Lion Cipher Lab
Grade a threat report against the ICD 203 analytic standards
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Most threat-intel teams say their reports follow 'ICD 203', the US Intelligence Community's directive on analytic standards. Far fewer have ever reviewed a report against it line by line. The directive is written to be used that way: it calls its standards the core criteria for a regular program of product review. Review is where a team catches the report that says 'we assess with high confidence the actor will likely strike soon'. That sentence breaks three rules at once and tells the reader almost nothing. This lab puts you in the reviewer's chair. You will audit a flawed draft against all…
What you'll learn
- Reading ICD 203 as a review checklist: the five analytic standards and the nine analytic tradecraft standards
- Applying the ICD 203 likelihood table correctly: two rows of terms, seven percentage bands, and the rule against mixing rows
- Spotting the confidence-and-likelihood-in-one-sentence error that ICD 203 explicitly forbids
- Writing a stdlib Python linter for the machine-checkable parts of an intelligence product
- Measuring a linter against a seeded answer key, and showing how a draft can game it
- Hand-grading the standards a pattern match cannot judge: alternative analysis, implications, accuracy
Steps in this lab
- What ICD 203 is, and why you are reading it as a reviewer
- The checklist: five analytic standards, nine tradecraft standards
- The likelihood rules, exactly as ICD 203 states them
- Generate the draft you will review
- Write the linter for the machine-checkable standards
- Lint the rewrite and see what fixing each standard looked like
- Score the linter against the key, then try to fool it
- Hand-grade all nine tradecraft standards with a rubric
- When to use the linter, and how a review team does better
- Where this goes next