and identify and mitigate risk, in new and different ways. In some ways, the private sector has more information than governments and can already perform intelligence and information functions that surpass some of the current capabilities of the public sector. The business imperative of collecting and leveraging data is well understood and firms are obliged to pursue these capabilities if they believe them to be in the best interest of their shareholders.

The use cases for this intelligence have evolved. The commercial marketing sector, for instance, has already created a real time individualized advertising capability. But, as shown in Ukraine, firms can leverage commercially generated intelligence to gain insights about threats and risk on their own, without having to wait for governments to share or act on information. The result is that companies are getting better and faster at fusing, analyzing, managing, disseminating and actioning a vast pool of information for intelligence. 

In each of these use cases, it is the coordination, integration and synchronization of those capabilities that generates the information and, when analyzed, the intelligence to answer questions and make decisions at scale. Therefore, the true power of commercially generated intelligence will only be realized when responsible private sector partners fuse their data into an intelligence ecosystem.

A Commercial Intelligence Ecosystem like this would include information from a range of domain sources, tipping and cueing off one another to provide holistic context on a broad range of threat types. It will afford private enterprises—especially those that provide critical functions—shared awareness of threats across these domains, leveraging private sector information in lieu of information that the government may never be able to share, simply does not have or is not allowed to collect. This approach will also foster new models for public private collaboration and information-sharing versus remaining in silos. This will have an over-sized impact on cybersecurity and provide a more complete picture of national security risks. While the concept of CIE is more aspiration than reality today, there are some companies beginning to build the necessary foundations and frameworks.

This approach does not come without controversy. In democratic countries, for the most part, government intelligence functions are governed by laws, policy and regulation, with robust oversight mechanisms. Many of the commercial capabilities being utilized in Ukraine today are governed by existing laws covering dual-use technology. However, their use has precipitated a discussion about potential new policies and laws to address the exploding use of these type technologies by private sector firms.

We concede that when various laws and authorities were created for the intelligence community, we did not and could not conceive of the collection and processing powers private firms would one day possess, nor did we envision the ubiquity of digital data sources. However, the world we now live in is characterized by bald-face aggression by near-peer adversaries and the utter abandonment of the laws of war and armed conflict. We therefore believe the use of such data deserves a fulsome and fair discussion amongst a wide range of stakeholders to strike the right balance between the privacy of private citizens, the protection of their rights and our national security with policy, norms, frameworks and oversight.  

We expect commercial intelligence capabilities to continue to grow in scope, scale and speed. Now is the time to figure out how to use these advances, both with public-private and private-private interfaces, to improve national security and the security of our critical infrastructures, as well as sustain and enhance our economic competitive advantages. There is no going back: we must learn to manage commercial intelligence responsibly and use it for the greatest good, according to the ethics and values of the U.S. and other democratic, allied nations. 

Dave DeWalt is the Founder and Managing Director of NightDragon, an investment platform focused on cybersecurity, security and privacy risk. Lieutenant General (Retired) Edward (“Ed”) Cardon is a retired senior officer in the U.S. Army and the Founder of Touchstone Futures, a national security-focused consultancy.