.@Digby56 As I have some small experience in the world of intelligence collection and analysis, I can explain why the phrase you keyed on is not a bigger deal. This is RE: your post the other day about signals intelligence (SIGINT) collection prior to the sarin gas attack in Damascus:


The operative sentence that twigged your suspicions:

"In the three days prior to the attack, we collected streams...of intelligence"

The most important word there is "collected." Just because you have collected something doesn't mean you have examined it yet. This brings us to the "haystack" issue: SIGINT operations generally capture much more than the operators can hear in real-time. This is so that when they discover something important happening, they can go back and listen to what came beforehand. Sometimes analysts have to hear communications on a different net or channel before the context of the first one is clear. In the Syrian example, this can mean listening to non-regime sources: what are Al Jazeera reporters talking about among themselves? What are ambulance drivers and paramedics talking about on their radios? And so on.

Before it can be considered conclusive, the SIGINT analysis also has to be matched to other forms of intelligence: at the time you heard radio traffic about mixing chemical weapons, was a satellite or other asset overhead to see the crews at work? What do our human assets in Damascus say? Can we get samples from the scene of the attack? And so forth.

Contrary to popular misperception, analysts spend much of their working time understanding events that have already happened, or obtaining background information on matters that are still in progress. Hollywood would have us imagine that clandestine services are listening to all of us with real time omniscience, but the truth is much more mundane. Frankly, there is always plenty of signal and not enough people to listen to it all live.

There are also practical reasons why "collected streams" may not be analyzed until after the fact. Target communications might be encrypted, for example, and are not available for analysis until they are decrypted. High-level Syrian command and control channels are almost certainly encrypted. Depending on the type of encryption used, this delay might last hours or days.

But even if you are listening to the Syrian chain of command pass orders to mix, fill, and then deploy chemical munitions in real time and with perfect decryption, it's not practical to issue a warning unless you can identify the target of the attack. Syrian generals are not stupid. They use OPSEC techniques such as code words and phrases, battlefield deception, etc. If no source gives you an actual name for the target, you will have to wait until the fire mission gets issued to the cannon-cockers manning the artillery tubes before you can find out which neighborhood is to be gassed.

But when a fire control center starts passing those grid coordinates, it is too late -- the munitions are already on site and ready to fire. You do not have time to warn anyone in Syria what's coming.

And until an attack actually happens, how do you know that you're not listening to a drill? In fact, the drill will sound exactly the same as an attack in every aspect.

We have a tendency to talk about America's SIGINT agencies as though they were absurdly all-knowing, then grouse "what good are they?" when something happens. The truth is that these agencies are incredibly valuable to policy makers, but they are staffed by human beings who often have to catch up to events themselves, fill in blanks, and deal with imperfect evidence before they can advise civilian authority with accurate, much less actionable, information.

I hope this helps you understand an opaque world that is far older than most of the commentariat seems to realize.