FM 2 22 2 Counterintelligence 2009

Document text

FM 2-22.2 (FM 34-60) 


Counterintelligence 


October 2009 


DISTRIBUTION RESTRICTION: Distribution authorized to U.S. Government agencies only because it requires 
protection in accordance with AR 380-5 or as specified by DCS G-3 Message DTG 091913Z MAR04. This 

determination was made on 22 May 2008. Contractor and other requests must be referred to ATTN: ATZS-CDI-D, 
U.S. Army Intelligence Center, Fort Huachuca, AZ 85613-7017, or via email at [email protected]. 


DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the 
document in accordance with AR 380-5. 


Headquarters, Department of the Army 


FOR OFFICIAL USE ONLY 


This publication is available at: 


Army Knowledge Online 
(www.us.army.mil) 
General Dennis J. Reimer 
Training and Doctrine Digital Library 
(http://www.train.army.mil) 


United States Army Publishing Agency 
(http://www.army.mil/usapa) 


*FM 2-22.2 (FM 34-60) 


Field Manual Headquarters 
Department of the Army 

No. 2-22.2 (34-60 
ü ( ) Washington, DC, 21 October 2009 


Counterintelligence 


Contents 
Page 
PREFAGE E se ccucnccestceed sestcevadieruueeunccecustcentueescceeestce ruveuarscucveseuereugny teeth vii 
Chapter 1 COUNTERINTELLIGENCE MISSION, STRUCTURE, AND 
ORGANIZATION oecice.sctecceseccccenssctiecuneccttecvecnttecuscctiecuseatiectsccutesvesstivenvestiedes editions 1-1 
Army Counterintelligence «0.0... ecceecieeeeeeeeeeeneeeeeeneeeeeeaeeeeeeaeeeseeieeeeeeeneeeeeeaas 1-1 
Counterintelligence Special Agent ........ssusssseseerransssnnnresnnannnnnnatennaanannantennnaananna ae 1-1 
Tenets of Counterintelligence..........essesssrresesrranssrnanseennnnnannantennaanannaneennaanannnaneenaa 1-1 
Counterintelligence Core Competencies .........eessesssssresesrrenrsrnnseennaarannanennnaanannaae 1-3 
Counterintelligence MISSION .essireinianininnnn ninakaa Eiana aK RANNER 1-4 
Counterintelligence Structure .......ssseeerseessrissseerirernredirnesrinadarnransnnnnaatannaneinnnaaa 1-5 
OX E E E Benen A T T 1-6 
Counterintelligence Coordinating Authority ..........sseeeesseseesesrrsserreseeerrsserrssrernsns 1-7 
U.S. and Department of Defense Counterintelligence Community.............. 1-13 
Army Counterintelligence Levels of Employment..........0..::cccccesseeeeeeeeeteeeeenes 1-14 
Chapter 2 COUNTERINTELLIGENCE INVESTIGATIONG..........:cccssseeeeeeseeeeeenseeeeeeneneeeees 2-1 
Investigative Personnel .........:ccceceeeeeeeeeee teeter ee eeeaeeeeeeaeeeeeeaeeeseeaeeeeeeenaeeeeseaas 2-1 
Counterintelligence Investigation Objectives... ee eeceeeestteeeeeeeteeeeeetteeeeees 2-1 
Investigative Authority 00.0... eee ee eeeeee eee eeenneeeeeeeaeeeeeeaeeeseeaeeeeeeeaeeeeeenieeeeneaas 2-2 
Counterintelligence Investigative JULISCICTION. ..0...... cc eeeeeeeetteeeeeenteeeertttteeeeees 2-3 
Incidents of Counterintelligence Interest ......... ee ceeceeeneeeeeeeeneeeeeeeeeeeeeenneeeeeaas 2-4 
Counterintelligence Investigative Control and Oversight .........0.:::ccseeeeeeeeeee 2-6 
Counterintelligence Investigation Types and Categories .............ccceeteereeees 2-7 
Investigative: PROCESS? iv.ievesdsadeesandedevnecvey i R a R 2-10 
Records: Checks ieisteiietsieesitiae sence nid EEEE 2-21 
Counterintelligence Interviews 0.0... cecceceeeeeeeeeeeeseeeeeeeeeeeeeeseeeeeeetenaeeeseenaees 2-27 
Counterintelligence Investigative Reports and Files ............eceeeeeeeeeeeeeees 2-43 


DISTRIBUTION RESTRICTION: Distribution authorized to U.S. Government agencies only because it requires 
protection in accordance with AR 380-5 or as specified by DCS G-3 Message DTG 091913Z MARO04. This 
determination was made on 22 May 2008. Contractor and other requests must be referred to ATTN: ATZS-CDI-D, 
U.S. Army Intelligence Center, Fort Huachuca, AZ 85613-7017, or via email at [email protected]. 


DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the 
document in accordance with AR 380-5. 


*This publication supersedes FM 34-60, 3 October 1995. 


FOR OFFICIAL USE ONLY 


Contents 


Chapter 3 COUNTERINTELLIGENCE OPERATIONS ..........csecccceseeeeeeeseeeeeeeseeeeeeeeseeneeeseees 3-1 
General nsina ys ites dicate ornate eel oe aee Nee said gtd oe et eas Aes ale teed Slat 3-1 
Advice and Assistance Programs ...........:ccccecccctieeeeeeeneeeeeeeieeeeetneeeeeetneeeeetieeeees 3-1 
Covering Agent: Program..;.c:.54 istvenldiveatie iden a Alaa did 3-2 
Counterintelligence Support to Research and Technology Protection............... 3-2 
Counterintelligence Support to Acquisition and Special Access Programs........ 3-3 
Counterintelligence Red Team Operations ...........ccccccceeeceeeeeeeeeeeeeeneeeeeenneeeeeeaes 3-3 
Counterintelligence Support to Treaty Verification ......... ee eeeeeeeeeeeeeeeteeeeeeenaes 3-4 
Counterintelligence Support to Antiterrorism and Protection............00:::::ccee 3-4 
Threat Assessments and Vulnerability Assessment .............cccceeeeeeeeeeeeteeeeeeeees 3-5 
Counterintelligence Support to Homeland Defense and Civil Support 
Sara TO DEEE AA hana a Se oes eet ha aaa oe oss igs eee sha eats EAA 3-6 
Counterintelligence Support to Joint Terrorism Task Force .............:::::ccceeeeeee 3-7 
Counterintelligence Support to Counterdrug Operations.................::::eceeeeeeees 3-7 
Counterintelligence Support to Information Superiority ...............:::::seeeeeeeeeeee 3-7 
Counterintelligence Support to Military Deception...........0......:cccceeeeceeeeeeeeeeeteees 3-8 
Counterintelligence Support to Psychological Operations... 3-9 
Counterintelligence Support to Electronic Warfare..............0.:.ccccceceseceeeeeeeeeteees 3-9 
Counterintelligence Support to Operations Security...............:::ccceeeeeesteeeeeeeees 3-10 
Counterintelligence Support to Counterpropaganda .............::::ccceceeeeseeeeeeeeees 3-10 
Counterintelligence Support to Counterdeception ...............::::cccceeeeeseeeeeeteeeees 3-11 
Counterintelligence Support to Physical Security «0.0... eeceeeeseseeeeeeeeteeeeeees 3-11 
Counterintelligence Support to Physical Destruction ........... cc ceeeeeeeenteeeeenees 3-11 
Counterintelligence Support to Information Assurance .............ccceeeeeeeereeeeeees 3-12 
Counterintelligence Support to Civil-Military Operations ...............:eeeeeeeees 3-12 
Counterintelligence Support to Public Affairs ........0.....:ccccceceeceeeeeeeeeeeeeteeeeeeeeees 3-13 
Counterintelligence Support to Computer Network Operations..............:::::06 3-13 

Chapter 4 COUNTERINTELLIGENCE COLLECTION PROGRAM ........:cccesseeteeeseereeeeseees 4-1 
GOMOR As. traces ETE AAE A E EA AE ASET 4-1 
Counterintelligence Collection Program .......sesssssesrisseerssserrssrtrrssrtrrssrerrssrernssnt 4-2 
Counterintelligence Debriefings, Screening, and Liaison ..........eeeeeeeeeeeeeeeeeeene 4-3 
Control of Source Information ..............:::cccccceeeeeeeeeeceeceeeeeeeeecaeeeeeeeeesetseestnaneeeees 4-10 
Unit Counterintelligence Requirements Management ............:::eceeeeesteeeeeeees 4-11 
Standing Counterintelligence Collection Requirements... 4-12 
Counterintelligence Support to Threat and Vulnerability Assessments............ 4-12 

