Every mature intelligence organisation has a scheme for saying how much it trusts a source, how much it believes a piece of information, and how likely it thinks a judgement is. The schemes look similar and are not interchangeable. This explainer sets out the UK police 5x5x5 and 3x5x2, the NATO Admiralty code, the UK PHIA probability yardstick and confidence ratings, the US ICD 203 standards and the Europol 4×4, grades one fictional item under each, and offers OAT’s view on which a small team should adopt.
OAT graphic: the same fictional claim graded on five scales.
Collection is the easy bit. The hard part is telling a reader how far to trust what you have collected. In his 1964 essay “Words of Estimative Probability”, the CIA analyst Sherman Kent recalled asking colleagues on the Board of National Estimates what odds they had meant by “serious possibility” in a 1951 estimate. Answers ranged from about 20 per cent to about 80 per cent, and the senior policy official who read it had taken the phrase to mean much lower odds than Kent’s own 65 to 35. Kent’s remedy was to tie the words to numerical odds.
Two ideas run through every scheme below. First, source and information are graded separately, because a reliable source can be wrong and an unreliable one right. Second, the probability that something is true is a different question from how confident the analyst is in the basis for that judgement.
Everything below grades one invented report about Harrowgate Freight Ltd, a fictional company.
Item. An account with no posting history on a haulage forum writes that Harrowgate Freight Ltd is about to shut its Doncaster depot and move operations to Immingham. The poster says a driver at the depot told them. Separately, your analyst finds a job advert on harrowgate-freight.example for a transport planner based in Immingham, posted last week. Nothing else corroborates a closure.
The source is new to us and second-hand. The move is partly corroborated; the closure is not.
Origin and users. The 5x5x5 was the standard intelligence report format under the National Intelligence Model, the intelligence-led policing framework adopted across UK forces. The College of Policing library holds a guide to completing it. Its replacement, the 3x5x2, is published by the College in its Authorised Professional Practice (APP) on intelligence management. The College’s 3x5x2 guidance is versioned October 2015; one practitioner history says the 5x5x5 lasted until 2016. Local authority and counter-fraud staff who share intelligence with policing also use it; the Local Government Association publishes training slides on it and a counter-fraud body republishes the College’s guidance.
What 5x5x5 meant. Source evaluation ran A to E: A always reliable, B mostly reliable, C sometimes reliable, D unreliable, E untested source. Intelligence evaluation ran 1 to 5: 1 known to be true without reservation, 2 known personally to the source but not to the person reporting, 3 not known personally to the source but can be corroborated by other information, 4 cannot be judged, 5 suspected to be false. Five handling codes governed who the report could be shared with.
What 3x5x2 means today. This is the College’s current wording.
The letters and numbers swapped places between the two schemes, and the source scale shrank from five levels to three.
Harrowgate Freight, graded. Under 5x5x5 the source is E (untested). Information is 3 only if the report “can be corroborated by other information”; the guide’s own example of 4 is a source who has “heard a number of others mention” something. The Immingham advert corroborates the move, not the closure, so E4 (E3 if you accept the advert as corroboration). Under 3x5x2 the source is 2 (untested). The poster was told by someone else, so C applies. It lifts to B only if the advert corroborates a closure, and the current APP page would want that corroboration graded A. We grade 2C. Handling would be P in a police context; a private organisation has no equivalent and should not borrow it.
Strengths and weaknesses. The scheme is quick, every UK police intelligence unit knows it, and its information scale is about provenance (how the source knows) rather than plausibility, a clean question at the point of collection. Its weakness is the same thing: it says how the information reached the source, not whether it is true, and nothing about probability or confidence. It was built for reports from officers and informants, and sits awkwardly on a web page or a dataset.
