Fortune Favors the Prepared · Intelligence Operations

How We Watch: The FFTP Intelligence Collection and Production System

Reading time: ~12 minutes  ·  Access: Free

The Intelligence Cycle, Applied

Every serious intelligence operation — from the CIA’s Directorate of Operations to a corporate threat intelligence team — runs on some version of the same cycle: define what you need to know, collect against it, process the raw collection, analyze it, and disseminate the finished product to the people who need it. The cycle then restarts based on what the finished product reveals and what questions it leaves unanswered.

The FFTP intelligence operation runs this cycle on a 24-hour clock. The output — the Daily Threat Report, DTR Lite, and Daily Preparedness Brief — is the dissemination step. Everything before it is the collection, processing, and analysis infrastructure that makes the products possible. Most intelligence consumers never see that infrastructure. This article makes it visible.

The Source Registry: Where Collection Starts

Collection without a defined source set is browsing. The difference between intelligence collection and reading the news is the discipline of knowing, before you start, exactly what you are collecting from, why each source is in the registry, and what it covers.

The FFTP source registry currently contains 247 sources organized by sector, source type, reliability tier, and update frequency. The full registry is documented at the Source Registry reference page. The architecture behind it reflects several principles that distinguish a collection registry from a reading list.

Sector alignment

Every source in the registry maps to one or more of the 18 critical infrastructure sectors defined by CISA: Energy, Water and Wastewater, Communications, Transportation Systems, Healthcare and Public Health, Financial Services, Food and Agriculture, Government Facilities, Emergency Services, Information Technology, Chemical, Critical Manufacturing, Defense Industrial Base, Nuclear, Dams, Commercial Facilities, and two cross-sector categories covering space and domestic hazards. This alignment is not cosmetic — it ensures that when the Watch Desk sweeps for Energy sector reporting, it pulls from the sources that actually cover energy infrastructure rather than from general-purpose news feeds that happen to mention energy occasionally.

Source typing and reliability tiering

Sources are typed by category: government primary sources (CISA advisories, NWS products, USGS, EPA, NOAA, DOE, DHS); academic and research institutions; trade and sector-specific publications; international news and foreign government sources; open-source threat intelligence feeds; and specialized technical sources covering cybersecurity, weather, space weather, and financial markets. Each type carries a default reliability weighting that reflects the source’s track record, editorial standards, and verification practices. A CISA advisory and a trade publication carrying the same information are not equivalent collection items — the source type is part of the analytical product.

Registry maintenance

A source registry that isn’t maintained becomes a liability. Sources go offline, change editorial focus, degrade in quality, or are superseded by better alternatives. The FFTP registry undergoes a standing audit cycle: sources that haven’t produced relevant material in a defined window are reviewed for retention; new sources that demonstrate consistent value are added through a structured vetting process that includes reliability assessment before they enter the active collection set. The registry version is tracked — the current build is v2.18 — so that changes to collection coverage are documented rather than silent.

The Watch Desk: Automated Collection Architecture

The Watch Desk is the automated collection and monitoring platform that runs the daily sweep cycle against the source registry. It is not a news aggregator or an RSS reader. It is a structured collection system with specific operational characteristics that matter to the quality of the finished intelligence products.

Continuous sector sweeps

The Watch Desk runs continuous sweeps organized by the 18 CISA critical infrastructure sectors. Rather than collecting everything and sorting later, it collects by sector from the outset — meaning the intake that reaches the analyst is pre-organized by the same sector taxonomy that structures the finished DTR. Coverage gaps are visible before the production cycle closes: if a sector sweep returns sparse material, that is a signal to check whether the relevant sources are operational and whether the sweep parameters need adjustment, not a reason to produce thin coverage without flagging it.

Condition monitoring

The Watch Desk monitors seven standing conditions in real time: DEFCON (US defense readiness), COGCON (continuity of government condition), FPCON (force protection condition), CYBERCON (DHS cybersecurity condition), COMCON (communications readiness), WX-CON (significant weather condition), and SWX-CON (space weather condition). These conditions feed directly into the DTR’s Sector Impact Matrix — the status of each condition at production time is locked into the product, giving subscribers a snapshot of the multi-domain readiness picture at the moment the brief was built rather than a general assessment that could apply to any day.

Focus Mode and Geographic Scope

The Watch Desk supports Focus Mode presets that direct collection resources toward specific sectors when conditions warrant — a pre-landfall hurricane activates an elevated WX-CON collection posture; a significant CVE disclosure activates an elevated cyber sector sweep. Geographic Scope filtering allows collection to be narrowed to a specific region for area-specific analytical products, which is the collection foundation for the ASAR product line. These aren’t manually triggered each time — they are parameterized presets that activate against defined threshold conditions, the same principle that governs automated collection posture shifts in national-level SIGINT systems.

From Collection to Finished Intelligence: The Production Cycle

Collection is raw material. Finished intelligence is a product that has been processed, analyzed, contextualized, and formatted for a specific consumer. The production cycle that converts Watch Desk intake into DTR products involves several steps that are worth understanding explicitly, because they are where the analytical value is actually added.

Triage and significance sorting

Not everything the Watch Desk collects makes it into the finished product. The first processing step is triage: identifying items that represent genuine new developments versus routine reporting, duplicates from multiple sources covering the same event, and items that fall below the significance threshold for inclusion. The significance threshold is not arbitrary — it is defined in the standing SOP and calibrated to the product’s consumer. A development that warrants inclusion in the DTR Full may not meet the threshold for the DTR Lite, which targets a faster, higher-significance read.