Chapter 5 ANALYSIS, TOOLS, AND PRODUCTION .........cceccsssseeeeesseeeeeeseeeeeeeeeseeeeenesseeees 5-1 
Generalaren e ela eae ela ee ee 5-1 
Anomalies, Signatures, and Patterns. .............0..:cccccceseceeceeeeeeeeeeeeneecaeeeeeeeeeeeenaees 5-3 
Counterintelligence Threat Analysis ...........:cecceceeseeeeeeeeeeeeeeeeeeeseeneeeeeeeneeeeeeaas 5-3 
Counterintelligence Support to Intelligence Preparation of the Battlefield.......... 5-5 
Counterintelligence Operational Analysis .............cccceeeeseeceeeeeeeeeeeenteeeeeeeneeeeeeaas 5-8 
Analytical Tools:c.ssi5 tiie weds cae Sas Aad et Aaa ales ae ae 5-9 
PROGUCUON E eset E A Acetate Soe ese Se eS ee Aen ea gan 5-20 

ii FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Contents 


Chapter 6 TECHNICAL COUNTERINTELLIGENCE SERVICES AND SUPPORT............ 6-1 
Technical Investigative Techniques ..0........c:ceceeeceeeeeeeeeeeeseeeeeeeteeeeeeseeaaeeeeeeaaees 6-1 
Electronic Surveillance seda a E ca Rind eel eee eee 6-1 
Investigative Photography and Video Recording ............:ceeeeseeeeeeeeeeeeeenteeeeeeaes 6-2 
LaboratorysAnalysis oin a cceuriads cles evdee tanh teva ee teed even eee en eee ete 6-2 
Polygraph Supporte iso eee ahead eins aa edie elated 6-2 
Technical Surveillance and Countermeasures Program. ..........eceeecceeeeeeeeeeneees 6-5 
Deception Identification and Detection (Biometrics) .......0...cceeeeeeeeeeetteeeeeeeee 6-7 
Computer ForenSiCS isernia ed ete nie dee ea ate 6-8 
Support to Information Tasks (Computer Network Operations)..............::00065 6-9 
Chapter 7 CYBER COUNTERINTELLIGENCE.........cccccssseeeceeeeeeeeeseeneeeeseeneeeaseeneeenseeeeeenss 7-1 
GO eal aes haved case ae eae scutes ta cat Be ta tuck causa pee ccs Scat N ened eta ee 7-1 
Cyber Counterintelligence Support to Core Functions ..........eeeeeeeeeeeesserreseeeeees 7-1 
Cyber Threat BrigfingS soreer Ai neiaa R Ea A aE AREE AR AS a TERANE ais 7-5 
Computer Network Incident Categories ...........esssseeeesssireseerrsserrrrsstrrssrirnssrrrnssne 7-6 
Cyber Indicators of Counterintelligence Interest ...........eeeeeeeeeesreeeeerresrereserree 7-8 
Recognizing Potential Evidence .......e.cssesrecsiricrrireerirrriserraadieiredreineetineneinnaaaiiea 7-9 
