THE INTEL ANALYST ACADEMY
Professional Intelligence Training
Printable Lesson
Data Visualization Intelligence
The Intel Analyst Academy · Lesson Notes
Charts in intelligence work have one job: to help a reader see something faster than they could from text or a table. A chart that looks impressive but needs a paragraph of explanation has failed at that job, however good it looked on the big screen in the briefing room.
This lesson covers the chart types analysts reach for most, what each is good and bad at, and how to avoid the visual equivalent of an overstated judgment.
Before you open a tool, write down the question the visual answers. Different questions need different charts.
If you cannot write the question in one sentence, the chart will not answer it either.
Timelines are the workhorse of incident analysis. They show sequence, gaps and clustering in a way text struggles to match. A list of twenty events is hard to hold in your head. The same events on a line show you at a glance that eight of them happened in the same week.
Good timelines mark the source of each event, separate confirmed events from reported ones (solid versus hollow markers works well), and keep the time scale honest. If the scale jumps from days to months halfway along, say so on the chart.
Network graphs show relationships between people, organisations, accounts, phone numbers or anything else that connects. They are excellent at revealing brokers, the nodes that link otherwise separate groups, and clusters that operate together.
They are also the chart most likely to be misread. A dense graph looks sinister even when the links are trivial. Two people who follow each other on social media and two people who send each other money appear as identical lines unless you make the difference visible. Use line thickness or style to show link type and strength, and say in the caption what a link means.
Size nodes by something meaningful, such as the number of connections, and say what it is. A big node with no explanation reads as "important" to most viewers, whether or not it is.
Maps answer "where" and tempt analysts to answer "why" with them as well. A cluster of incidents in one suburb might be a hotspot, or it might be where most of the reporting comes from. Population, reporting coverage and patrol patterns all shape what appears on a map.
When you map incidents, show the coverage of your sources if you can. If collection only covered half the area, shade the other half rather than letting it look quiet.
Flow diagrams, including Sankey charts, show how volume moves between stages: money through accounts, goods through ports, reports through a collection and analysis process. The width of each band shows quantity, which makes bottlenecks and leaks easy to spot.
They work best with a small number of stages and categories. Past about a dozen bands, a Sankey chart turns into spaghetti, and a table will serve the reader better.
Every number can be right and the chart can still be wrong. The usual ways this happens:
A useful habit: for every chart, ask what a sceptical reader would say about it, and fix that before they get the chance.
An analyst investigating invoice fraud has 300 transactions across 40 company accounts. The first attempt puts every account on a network graph with every transaction as a line. The result is a hairball that tells the reader nothing except that there is a lot of data.
The second attempt starts with the question: which accounts move money between the two companies under investigation? The analyst filters to transactions above a set value, groups accounts by registered owner, and draws lines only between groups. Line thickness shows total value. Now the graph has nine nodes, and one account stands out as the only link between the two companies. It becomes the focus of the next round of collection.
The data did not change. The question did, and the chart followed it.
You do not need expensive software to make good charts. A spreadsheet handles bar charts and simple timelines. Gephi is a free option for network analysis, and QGIS is a free option for maps. Code libraries such as D3.js allow custom interactive visuals if you have the skills and the time. Pick the simplest tool that answers the question.
Take ten to twenty events from a recent news story and plot them on a timeline. Mark confirmed events differently from reported ones. Then write a title that states what the timeline shows. If you cannot write that title, the timeline is not finished yet.
Continue your training
This lesson is part of The Intel Analyst Academy — professional intelligence analysis training built for analysts. Explore the full course library, structured learning paths, and practical tools at theintelanalystacademy.com.
