The difference between knowing and seeing: Why Intelligence services in Africa are still fighting the last war

When I was leading the Bureau of National Intelligence, I had a habit of dropping a thick folder of field reports on the desk in front of an officer; pages of accounts from across the country, incidents recorded, events described, and situations noted and ask one question: what does this tell us about six to twelve months from now? The silence was always the answer. From my readings and experience of intelligence practice and professionals in the sub region, forward looking insight has not been how we looked at things. From the colonial to post-colonial periods, intelligence services in Sub Saharan Africa have trained people for decades, to record what had already happened.

Someone in the field filed a report. Someone at headquarters collated it. Someone above them summarised it and sent it up the chain. At the top, a decision-maker received a neat document telling them, with reasonable accuracy, what had gone on across the country over the past week or month. Thorough. Organised. And in the most important sense, undirected at a stated national security priority, usually after the facts because by the time it landed on the desk, the moment for doing something about it had already passed.

But Intelligence for National Security is not about what happened. It is about what is likely going to happen with a stated degree of confidence. And confusing those two things is not a minor operational hiccup. It is a fundamental failure of purpose.

The Colonial Inheritance Nobody Wants to Talk About

The Intelligence architecture operating today in many African countries was never designed to create an integrated analytical picture of a complex problem. It was designed to watch and report. The colonial security apparatus it grew from had one job: monitor the population, record dissent, track movements, and send the information upward to administrators who would decide what to do with it. It was a surveillance and filing machine, oriented entirely toward control, entirely backward-looking.

That machine did not shut down at independence. It was renamed, re-staffed, and redirected but the bones stayed the same. Watch. Record. Report. Generations of officers were formed inside that orientation. The culture hardened around it. And so, decades later, the dominant output of intelligence services is still what it has always been: the incident diary. The narrative of events. The careful, detailed, utterly retrospective description of what occurred.

That is not intelligence work. That is filing. And no matter how meticulously you file things, it does not protect the country from what may be coming.

Two Kinds of Intelligence — and Why Mixing Them Up Is Dangerous

Here is something that needs to be said plainly, because the confusion around it explains a great deal. There are two fundamentally different kinds of intelligence, and they are not the same job.

The first is law enforcement, criminal and police intelligence. It looks backward, deliberately and appropriately. Its job is to solve crimes, identify who did what, build an evidence chain that will hold up in court, and support prosecution. The detective taking statements, the forensic analyst processing a scene, the police intelligence officer building a case file all doing criminal intelligence. The consumer at the end of the line is a judge or a jury. The product has to meet a legal standard. The question it answers is: what happened, who did it, and can we prove it?

The second is national security intelligence; in Ghana, what the RD, NSB, DI and BNI are actually mandated to produce. It looks forward, deliberately and necessarily. Its job is to collect information on stated national security priorities and developing situations, analyse it rigorously, and deliver assessed judgment to political decision-makers to enhance decision making. The consumer is the President, the National Security Council, the minister facing a decision at 7 am with incomplete information and no time to wait. The product does not need to be admissible in court. It needs to be honest, well-reasoned, and timely. The question it answers is: what is developing, how confident are we, and what does the decision-maker need to know within the time?

These two types of intelligence require different training, different methods, different institutional cultures, and they produce completely different outputs. Building a national intelligence service around the methods and mindset of the first, when its mandate requires the second, is not a minor administrative mistake. It is a structural failure. And it is exactly what many intelligence services in Africa have been doing.

The Intelligence services in Ghana for instance have operated, for most of their existence, closer to a criminal intelligence model than a national security intelligence one. Its officers have been formed in a culture that rewards the collection and recording of incidents over the analysis of trends. Its relationship with political leadership has been one of reporting rather than advising, transmitting information rather than delivering judgment.

The result is a national intelligence service doing a different job with considerable effort.

What Forward-Looking Intelligence Actually Looks Like

A criminal intelligence report tells you three men were arrested near the northern border with materials linked to extremist financing. Full stop. Case file opened.

A national security intelligence assessment tells you something different. It says that over the past eighteen months, a pattern of incidents in this corridor, combined with recruitment activity in three specific communities, the documented movement of a known logistics facilitator across the border four times in six weeks, and a shift in communication patterns among persons of interest in two northern districts suggests that an operational cell is in the early stages of establishment. Here are the indicators that would confirm that assessment. Here are the indicators that would challenge it. Here is what you should be watching for over the next sixty days.