Origin and users. Practitioner histories trace the letter-and-number habit to British naval intelligence at the start of the Second World War (letters for source reliability, numbers for information credibility) and from there into NATO doctrine. Academic and practitioner sources attribute the six-by-six version to NATO standardisation agreement STANAG 2511 (2003) and say Allied Joint Publication AJP-2.1 reproduces it. UK defence doctrine, JDP 2-00 (4th edition, August 2023), calls it “the NATO Intelligence Grading System” and notes it is “sometimes referred to as the ‘Admiralty Code’”. The US Army’s FM 2-22.3 carries the same A–F and 1–6 matrix with slightly different wording.
The scales. JDP 2-00 gives them as follows.
| Reliability of the source | Credibility of the information |
|---|---|
| A Completely reliable | 1 Confirmed by other sources |
| B Usually reliable | 2 Probably true |
| C Fairly reliable | 3 Possibly true |
| D Not usually reliable | 4 Doubtful |
| E Unreliable | 5 Improbable |
| F Reliability cannot be judged | 6 Truth cannot be judged |
The two are written as a digraph, a two-character code such as B2. JDP 2-00 stresses that the ratings need not match, giving B5 (usually reliable source, improbable information) and E1 (confirmed information, unreliable source). F6, it notes, does not mean useless, only that there is not yet enough to judge either element.
Harrowgate Freight, graded. Source F: no reporting history for this account, so reliability cannot be judged. Information 3, possibly true: FM 2-22.3 defines that grade as not confirmed, reasonably logical in itself, and agreeing with some other information on the subject, which the advert supplies. Grade 1 would need other sources to confirm the closure itself. Result: F3.
Strengths and weaknesses. The credibility scale asks about plausibility and corroboration, and the scheme is public, language-neutral and understood across allied militaries and much of the private sector. In open-source intelligence (OSINT) most sources are new, so F piles up and stops distinguishing an anonymous account from an established outlet you have never tracked. There is no handling code and no timeliness marker.
Figure 1: the Admiralty 6×6 grid with the fictional forum post at F3, and the same item at 2C on the 3x5x2. OAT graphic.
Origin and users. The Professional Head of Intelligence Assessment (PHIA) is a post within the Joint Intelligence Organisation, established in 2005, which leads the development of the UK intelligence community’s analytical capability. Defence Intelligence developed a common yardstick for probability language in the early 2000s; an updated form is now used across the UK intelligence assessment community. It is published on GOV.UK in “Explaining uncertainty in UK intelligence assessment” (March 2025, updated July 2026). Defence mandates it for all subjective probability judgements in intelligence products. The National Crime Agency and the National Cyber Security Centre (NCSC) both state that they use it.
The scale. Seven terms, each tied to an approximate range, with deliberate gaps between them.
| Term | Approximate range |
|---|---|
| Remote chance | >0% – ≈5% |
| Highly unlikely | ≈10% – ≈20% |
| Unlikely | ≈25% – ≈35% |
| Realistic possibility | ≈40% – <50% |
| Likely or probable | ≈55% – ≈75% |
| Highly likely | ≈80% – ≈90% |
| Almost certain | ≈95% – <100% |
(JDP 2-00 prints the two end ranges as “≤ ≈5%” and “≥ ≈95%” and misprints “Likely or probable” as “Likely or Probably”; otherwise the terms and ranges are identical.)
The Ministry of Defence says the gaps avoid a false impression of accuracy.
Confidence is separate. GOV.UK puts it plainly: probability reflects the likelihood that a statement is true, while analytical confidence reflects the soundness and stability of the foundations on which that likelihood was assessed. GOV.UK rates confidence High, Moderate or Low, and GOV.UK and JDP 2-00 both build the rating from three sets of criteria: the information base, the analytical rigour applied, and the complexity and volatility of the subject. The yardstick “is intended for the communication of probability only, not analytic confidence”.