Search and SoU Onenean a E ARA dea ARAA 7-9 
Chapter 8 INVESTIGATIVE LEGAL PRINCIPLES ..........ccccccesseneeeeseeeeeeeseeneeenseeneeeenseeneeens 8-1 
Inteligence Oversight 2 sce. clekec eae elelecelaee eee eececehes bec eden cate deveeliuecedeateseussueledenvaades 8-1 
JUPISGICUON E E Ae ee a is a A 8-2 
Criimimal Paws ia nn vids do ushed fo inde deva nad de paned T TA 8-4 
EVOO oeri 5 fs tates ce Ashita EA tibet Mabe caret TA 8-5 
RightSAmendmenite:s:-si.as feuecteateciat A A R vinceealvsantiad ATE 8-8 
Investigative Authority .............ccccceeeeececceceeeeeeeeeeceecaeeeeeeeeesecaeeeeeeeeeeeesensuaeeeeees 8-12 
Crimes and Incidents Within Counterintelligence Investigative Jurisdiction .... 8-16 
Chapter 9 COUNTERINTELLIGENCE REPORTING..........cccccssseeecessseeeeeseseeeeeneeseeeeenseenes 9-1 
Tenets of Reporting isis: is aoe ee eis eee le 9-1 
Reports: Management oesi aana eren ea Meee steeds ee devetetee ea ded ea eee eats 9-1 
Report: Categories. ar a ae caceviag! EEE ceded trade eee tens eed deren 9-2 
Reporting: Architecture’ neia a ariel annien erie ates 9-4 
Information Sharing and Release 00.0... eeceeeeeceeeeeneeeeeeeeeeeseeneeeeeecaeeeeeenaeeeeteaas 9-6 
Appendix A COUNTERINTELLIGENCE PROGRAM ADMINISTRATION ..........cssecsseseeeens A-1 
Appendix B CONTRACTOR SUPPORT TO COUNTERINTELLIGENCE ACTIVITIES........ B-1 
Appendix C INTERPRETER SUPPORT TO COUNTERINTELLIGENCE ACTIVITIES ....... C-1 
Appendix D FBI DELIMITATIONS AGREEMENT. ..........:cccccsssereeseseeeseeneeeeeeeseeneeeesesnensneseeenens D-1 
Appendix E COUNTERINTELLIGENCE INVESTIGATIVE REPORT WRITING GUIDE .....E-1 
Appendix F PREDEPLOYMENT AND MISSION PLANNING ........ccccssseeesesseeeeeesseeeseeeeeenens F-1 
Appendix G COUNTERINTELLIGENCE SUPPORT TO MULTINATIONAL 
OPERATIONS vrara aenea rinane ekara r ONALAR N EEr ARANEA AEE PAE EA ESRA EEE cxpaeceets G-1 
Appendix H AUTOMATION, COMMUNICATION, AND EQUIPMENT ..........:cccsssseeeseseeeeens H-1 
Appendix | COUNTERINTELLIGENCE SPECIAL AGENT APPLICATION 
INFORMATION. PACKET 2... ccsscecccecetceeceeseccecesstececesstncecsstceeeseceeeeresneeeesseneceeerests 1-1 
21 October 2009 FM 2-22.2 iii 