The first document records a fact. The second produces something you can act on. The first tells you something happened. The second tells you something is happening, gives you a window while the window is still open, and tells you exactly what to watch for.

A government receiving only the first is a government that is always reacting. A government receiving the second has real options to pre-empt, disrupt, redirect resources, or at minimum get ahead of the situation before it becomes unmanageable. Over time, the difference between those two governments is not academic. It is the difference between security and chronic exposure.

Where Ghana Actually Stands The threat environment Ghana is operating in right now is not the one from thirty years ago. The intelligence posture has not kept pace, and that gap is becoming dangerous.

Galamsey has stopped being an environmental or enforcement problem and become a full-scale organised crime problem with arms dimensions, foreign financing, chieftaincy connections, political protection, and money laundering of significant scale. These networks cannot be disrupted by incident reports. They need to be mapped analytically, understood as the sophisticated organisations they are, in their full structure and their vulnerabilities before any enforcement action amounts to more than a press conference.

The Sahelian threat is no longer distant. Burkina Faso is effectively partitioned. Northern Côte d'Ivoire, Togo, and Benin have all seen attacks. The groups behind this expansion have strategy, financing, recruitment systems, and a southward territorial logic that has not reversed once in over a decade. Ghana's northern border is long, porous, and overlaps with ethnic and kinship networks reaching deep into Burkina Faso. The conditions that preceded attacks elsewhere exist here in measurable form. What does not exist, in any demonstrable way, is a sustained analytical picture of how this threat is evolving and what our specific vulnerabilities are.

Add organised crime, cybercrime networks operating openly from Accra, human trafficking, and drug transhipment through Ghanaian ports, and you have a threat landscape that incident diaries cannot begin to address.

A state navigating all of that on field reports and collated summaries is not just under-resourced. It is structurally blind.

What Has to Change — Starting With the Analyst Leadership and Direction

The shift from incident diary to real intelligence analysis is not a technology problem or even primarily a budget problem. It is an orientation problem. And the most consequential single appointment in fixing that orientation is the analyst leadership and doctrine.

In Ghana's current culture, the chief analyst is largely understood as a senior administrator, someone who manages report flow, keeps the memoranda moving, and ensures the chain functions. That is not a chief analyst. That is a chief clerk with a more impressive title.

A real chief analyst is the intellectual leader of the analytical function. They must be formally trained in structured analytical techniques; how to build an argument from incomplete evidence, how to surface and test the assumptions buried in every assessment, how to run alternative analysis that forces the team to consider what they might be getting wrong, and how to communicate confidence levels honestly so that the decision-maker can tell the difference between solid ground and educated inference. These are not natural instincts. They are professional skills that have to be taught, not by people who have not practised or only exposed to the same narrow old ways of doing things.

The chief analyst role must be one who reads, seriously, widely, and continuously. Not just the classified reporting coming through the department, but academic literature on the threats being assessed, the history of comparable environments, the political economy of the region, the methodological literature of the analytical profession. James Mattis made reading a condition of advancement for his military officers because no single career can provide the full range of experience the work demands. The same logic applies here. The analyst who reads only internal reports is an analyst whose mental library is too narrow for the job.

The chief analyst must also engage outside the institution's walls, with researchers, civil society, subject matter experts in economics, public health, climate science, and all the disciplines that illuminate what intelligence collection alone cannot reach. Ghana's present intelligence culture treats this kind of external engagement with suspicion which must change. That instinct has it exactly backwards. A department sealed off from the external knowledge community is a department that is slowly losing its ability to make sense of the world it is supposed to be assessing.

And the chief analyst must be able to brief. Not summarise. Stand in front of the most senior decision-makers in the country, deliver a judgment clearly, hold the position under political pressure without flinching, and walk out having genuinely advanced the principal's understanding. That is the job on the supply side. There are fundamental changes that must happen from the demand side as well that will be discussed later.

The incident diary tells you the house is on fire. The intelligence assessment tells you the wiring was faulty three years ago and shows you which rooms are next.

Ghana needs the second document. It is currently getting the first.

The author, Nana Attobrah Quaicoe is an Intelligence and National Security Analyst, a former Director General of the Bureau of National Intelligence (2022-2025) and writes on national security and intelligence reforms, risk, integrity assessment and institutional governance in the Ghanaian context.