A contraband phone is found in a cell. A drone carrying drugs is intercepted. A violent assault takes place. A prisoner receives an unusual payment.
Each requires an immediate response. But if you lead prison intelligence, there is another question worth asking: What does this incident reveal about the network behind it?
The phone may connect a prisoner to an external associate. A drone drop may be one of several deliveries. An assault that appears isolated may be connected to debt, intimidation, gang activity or wider criminal activity.
Prisons already hold a huge amount of intelligence. The challenge is connecting those pieces together to understand where the greatest risks lie and where to intervene.
The shift is simple. Investigate the incident but understand the network.
For prison intelligence leaders, that can change where you focus limited resources and how early you can act.
In this blog, we look at five questions your intelligence picture should answer, what the current security guidance means in practice, and what real investigations can teach us about disrupting criminal networks.
Criminal groups adapt quickly. So do the methods they use to communicate, move illicit goods and coordinate criminal activity.
Drone smuggling is a good example. In England and Wales, 1,712 prison drone incidents were recorded in 2025, a 43% increase on the previous year. The latest figures show incidents fell by 13% in 2026 but remained above levels seen only a few years ago1. Authorities have linked drones to organised crime groups moving drugs, weapons and mobile phones into prisons.
Drugs remain another major concern. HM Inspectorate of Prisons reported in 2026 that 41% of men and 38% of women surveyed during its inspections said drugs were easy to obtain in their prison. Inspectors also reported organised crime groups using sophisticated drones to deliver drugs, steroids and mobile phones.2
While these figures come from England and Wales, the challenge of organised crime operating through and beyond prisons is much broader.
The United Nations Office on Drugs and Crime (UNODC) has highlighted the role prison intelligence can play in identifying organised crime groups, their leaders and facilitators, and criminal activity directed from within prisons.3
EuroPris has also made organised crime a focus of its 2026 prison security guidance, including prison intelligence, high-risk prisoners and cooperation between agencies.4
For those responsible for putting that guidance into practice, the implication is practical: build a stronger information position around high-risk individuals and networks, monitor activity across incidents rather than in isolation, and make intelligence easier to share with police and other agencies.
Physical incarceration does not necessarily mean criminal isolation. A criminal operation might connect a prisoner to an external associate, a phone, a payment, a supplier and another prisoner in another facility.
Stopping the contraband matters. Understanding the network that put it there matters even more.
You may already have much of the information needed to understand the networks operating around your prisons.
It can sit across prisoner records, incident reports, cell searches, visitor logs, communications, financial transactions, staff observations, gang intelligence, device forensics and information from police or other agencies. The challenge is that these pieces don't always look significant on their own.
An incident report identifies a prisoner. A visitor record identifies an associate. Phone data reveals repeated contact. A financial transaction introduces another person. A previous contraband seizure points to the same address.
Individually, they may not mean much. Together, they may tell a very different story. As the real-world investigations later in this article show, those connections can expose the network behind the incident and support disruption beyond the prison.
Take a contraband phone. Finding and removing it solves the immediate security problem. But what else can it tell you?
Who was using it? Who were they communicating with? Do those numbers appear in other investigations? Are the contacts connected to other prisoners? Do visits or financial activity support those relationships? Is someone acting as an intermediary between groups that otherwise appear unrelated?
This is where the incident becomes an intelligence opportunity.
Instead of looking only at who was involved, you can start looking at who connects multiple incidents. Instead of asking only what happened, you can explore who is influencing whom, how the activity is being enabled and where the network extends next.
Seeing the connections is only useful if they help you and your team understand what they mean and where to focus next.
A single incident rarely tells the whole story. These five questions help your team move from isolated events to the network behind them.
Look for people who recur across contraband seizures, violence, communications, financial activity and visits. Someone who seems peripheral in one investigation may turn out to be central when you view several together.
The most visible prisoner isn't always the one directing activity. Map relationships to find who gives instructions, who passes messages on, who acts as a go-between, and who may be exploited or coerced.
Check whether the same external contacts, addresses, phone numbers, accounts or visitors appear around multiple prisoners. These links can tie activity inside to organised crime in the community.