FOR OFFICIAL USE ONLY 


Contents 


Appendix J 


UNIT CUSTODIAN BADGE AND CREDENTIALS HANDBOOK ..................55 J-1 

GLOSSARY. uira AE a A TA Glossary-1 

REFERENCES AE EA E E EEEE Nee E EEE aedke References-1 

STB) => SEE EEE S E E E EE E E tee Index-1 
Figures 


Figure 1-1. 


Neutralization versus exploitation...............ccccececceceeeeeeeeeeeeeeeeeeeseeeeaeeeeeeeeeeseteenaees 1-2 


Figure t2. 2X OFQANIZAtION rerea enaA A eae gees each aati Se A AAS is thee ARAA EE AERA 1-7 
Figure 2-1. Investigative life CyCle osoric a 2-11 
Figure 2-2. Indicators Of CSPIONAGE serite esaia a E E EEEREN ENEA 2-13 
Figure 2-3. Example of an interview room Setup .............::::cccccceeeeeeeeeeeceeeeeeeeeeseeeenaeeeeeeeetees 2-33 
Figure 3-1. Counterintelligence Operations ......... cc cece eeeeeeeeeeeeeeeeteneeeeeeteeeeetieeeeetieeeeees 3-2 
Figure 3-2. Counterintelligence support to Army information tasks... 3-8 
Figure 5-1: lntelligenee Process. orisirisi aT Aar AEA AATE REAA dee Mace AAEREN EARR 5-1 
Figure 5-2. Example of a time event Chart... eee eeeeeeeeeeneeeeeeeneeeeeeaeeeeeeaeeeeeeneeeesenaees 5-10 
Figure 5-3. Analysis Notebook theme line chart 0.0.0... cccceeeeeeeeeeeeeeeeeeeeeeeeeeeaeeeeeeaeeeeeeaaees 5-10 
Figure 5-4. Example of an association Matrix............sseeesssssieseerresrrrrrettrrsstnnsstnnssernssrennnat 5-11 
Figure 5-5. Example of an association matrix symbology .........sssssessssrrsserrrsseerrrssrrrrsserrss 5-11 
Figure 5-6. Example of an activities Matrix ............eseessseeesssrneseeerresttrrttttrrssttrnssttrrsstnnsssrennne 5-12 
Figure 5-7. Example of a link analysis diagram ...........cccecceeeeeeeeeeeeeeeeeeeteeeeteeeeeeeeeeeaeereeeenaees 5-13 
Figure 5-8. Example showing deceased Person..........eeccccccceceeeeseeeeeeeseeeeeeeteeneeeeeeeeaeeeeeeaaees 5-14 
Figure 5-9. Example of person with suspected alias ................cccceccecseceeceeeeeeeeeeeeeneeeeeeeeeeeees 5-14 
Figure 5-10. Example of person with confirmed aliaS................:ccccccccceeceeeeeeeeseeeeeeeeeeeeeeteees 5-14 
Figure 5-11. Example of nonpersonal entity ........0..ceceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaeeeseeaeeeeeeeaees 5-14 
Figure 5-12. Confirmed linkage...........ececceceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeaeeeseeeeeeeeseeeaeeeseeaeeeseeaaees 5-14 
Figure 5-13. Suspected linkage ........ ee eeeeeceeeeeeeeeceeeeeeeeeeeeeeeeeneeeeeeeeeaaeeeeeeeeeeeseeeaeeeseeeeeeeeeeaees 5-15 
Figure 5-14. Legend on Connectivity line 2... eee eeeceeee scence eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaeeeeeenaees 5-15 
Figure 5-15. Connectivity between Persons ........ cc ceeeeeeeeeeeeeeeeeeeeeeeteeeeeeeteeeeaeeeteeaeeeseeaaees 5-15 
Figure 5-16. Example of mutually associated MEMbETS............:eeeeeceeeeeeeeeeeeeeeeeeeeeeeeeeeaaees 5-16 
Figure 5-17. Connection between organizations and event...........:ceeeeceeeeeeeeeenteeeeeeaees 5-16 
Figure 5-18. Connectivity between persons but not the organization... 5-17 
Figure 5-19. Association with an entity 0.0... eee eeeen ee eeenceeeeeeaeeeeeeaeeeeeeaeeeseeneeeeeneaaes 5-17 
Figure 5-20. Person with greatest number of personal associations.............::cceeeeeeeeeeeees 5-17 
Figure 5-21. Person with next highest number of personal associations .............:: cee 5-18 
Figure 5-22. Confirmed personal ASSOCIATIONS ............eeeeeceeeeeeeeeeeeee eee teeeeeeeteeeaeeeeeeeaeeeeeenaees 5-18 
Figure 5-23. Example of activities, organization, and nonpersonal entities.................006 5-18 
Figure 5-24. Analyst Notebook link diagram showing information from an activity 
EE E E E A T E TA PE E PE I E E E E 5-19 
Figure 5-25. Analyst Notebook link diagram showing nonpersonal relationship ................. 5-19 
FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Contents 