Harrowgate Freight, graded. The yardstick grades a judgement, not the post. Suppose the judgement is: “Harrowgate Freight Ltd will close its Doncaster depot within six months.” One untested, second-hand report plus an advert showing some Immingham activity puts that, in our view, at a realistic possibility. Confidence is Low: thin information base, no corroboration of the closure, volatile subject. Written up: “There is a realistic possibility that Harrowgate Freight will close the Doncaster depot within six months. We have low confidence in this judgement, which rests on a single untested source.”
Strengths and weaknesses. It is the UK government standard, so anything written in it is legible to a public-sector reader. It forces a probability out of you, which is uncomfortable and correct. It says nothing about individual sources, so it needs a companion scheme. The ranges are approximate by design, which some readers find imprecise and others honest.
Origin and users. Intelligence Community Directive 203 (ICD 203), Analytic Standards, issued by the Director of National Intelligence for the US Intelligence Community, took effect on 2 January 2015, with technical amendments dated 21 January 2022 and 12 June 2023. It sets five core standards and nine tradecraft standards; the first two tradecraft standards are describing the quality and credibility of sources and properly expressing uncertainty.
The scale. ICD 203 offers two interchangeable sets of terms across seven bands.
| Set 1 | Set 2 | Range |
|---|---|---|
| almost no chance | remote | 01–05% |
| very unlikely | highly improbable | 05–20% |
| unlikely | improbable | 20–45% |
| roughly even chance | roughly even odds | 45–55% |
| likely | probable | 55–80% |
| very likely | highly probable | 80–95% |
| almost certainly | nearly certain | 95–99% |
Analysts are “strongly encouraged not to mix terms from different rows”, and products that use a confidence level “must not combine a confidence level and a degree of likelihood … in the same sentence”. The directive does not itself define high, moderate and low confidence, only the kind of evidence confidence rests on; US bodies such as the Multi-State Information Sharing and Analysis Center (MS-ISAC) publish their own definitions, tied to the quality, quantity and agreement of sources.
Source descriptors. A companion directive, ICD 206 (signed 22 January 2015), requires covered analytic products to carry source reference citations and “source descriptors”: short narrative notes on the factors affecting a source’s quality, which ICD 203 lists as accuracy and completeness, possible denial and deception, age and currency of the information, and source access, validation, motivation, possible bias and expertise. It also strongly encourages a “source summary statement” covering the whole source base. Both are prose alternatives to a letter-number grade.
Harrowgate Freight, graded. Our analyst put the closure at around 45 per cent. On the PHIA yardstick that is a realistic possibility. On ICD 203 it sits at the bottom of roughly even chance (45–55%) or the top of unlikely (20–45%), depending where the analyst lands. Confidence, in its own sentence, is low.
Strengths and weaknesses. ICD 203’s bands are contiguous, and its tradecraft standards go well beyond grading into how analysis is argued and reviewed. Its band boundaries differ from PHIA’s, so “likely” in one scheme is not “likely” in the other, and a report must say which vocabulary it is using.
Europol’s scheme is written into law. Article 29 of Regulation (EU) 2016/794 requires member states, as far as possible, to code source reliability as A (no doubt as to authenticity, trustworthiness and competence, or reliable in all instances), B (reliable in most instances), C (unreliable in most instances) or X (reliability cannot be assessed), and information accuracy as 1 (accuracy not in doubt), 2 (known personally to the source but not to the official passing it on), 3 (not known personally to the source but corroborated by other information already recorded) or 4 (not known personally to the source and cannot be corroborated). The same codes were in use at Europol before the 2016 Regulation.
Information that arrives ungraded must be assessed by Europol from what it already holds, in agreement with the providing state, or coded X and 4 if no agreement is reached. Restrictions on use are handled separately, under Article 19, and Europol’s own guidance describes them as handling codes: H1 must not be used as evidence without the provider’s permission, H2 must not be disseminated without permission, H3 other restrictions. The retained UK copy of the Regulation was revoked at the end of 2020, so it has no legal force here, though anyone working with European partners will still meet it.
