Open-Source Intelligence in Pandemic Early Warning

28 April 2020, 11:30 a.m.

(Disponible en français : Le renseignement de sources ouvertes et l’alerte rapide en situation de pandémie)

The purpose of intelligence is to warn and inform. Selecting the right tools to accomplish these goals matters. In the context of public health intelligence, open sources and analysts with epidemiological expertise are essential, although secret intelligence may help provide additional context.

Open-source intelligence (OSINT) is vital to the provision of pandemic early warning. While secret intelligence provided by national security agencies, such as the Canadian Security Intelligence Service (CSIS), Communications Security Establishment (CSE), and Canadian Forces Intelligence Command (CFINTCOM), may provide insight as to how a foreign country’s leadership or military are reacting to or are implicated in a disease outbreak, OSINT is the “workhorse” of public health intelligence.

What is Public Health Intelligence?

Public health intelligence entails the systematic collection and analysis of health data to identify and prevent risks to public health. It is, by its very nature, an OSINT issue. In identifying and reacting to an emerging public health threat, it is civil society – in particular, doctors, patients, family members, and third-party observers of social life – that creates most of the information of interest.

Using social media scrapers and other techniques to collect online content and artificial intelligence (AI) to analyse this content, public health intelligence can rapidly build a detailed picture of a developing situation.

It is difficult to control the spread of this information. For example, on 30 December 2019, Wuhan-based ophthalmologist Dr. Li Wenliang warned of a possible disease outbreak resembling severe acute respiratory syndrome (SARS) in a WeChat message sent to 25 colleagues, and the post went viral within an hour. 

A day after Li’s WeChat message was sent, Wuhan reported the outbreak of a pneumonia-like illness of unknown etiology to the World Health Organization’s (WHO) country office in Beijing. The situation mirrors events that took place 17 years prior, when the Program for Monitoring Emerging Diseases (ProMED-mail) used OSINT to uncover the SARS epidemic

Global Public Health Intelligence Network

Canada has played a key role in the ongoing development of an important open-source tool used in identifying potential public health threats, the Global Public Health Intelligence Network (GPHIN). 

Working with the WHO, Health Canada set up GPHIN in 1997 to track foreign media reporting and provide early warning of biological, chemical, radiological and nuclear threats. GPHIN drew its inspiration from ProMED-mail and similar open-source initiatives being undertaken by intelligence agencies, such as the U.S. Central Intelligence Agency’s Community Open Source Program Office (COSPO). 

Today, the Public Health Agency of Canada (PHAC) operates GPHIN, and its scientists are applying AI techniques to obtain new insights from a variety of data inputs, including social media. GPHIN has become a core element in a broader WHO initiative called Epidemic Intelligence from Open Source (EIOS), which consolidates inputs from several national open-source epidemiological tools.

“Big Data” Intelligence

GPHIN and the EIOS have counterparts in the classified world. Both CSE and CSIS collect and analyze massive datasets of publicly available information to detect trends and patterns of interest. Though traditional intelligence agencies have long acknowledged the value of OSINT, they have tended to emphasize the importance of intelligence collection using secret sources and methods.  Web 2.0 and advances in AI techniques – such as natural language processing using machine learning – are changing this outlook.

Such “big data” methods present challenges. Validation is essential. Regardless of its source, data may be incomplete or untrustworthy, underlining the importance of drawing on a rich variety of sources. Human analysts with subject matter expertise also remain an indispensable part of the intelligence production process.

In both the classified and public realms, a single source can provide the prompt needed for a closer look using other means. Signals intelligence can detect terrorist networks, thereby helping human intelligence agents know who to watch.

“Signals intelligence” from Dr. Li’s WeChat message alerted the world to the emergence of a novel coronavirus, then specialized human resources were needed to collect data on the virus and how it manifests in humans. International collaborative networks of virologists have been and will be key resources in responding to this pandemic.

Unlike secret intelligence, OSINT can be widely shared without compromising sensitive sources and methods. The threat of such sharing could be used to induce greater transparency in reporting on disease outbreaks.

Intelligence Assessment in Canada

Drawing conclusions from intelligence requires teamwork. PHAC did not work alone in assessing the risks posed by COVID-19. In Canada, the Privy Council Office’s Intelligence Assessment Secretariat (IAS), Global Affairs Canada (GAC), CFINTCOM, CSE, CSIS, and others such as Health Canada where appropriate, bring expertise to international assessments of interest to the Government of Canada.

The IAS exists to provide all-source intelligence assessments of foreign, defence and national security issues. Its analysis draws on all available intelligence reporting to help decision makers understand the significance of developments abroad. Though PHAC leads the assessment of public health risks, the COVID-19 crisis also gives rise to many foreign policy questions. In such circumstances, it is normal practice for the IAS to convene subject matter experts to render assessments.

CFINTCOM tracks biological weapons threats and it also has a Medical Intelligence Cell.  Among other things, the Medical Intelligence Cell monitors regional communicable disease threats to ensure the Canadian Armed Forces are properly inoculated prior to deployment. As media reports indicate, the Cell relies primarily on OSINT, but it also receives classified medical intelligence reporting from allied counterparts.

Using local networks, Global Affairs Canada’s Global Security Reporting Program (GSRP) creates focused reporting on security and stability issues from Canadian diplomatic posts abroad.

CSIS’s mandate is to investigate threats to Canada’s national security, including terrorism directed against Canadians using biological weapons. 

Author: Holly Porteous, Library of Parliament