For three decades, mastering i2 Analyst’s Notebook was the mark that separated an operational intelligence analyst from a theoretical one. Today the tool has changed owners four times, IBM-era certifications are tied to specific versions, and AI-powered platforms have emerged. The question is a fair one: does training in i2 still make sense? The short answer is that the certification ages, but the method it teaches does not.
i2 Analyst’s Notebook is built on the ELP methodology (entity, link, property): it turns reports, phone records, transactions and statements into charts where hidden relationships become visible. It was born in Cambridge in 1990, passed through ChoicePoint, Silver Lake and IBM, and since 2022 has been developed by i2 Group within Harris Computer. IBM once offered an official analyst certification for version 9, aimed at national security, law enforcement, defence and fraud professionals with at least six months of hands-on experience with the product. The credential has lost some of its market weight. The discipline it certified has not.
The thesis of this analysis is as follows: whoever understands i2 understands the grammar of link analysis, and that grammar is the same one used by today’s AI-powered platforms. Analysts who skip that foundation will know which buttons to press, but not how to challenge what the machine shows them. And in intelligence, a poorly validated link is not a technical error: it is a wrong decision.
in Cambridge (United Kingdom)
i2 user organisations
between 2005 and 2022
to Saddam in his network
These four figures sum up the story. A British tool created for police investigations ended up in more than two thousand organisations across 149 countries, including most NATO members. Its ownership has changed hands four times. And the method it popularised proved decisive in one of the best-known intelligence operations of the century: locating Saddam Hussein, whose network of 214 actors had only 23 direct connections to him.
“We don’t teach a junior analyst i2 so they can use a piece of software. We teach it so they learn to think in entities, links and evidence. Once they understand why a line on a chart has to be backed by a source, they are ready for any platform that comes next.”
— Antonio García, Senior Operations Coordinator (GPC), ACK3® · Academy
What i2 is and why it defined an era
i2 Limited was founded in 1990 by Mike Hunter and Tim Spiers. Its first products, i2 Link Notebook and i2 Case Notebook, were eventually deployed across every police force in the United Kingdom and, in many stations, were the reason the first computer for analysts was installed. Counter-terrorism agencies, military intelligence, defence and fraud departments followed. The US Army integrated it into its Distributed Common Ground System intelligence system until 2011.
The ELP grammar: entity, link, property
i2’s contribution was not merely technical. It was a common language. A person, a company, a phone, an account or a vehicle are entities. A call, a transfer or a meeting are links. The date, the amount or the reliability of the source are properties. With that grammar, an analyst in Madrid and another in Brussels can read the same chart without explanation. That standardisation is what made i2 a benchmark, and it is what still holds value today.
From tool to de facto standard
For years, “doing an i2” was shorthand for building a link chart in police forces, intelligence services and compliance units. Many tenders and job postings required proficiency in Analyst’s Notebook. The certification served as objective proof that the candidate could structure complex information, not just read it.
From Cambridge to Harris: the i2 timeline
i2’s corporate history explains much of today’s debate about its relevance. Every change of ownership brought changes in product, support and certification.
| Year | Milestone | What it means for the analyst |
|---|---|---|
| 1990 | i2 Limited founded in Cambridge by Mike Hunter and Tim Spiers. | Born as a police tool. Its logic is investigative, not commercial. |
| 2005 | Acquired by ChoicePoint. | First step into the commercial data market. |
| 2008 | Bought by private equity firm Silver Lake for USD 185 million. | i2 becomes a financial asset as well as a technological one. |
| 2011 | IBM acquires i2 for an estimated USD 500 million. That same year, i2 reaches a USD 10 million out-of-court settlement with Palantir after suing it for misuse of its code. | Official IBM certification arrives. The market confirms that link analysis is a strategic asset. |
| 2022 | IBM sells the entire i2 family to Harris Computer, a subsidiary of Constellation Software. | IBM certifications remain tied to earlier versions. Training moves to i2 Group. |
Cases that proved the value of link analysis
Link analysis did not earn its reputation in manuals. It earned it in real operations, where connecting the right dots changed the outcome.
| Case | What was done | Lesson for today |
|---|---|---|
| Capture of Saddam Hussein (2003) | Analysts from the 4th Infantry Division and Task Force 121 abandoned the search through political office-holders and built link charts on five families close to Saddam since his youth. Major Brian J. Reed and analyst Eric Maddox played key roles. | The target is not always in the formal hierarchy. It is in the network of trust. |
| The 9/11 network (2001–2002) | Valdis Krebs used open sources to reconstruct the network of the 19 hijackers and measure its centrality. His work became the most widely cited public analysis of that network. | Well-structured OSINT can reconstruct a covert network. But Krebs warned that mapping after the fact is easy; prevention is far harder. |
| British police (1990s) | Every police force in the United Kingdom adopted i2 for complex criminal investigations. | A shared standard multiplies the capacity for collaboration between units and countries. |
| i2 v. Palantir (2011) | i2 sued Palantir for fraud and copyright infringement over its technology. The case was closed with a USD 10 million out-of-court settlement. | The new generation of platforms did not appear out of nowhere. It inherits the logic that i2 standardised. |
Is i2 certification obsolete?