Figure 5-26. Analyst Notebook hierarchy layout ............eccccceeeeeeeeeeeeeeeeeeeeneeeeeenaeeeeetnaeeeeeenaes 5-20 
Figure 9-1. Reporting architecture .........e cc cccceeeceeeeeeeeeeeeeeeeeeneaeeeseneaeeeseeeaeeeeeeeaeeseeeaeeeseeaaees 9-5 
Figure D-1. FBI delimitations agreement Content ....0.... cece eeeeeeeeenneeeeeenteeeeeenaeeeeeeenaeeeeeeaas D-1 
Figure E-1. Example of a Cl incident report ..............cccccceeeececeeceeeeeeeeeeeeenecaeeeeeeesetsnsuaeeeeeess E-16 
Figure E-2. Example of an IMFR— interview ..0.......ecccceeeceeeeeeeeeeeeeeeeeeeeeeeeaeeeeesnaeeeeeenaeeeeneaes E-24 
Figure E-3. Example of an IMFR—personnel files CHECKS. ..............:::c:s:ceecceeeeeeeeeeeeneeeeeeeeeees E-35 
Figure E-4. Example of an IMFR—records CheckS ........cccccceececeeeeeeeeeeeeeeneeeeeenaeeeeeenaeeeeseeaes E-39 
Figure E-5. Example of an IMFR—intelligence files checks .00.......eccceeeeteeeeeeeteeeeeettteeeeeaees E-41 
Figure E-6. Example of an IMFR—law enforcement records checks ...........::ccceeeeeeeeeeeenee E-43 
Figure E-7. Example of a transmittal letter for an ROI «0.0.0... cece eeeeeeeeeneeeeeeeneeeeeeneeeeeeenaes E-51 
Figure E-8. Example of an ROI enesenn aii aeiaai i Eie a E-52 
Figure. E-9. Example of an SOl oeeie aenieiai iiaeaae a aE a a eia eri E-55 
Figure E-10. Privacy Act of 1974 advisement statement .......... ce eeeeeeeeeteeeeeeeteeeeeeneeeeeeaes E-57 
Figure E-11. Perjury Warning ..........eececceeeeneeeeeeneeeeeeeaeeeeeeaaeeeeeeaaaeeeeeeaaeeeeeenaeeeeseiaeeeeeeceeeeeeaas E-58 
Figure E-12. Secrecy affirmation statement ....0..... cc ccecceeeeeeneeeeeeeneeeeeeeeeeeeesnaeeeeeenaeeeeneaes E-59 
Figure F-1. Appendix 3 (Cl) to Annex B (Intelligence) to an OPORD „osese F-4 
Figure l-1. Information sheet—Cl (MOS 35L) 00.0... eect eeeeeeeeeeeeeeeeeeeeeeeseeeeeeeseeaaeeeeeeaaees l-2 
Figure l-2. Applicant information Sheet................cccccccccceceeeeeeeeeeeeeeeeeeeeeeeneaeeeeeeeeesenencaeeeeeeeeeeees l-7 
Figure l-3. Cl special agent application—minimum qualifications...................::ceeeeeeeeeeeeeeeeee l-9 
Figure l-4. Cl applicant processing Checklist..............:::::cccecceeeeeeeceeceeeeeeeseeeaeaaeeeeeeeeeseesnnaeeeeees l-11 
Figure l-5. CI special agent applicant interview Process. ..............ccccccceeeeeecceeeeeeeseseetteeeeeeeess I-12 
Figure l-6. Orientation stateMent.......... ec ceecceeee eee eeeeeeeeeeeeeeeeaeeeeeeaeeeeeeaeeeeseaeeeeeeneeeeeeaas I-14 
Figure l-7. Instructions for the contingency statement and compositions ..............eeeee I-16 
Figure l-8. Final interview ...........cccecececeeeeeeeeeeeeeeeeeeeeaeeeeeeaeeeeeeaeeeeeeaeeeseenaeeeeeeceeeeseeneeeseeaes I-18 
Figure l-9. Final interview guide ..........::ceccceeeeeeeeeeeeneeeeeeeaeeeeeeaaeeeeeeaeeeeeeaeeeeeecaeeeeseniaeeeseeaas I-19 
Figure l-10. Cl applicant interview biographic sheet .................:::ccccceeeeeeeeeeeceeceeeeeeeeeestsaeeeeees I-22 
Figure I-11. Interviewing agent’s post-interview requirement ............:ceceeeeeeneeeeeeeenteeeeeeaes I-32 
Figure l-12. Statement of interview .0...... eee ee eeee ee ee entree ee eae ee eeeeaeeeeeeaaeeeeeeaeeeeeeneeeeneaas I-33 
Figure l-13. Cl applicant HRC memorandum ............::::cccceceeeeeececeeeeeeeeeeeseceneaeceeeeeeesecsusaneeeees I-38 
Figure J-1. Email receipt for badge and credentials materials shipped to a unit ................... J-3 
Figure J-2. Email receipt for Cl badge and credentials hand-carried to a unit........... ee J-4 
Figure J-3. Email 1 example—hand-carry transfer coordination process ...........::eeeeeeees J-6 
Figure J-4. Email 2 example—gaining unit responds to the initial email.........0. eee J-7 
Figure J-5. Email 3 example—hand-carry authorization email from ITRADS.......... ee J-7 
Figure J-6. Email 4 example—gaining unit receipts for the badge and credentials............... J-7 
Figure J-7. Email 5 example—ITRADS acknowledgment of transfer .......0... ec cceeeeeeeeeeeenees J-8 
Figure J-8. Unit badge and credentials inventory memorandum format ...........:::ceeeeereeeeetees J-9 
Figure J-9. Receipt and responsibility statement format ...........ecceeeeeeeteeeeeeteeeeeeteeeeeeeaaes J-11 
Figure J-10. Example of badge and credentials return memorandum format............::e J-13 
Figure J-11. Badge and credentials request memorandum format. ..........:c:ceeeeeeeeeeeseeeeeeees J-14 
21 October 2009 FM 2-22.2 v 