Harrowgate Freight under 4×4: X4. Code 3 needs corroboration “by other information already recorded”, and we do not accept the advert as corroborating the closure; X3 only if you do.
| Scheme | Grades the source? | Grades the information? | Probability of a judgement? | Analytical confidence? | Handling code? | Primary users | Harrowgate Freight |
|---|---|---|---|---|---|---|---|
| 5x5x5 (legacy) | A–E | 1–5 (provenance) | No | No | 1–5 | UK police, pre-2016 | E4 (E3 if advert accepted) |
| 3x5x2 | 1–3 | A–E (provenance) | No | No | P / C | UK police and partners | 2C, P |
| Admiralty / NATO | A–F | 1–6 (plausibility and corroboration) | No | No | No | NATO, Ministry of Defence, threat intelligence, OSINT | F3 |
| PHIA yardstick and confidence | No | No | 7 terms, gapped ranges | High / Moderate / Low | No | UK government assessment | Realistic possibility; low confidence |
| ICD 203 (with ICD 206) | Prose (source descriptors) | Prose (source descriptors) | 7 terms, contiguous bands | Yes (stated in its own sentence) | No | US Intelligence Community | Roughly even chance; low confidence |
| Europol 4×4 | A, B, C, X | 1–4 (provenance) | No | No | Separate (H1–H3) | Europol, EU police | X4 (X3 if advert accepted) |
The table summarises the definitions cited above.
Figure 2: the PHIA yardstick (with gaps) against the ICD 203 bands. 45% is illustrative. OAT graphic.
Grading the source when you meant the information, or the reverse. The College, JDP 2-00 and the Europol Regulation all keep the two judgements apart. A reputable outlet quoting an anonymous tip is a reliable source carrying unverified information. Grade both.
Circular reporting inflating the grade. Three articles that trace back to one forum post are one source. JDP 2-00 warns operators to be alert to circular reporting when corroborating.
Confusing probability with confidence. “Highly likely” is about the world; “high confidence” is about your evidence and method. PHIA and ICD 203 both insist on the separation, and ICD 203 forbids putting them in one sentence. A judgement can be highly likely and low confidence at once.
Mixing scales in one report. “B2” is a usually reliable source with probably true information in Admiralty, and a mostly reliable source with information known personally to that source in old 5x5x5.
Treating F6 or 2D as a verdict. JDP 2-00 says F6 does not make information useless, only unjudged; the College defines D as having no means of assessing the information, which is a statement about the evidence, not a verdict.
Forgetting to re-grade. JDP 2-00 says gradings should be reviewed as further intelligence arrives. A grade is a timestamped judgement, not a permanent label.
This is opinion. A small organisation with no statutory duty to use a particular scheme should grade items on the Admiralty code, and judgements on the PHIA yardstick with a High/Moderate/Low confidence statement. The Admiralty scales are public, ask about plausibility and corroboration rather than provenance alone, and most of the threat intelligence world already understands them. The PHIA yardstick is the UK government standard, so a police, regulator or Whitehall audience will read it correctly. Add ICD 206-style source descriptors alongside the letters, because a digraph without a sentence of explanation is a grade nobody can audit.
Use the 3x5x2 only when submitting into a police or partnership system that expects it, and then use it exactly as the College defines it, without translating from your own scheme. Name the scheme once in the report header and stick to it. Show your working. A grade the next analyst cannot reconstruct is not defensible.
OSINT is easy to start and hard to do properly. We teach the hard part. Grading and confidence wording are core to the course. Find out about our Level 3 Award in OSINT at obsidianarctraining.com.
Show your working: notes and evidence capture in OSINT A finding you cannot show your working for is an anecdote. This guide covers why OSINT analysts keep a research log,…
Is this source any good? Five checks for OSINT beginners Finding information is the easy bit. Deciding whether to believe it is where beginners come unstuck. A five-question checklist, how…
Reverse image search basics: why one engine is never enough A photo turns up captioned “happening now”. Reverse image search is how you find out whether it is new, old…