The answer depends on what is being certified. IBM-era certifications, such as those for versions 8.9 and 9, accredit proficiency in a specific version of a product that IBM no longer manages. In that sense, they have lost relevance as a market credential. i2 Group now runs its own training offering for Analyst’s Notebook, iBase and TextChart, and the International Association of Crime Analysts (IACA) offers an i2 basic certification. The tool is still alive. What has changed is the ecosystem around it.
For today’s analyst, what matters is not the diploma, but the competencies that diploma was meant to demonstrate.
| Element | Relevance | Why |
|---|---|---|
| IBM version certification | Low | Accredits a product version from a previous corporate era. Useful as background, not as a differentiator. |
| Interface proficiency | Medium | Still useful in organisations that use i2, but easily transferable to other platforms. |
| ELP methodology and charting conventions | High | It is the common language of link analysis. Every modern platform inherits it. |
| Source evaluation and traceability | High | With AI generating links automatically, knowing where each relationship comes from is more critical than ever. |
| Network analysis and centrality | High | Identifying key nodes, brokers and breaking points is the foundation of due diligence, anti-fraud and counter-intelligence. |
“Artificial intelligence can suggest a hundred links in seconds. The problem is that ten may be false and one may cost you a client or an operation. An analyst trained on i2 knows that every line needs a source, a date and a reliability grade. That discipline is exactly what is missing in many teams that start straight away with automated tools.”
— Antonio García, Senior Operations Coordinator (GPC), ACK3® · Due Diligence
US military intelligence realised that the former regime’s political leaders were not the best path to Saddam Hussein. Analysts focused on his personal connections and built link diagrams of his family and tribal network until they located him in December 2003.
Analysing a covert network after an attack is relatively straightforward for prosecution purposes. Mapping it in time to prevent the attack is far harder, because the data is always incomplete and the boundaries of the network are fuzzy.
— Valdis Krebs — Mapping Networks of Terrorist Cells · Connections (INSNA, 2002)
i2 Group runs an academic programme that allows accredited universities to use its software free of charge in criminology, forensic analysis and intelligence analysis degrees, with the aim of training future analysts on real-world tools.
The most common framing error
Confusing the tool with the method. Whoever dismisses i2 because “there’s AI now” also dismisses the discipline needed to audit that AI. Platforms change every few years; the entity, link and property logic has remained intact for more than three decades. An analyst who masters the method adapts to any software. One who only masters the software becomes obsolete with the next release.
IAP™: the i2 method in today’s language
At ACK3® we built the Intelligence Analysis Platform (IAP™) on that premise. Our aim was not to replace the logic that i2 turned into a standard, but to bring it into a modern environment. The entity, link and property grammar remains the core of the analysis. What changes is everything around it: integration of multiple sources, from digital footprint and OSINT to geopolitical developments and market movements; algorithms and artificial intelligence to process large volumes of data; a dynamic dashboard with a real-time view; automated alerts; advanced visualisation tools and customisable reports.
The result is that an analyst trained on i2 does not start from scratch, and a new analyst learns the right method from day one, with human judgement in command. The IAP™ is also the analytical backbone of the ACK3® Global Hybrid SOC, where cyber, physical and geopolitical information is integrated to anticipate threats and support decision-making.
| Dimension | Classic i2 approach | ACK3® IAP™ approach |
|---|---|---|
| Method | Entity, link and property as the basis of the chart. | The same ELP logic, retained as the analytical core. |
| Sources | Manual loading or import of structured records. | Continuous integration of digital, geopolitical, market and network sources. |
| Processing | Chart built by the analyst. | Algorithms and artificial intelligence that suggest relationships, always validated by the analyst. |
| Time | Case-by-case analysis, investigation-oriented. | Real-time dashboard and alerts for anticipation and early warning. |
| Output | Charts for the investigator or the court. | Customisable reports geared to executive decision-making. |
This is also the approach we apply to training our own teams. To learn how we develop analysts from day one with real clients and operational methodology, read our article on intelligence consulting and analyst development.
Frequently asked questions about i2 certification
Is i2 Analyst’s Notebook certification still worthwhile?
Yes, especially for working in law enforcement, defence or anti-fraud units that use the tool. But its greatest value lies in the methodology it teaches, which transfers to any link analysis platform.
What happened to the IBM certification?
IBM sold the i2 family to Harris Computer in 2022. Its certifications are tied to specific product versions from the IBM era. Training is now delivered by i2 Group, and organisations such as IACA offer their own certifications.
What should an intelligence analyst learn today besides i2?
Network analysis, source evaluation, OSINT, working with AI-enabled platforms and, above all, the ability to validate and explain every conclusion to whoever has to make the decision.
Does your team analyse links or just visualise them?
ACK3® combines proven intelligence methodology, proprietary technology and operationally experienced analysts to turn scattered data into decisions.
| ACK3® solution | What it delivers |
|---|---|
| Intelligence Analysis Platform (IAP™) | AI-powered multi-source link analysis, real-time dashboard, alerts and decision-oriented reporting. |
| Due Diligence and economic intelligence | Mapping of actors, corporate networks and cross-interests among partners, suppliers and investment targets. |
| Global Hybrid SOC | 24/7 monitoring integrating the cyber, physical and geopolitical domains to anticipate threats. |
| ACK3® Academy | Analyst training in link analysis methodology, source evaluation and critical use of AI-enabled tools. |
Tools change. The method that connects the right dots endures.