FLASH designation

Items that meet the FLASH threshold — defined as decision-trigger events that a subscriber needs to act on or account for before the next production cycle — receive elevated treatment in the finished product. FLASH entries in the DTR carry a structured alternative hypothesis object: a competing explanation for the observed event, explicitly weighed against the primary assessment. This structure implements the same alternative hypothesis discipline that ICD 203 requires of IC analytical products. The methodology is documented in full at the Analytical Standards reference page.

The I&W Matrix

The DTR’s Sector Indications and Warning Matrix is populated during the analysis phase, not as a post-hoc summary. For each of the 18 sectors, the I&W matrix tracks whether collected material meets any of the defined decision-trigger thresholds — specific indicators that warrant subscriber action or heightened attention. Populating the matrix during analysis rather than after it ensures that the analyst is actively looking for the indicator set, not retroactively deciding whether something qualifies. This is the same forward-looking I&W discipline that national-level warning systems apply to strategic threat indicators.

The BLUF and product format

Every DTR product leads with a boxed BLUF — Bottom Line Up Front — before the analytical body. This is not a stylistic choice. The BLUF discipline ensures that the most critical analytical judgment reaches the subscriber regardless of how much of the product they read. A subscriber who reads only the BLUF has the essential picture. A subscriber who reads the full product has the supporting detail, the sector-by-sector breakdown, the condition status, and the sourcing. Both read a finished intelligence product that holds itself to the same estimative language standards — the “almost certainly,” “likely,” “possibly” scale locked to the IC’s ICD 203 framework — rather than the unqualified assertions that characterize most commercial threat reporting. The full estimative language standard is documented at the Analytical Standards page; the terminology used throughout the products is defined in the Acronyms reference.

The Product Suite

The Watch Desk and production cycle feed four standing products, each calibrated for a different consumer and use case.

What OSINT Can and Cannot Do

The FFTP intelligence operation is an open-source intelligence operation. Everything it collects is from sources that are publicly accessible — no classified reporting, no human sources, no signals interception. Understanding what that means operationally is important for calibrating what the products can and cannot tell you.

OSINT is not a second-tier capability. The intelligence community’s own post-mortems on major analytical failures — including 9/11 and the 2003 Iraq WMD assessment — identified over-reliance on classified collection and under-utilization of open-source reporting as contributing factors. Open sources provide volume, context, and corroboration that classified collection cannot replicate. The OSINT revolution described in Part 8 of the Architecture of Intelligence series has made OSINT more capable, faster, and more broadly accessible than at any point in the discipline’s history.

OSINT has structural limitations. It cannot tell you what a foreign government’s internal deliberations are producing, what a threat actor’s operational planning looks like before it surfaces in observable behavior, or what a classified intelligence assessment says about a specific threat. For the threat picture that matters to emergency managers, infrastructure operators, and preparedness-focused households — natural hazards, cyber threats to public infrastructure, supply chain disruptions, geopolitical developments with domestic implications — open-source collection against a structured source registry provides coverage that classified reporting doesn’t materially improve for most operational purposes.

The production discipline matters as much as the collection coverage. An open-source collection against 247 structured sources, processed through a defined triage protocol, analyzed against ICD 203 estimative standards, and formatted in a consistent finished intelligence product is a fundamentally different thing from reading the same sources without that structure. The discipline doesn’t change what the sources say. It changes what the analyst does with what the sources say — and that is where finished intelligence diverges from informed browsing.

Building Your Own Collection Discipline

One of the explicit goals of the FFTP intelligence operation is to make the methodology visible — not just to explain what the products are, but to give practitioners the framework to build their own collection and analysis capability at whatever scale fits their mission.

The principles that govern the FFTP system scale down to individual and organizational use without requiring a 247-source registry or an automated sweep platform. The essential elements are simpler than the full production architecture:

Define your collection requirements before you start collecting. What sectors, geographic areas, or threat categories are relevant to your planning? A household preparedness plan needs different collection than a corporate continuity program, which needs different collection than a county emergency management office. Starting from requirements prevents the collection from expanding to fill available time rather than actual need.

Build a source registry, even a small one. Twenty well-chosen sources that you review consistently and understand well produce better situational awareness than 200 sources that you scan irregularly. The FFTP source registry documentation at the Source Registry page provides a starting point — the full 247-source list is available to Patreon members, but the structure and sector organization are documented openly.

Apply estimative discipline to your own assessments. The difference between “this might be a problem” and “this is likely to become a problem within 72 hours based on the following indicators” is the difference between awareness and actionable intelligence. The Analytical Standards page documents the estimative language framework in full.

Separate collection from analysis. Reading a source and immediately forming a judgment about its implications is a single-step process that skips the processing phase. Structured collection — gathering the reporting first, then analyzing across the full intake — produces more reliable assessments than analyzing each item as it arrives.

See Also

• Analytical Standards — ICD 203 estimative language, FLASH designation, and production rules
• Source Registry — the 247-source collection architecture by sector and type
• Acronyms — terminology reference for all FFTP products
• The Architecture of Intelligence — 8-part series on national and commercial intelligence systems
• The Commercial Layer: Private Intelligence in the Modern Era (Part 8)
• Open-Source Intelligence (OSINT)
• OPSEC: Don’t Become the Target