Compare incidents for recurring locations, times, people and methods. Drones, visits, mail, corrupt facilitators and external drops may be parts of one supply chain rather than separate problems.
Past incidents can signal future harm. Patterns of debt, intimidation, communications, associations or movement show where closer attention, or early intervention, is needed.
These questions move the intelligence conversation from “What happened?” towards “What is connected, what does it mean and where should we focus next?” They also reflect the direction of modern prison security guidance, which is to develop a stronger intelligence picture around high-risk prisoners and criminal networks, assess activity broadly and strengthen interagency cooperation.4 That cooperation matters because the networks themselves operate across organisational boundaries. Intelligence held by prison services may connect with information held by law enforcement or judicial partners, helping agencies build a more complete picture of the people, relationships and activity behind organised crime.
We can see this approach in real prison investigations.
At one i2 customer in North America, several officers were hospitalised after handling a newspaper suspected of being soaked in drugs. What began as a single contraband incident exposed wider drug-trafficking activity. Analysts connected phone calls, financial transactions and external associates, identifying another prisoner as a key figure in the network. The resulting intelligence was shared with law enforcement to support the wider investigation.
A separate UK investigation shows the same principle. Investigators brought together drone evidence, phone data, financial activity and information about people operating inside and outside prisons. They linked 49 drone flights to an organised network operating across several facilities. The gang was dismantled, with 11 members receiving sentences totalling more than 32 years.5
Bringing this picture together manually across incident reports, communications, financial activity, device data and other sources quickly becomes difficult at scale. Analytical technology can help bring those connections into view. Connecting information can reveal who sits behind an incident. Looking at activity over time can show how a network operates. Adding location can expose recurring routes, hotspots or links between people and places.
But technology is only part of the equation. Effective prison intelligence still depends on experienced people, good intelligence collection, clear priorities, strong governance and collaboration between prisons, police and other agencies.
The objective is not better charts. It is better decisions.
For intelligence leaders, understanding the network matters when it changes what you do next.
A clearer intelligence picture can help you prioritise high-risk networks, target recurring contraband routes, identify influential individuals and facilitators, and give law enforcement partners better intelligence on activity extending beyond prison walls.
Modern prison security guidance increasingly points towards a more connected intelligence approach: understand high-risk prisoners and networks, maintain a strong information position and work effectively across agencies.
The question is whether your current approach gives your team the connected intelligence they need to do that.
Can you connect intelligence across incidents and sources? Identify who influences or facilitates activity? See where networks cross prison walls and share that intelligence with the right partners?
Improving those capabilities can help you focus limited resources, intervene earlier and build stronger investigations, creating more opportunities to disrupt organised crime inside and beyond prison walls.
Exploring how to strengthen intelligence-led investigations across your prison service? Talk to an i2 intelligence expert.
1 HM Prison and Probation Service, HMPPS Annual Digest 2025 to 2026. Recorded drone incidents decreased from 1,712 in the 12 months to March 2025 to 1,497 in the 12 months to March 2026, a 13% decrease; the 1,712 figure was 43% higher than the previous year.
2 HM Inspectorate of Prisons, Annual Report 2025–26 (published 7 July 2026). In inspection reports published between April 2025 and March 2026, 41% of men and 38% of women said drugs were easy to obtain; inspectors also reported sophisticated drone deliveries by organised crime groups.
3 United Nations Office on Drugs and Crime, Handbook on Dynamic Security and Prison Intelligence (2015). The handbook describes prison intelligence as supporting the identification of organised criminal groups, leaders and facilitators, and the prevention of criminal activity directed from prison.
4 EuroPris, Prison Security Handbook: Strengthening Responses to Organised Crime Within European Prisons (2026). The handbook covers prison intelligence systems, management of high-risk prisoners and interagency cooperation, and stresses a strong information position and collaboration between prison authorities and other agencies.
5 UK Ministry of Justice, “Major investigation smashes nationwide prison drone gang” (14 December 2017). Investigators linked 49 drone flights to the organised gang; 11 members received sentences totalling more than 32 years.