FOR OFFICIAL USE ONLY 


Contents 


vi 


Figure J-12. Request for USAI representative credentials ...............:::ccccecceeeeseceeceeeeeeeeeeneees J-15 
Figure J-13. Misuse of badge and credentials materials—initial report format................ J-16 
Figure J-14. Misuse of badge and credentials materials—final report format ...............08 J-17 
Figure J-15. Loss of badge and credentials materials—initial report format .......00... eee J-18 
Figure J-16. Loss of badge and credentials materials—final report format.........0...::ceeeee J-19 
Figure J-17. Additional duty appointment badge and credentials custodians ..............:06 J-20 
Figure J-18. Request to establish a USAI badge and credentials account .........0....eeeeeee J-21 
Figure J-19. Request for revalidation of badge and credentials account ...........eeeeeeeeeeeeees J-23 


Tables 


Table 1-1. Counterintelligence coordinating authority functions ......... eee eee eeteeeeenteeeeeeeeee 1-8 
Table 1-2. Operations support cell FUNCTIONS ............ cc ceecceeeeeeeeeeeceeeeeeeeeeeecceeaeeeeeeetetsenieaeeees 1-10 
Table 1-3. Operational management team FUNCTIONS. .......... eee ee eeteeeeeeeteeeeeetteeeeetnaeeeeeeaas 1-10 
Table 1-4. Counterintelligence team functions ......... ce eeeceeeenteeeeeeeeeeeeeeeneeeeettaeeeeeenaeeeeeeaas 1-12 
Table: E-t: Personai data arora iio es vances faevanteenenan T T O E-2 
Table E-2. Military ranks and civilian titles 0.00... eee eeeeene ee eeeeaeeeeeeaeeeeeeaeeeeeeenaeeeeeeaas E-4 
Table E-3. Physical descnptióm ornica aieiaa a ae A eA E-4 

FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Preface 


This manual provides doctrinal guidance, techniques, and procedures for the employment of counterintelligence 
(CI) special agents in the Army. It outlines— 


e CI investigations and operations. 
e The CI special agent’s role within the intelligence warfighting function. 


e The importance of aggressively countering foreign intelligence and security services (FISS) and 
international terrorist organizations (ITO). 


e The roles and responsibilities of those providing command, control, and technical support to CI 
investigations and operations. 


e The need for effective dissemination of CI reports and products and the importance of cross- 
cueing other intelligence disciplines. 


e The significance of cultural awareness as a consideration to counter the foreign intelligence threat. 


This manual expands upon the information in FM 2-0 and supersedes FM 34-60. It is consistent with doctrine in 
FM 3-0, FM 5-0, FM 100-15, and JP 2-0. When published, FM 2-22.2 will provide further information on CI 
activities when Army forces are employed in tactical operations. 


This manual provides the doctrinal guidance for CI special agents, commanders, and staffs of the military 
intelligence organizations responsible for planning and executing CI missions. It also serves as a reference for 
personnel developing doctrine and tactics, techniques, and procedures; materiel and force structure; institutional 
and unit training; and standing operating procedures for CI activities at all Army echelons. 


FM 2-22.2 is intended for use by CI special agents, commanders, staff officers, military intelligence personnel, 
and Government civilian and contract employees charged with responsibility for CI activities and operations. It 
is also intended for commanders and staffs of joint and multinational commands, U.S. Naval and Marine forces, 
units of the U.S. Air Force, and the military forces of multinational partners. This manual applies to the 
spectrum of conflict and operational themes. 


This manual applies to the Active Army, the Army National Guard/Army National Guard of the United States, 
and the U.S. Army Reserve unless otherwise stated, and Federal employees and contractor personnel employed 
by the Services to engage in CI activities. 


For the purposes of this manual, the term special agents or agents refers to an enlisted Soldier in military 
occupational specialty 35L, a warrant officer in WO area of concentration (AOC) 351L, a commissioned officer 
in AOC 35E, or their Federal civilian employee counterpart. 


Headquarters, U.S. Army Training and Doctrine Command is the proponent for this publication. The preparing 
agency is the U.S. Army Intelligence Center and Fort Huachuca. Send written comments and recommendations 
on DA Form 2028 (Recommended Changes to Publications and Blank Forms) directly to Commander, ATZS- 
CDI-D (FM 2-22.2), U.S. Army Intelligence Center, 550 Cibeque Street, Fort Huachuca, AZ 85613-7017: by 
email to [email protected] or submit an electronic DA Form 2028. 


21 October 2009 FM 2-22.2 vii 


FOR OFFICIAL USE ONLY 


This page intentionally left blank. 


Chapter 1 
Counterintelligence Mission, Structure, and Organization 


Counterintelligence is information gathered and activities conducted to identify, 
deceive, exploit, disrupt, or protect against espionage, other intelligence activities, 
sabotage, or assassinations conducted for or on behalf of foreign powers, 
organizations, or persons, or their agents, or international terrorist organizations or 
activities (EO 12333). 


Counterintelligence (CI) includes all actions taken to detect, identify, track, exploit, 
and neutralize the multidiscipline intelligence activities of adversaries. It is a key 
intelligence community contributor to protect U.S. interests and equities. 


ARMY COUNTERINTELLIGENCE 


1-1. CI focuses on negating, mitigating, or degrading the foreign intelligence and security services (FISS) 
and international terrorist organizations (ITO) collection threat that targets Army interests through the 
conduct of investigations, operations, collection, analysis, production, and technical services and support. 


1-2. CI analyzes the threats posed by FISS and the intelligence activities of nonstate actors such as 
organized crime, terrorist groups, and drug traffickers. CI analysis incorporates all-source information and 
the results of CI investigations and operations to support a multidiscipline analysis of the force protection 
threat. 


COUNTERINTELLIGENCE SPECIAL AGENT 


1-3. The CI special agent has the distinct mission of detecting, identifying, countering, and neutralizing 
FISS and ITO threats directed towards the Army through the execution of all CI functions. CI special 
agents should not be confused with human intelligence (HUMINT) collectors, military occupational 
specialty (MOS) 35M, and warrant officer (WO) area of concentration (AOC) 351M. They are specifically 
trained and certified for, tasked with, and engage in the collection of information from individuals 
(HUMINT sources) for the purpose of answering HUMINT-specific requirements. Although CI and 
HUMINT personnel may use similar methods, their missions are separate and distinct. Commanders should 
not use them interchangeably. Using CI personnel for HUMINT missions degrades the Army’s ability to 
protect its forces, information, and critical technology that provides the Army operational and technological 
superiority over existing and future adversaries. 


Note. For the purpose of this FM, a CI special agent consists of enlisted personnel in MOS 35L, 
WOs in AOC 351L, commissioned officers in AOC 35E, and their Federal civilian employee 
counterparts. 


TENETS OF COUNTERINTELLIGENCE 


1-4. The National Security Act of 1947, codified under Title 50, USC § 40la, designates CI as an 
intelligence activity. While one of the CI cornerstones is the conduct of investigations, Title 50, USC 
highlights—the best long-term solution to counter the FISS and ITO collection threats is offensively 
exploiting the situation to identify all the participants, and undermining the FISS and ITO’s ability to 
collect effectively on Army equities through control of the participants and information. Neutralization of a 


21 October 2009 FM 2-22.2 1-1 


FOR OFFICIAL USE ONLY 


Chapter 1 


1-2 


FISS and ITO threat through exposure, changes to systemic procedures, or criminal prosecution should 
always be the secondary consideration. Neutralization inhibits Army CI’s ability to fully identify all the 
participants and assess the damage caused to national security; however, all CI investigative activities 
should be conducted at a prosecutorial standard to preserve the legal integrity and admissibility of 
evidence. Figure 1- 1 shows criminal versus intelligence approach to CI operations. 


Neutralization vs. Exploitation 


Support Handler 
Agents 


Cut-Outs 


Neutralization: Exploitation: 
Focuses on prosecution Criminal vs. Intelligence Targets entire 
of subject network 


Figure 1-1. Neutralization versus exploitation 


1-5. The Department of Defense (DOD) defines CI as a multidiscipline function to counter the full range 
of FISS and ITO collection activities. However, the only FISS and ITO intelligence platform that Army CI 
can offensively and proactively counter is their HUMINT capability. Signals intelligence, imagery 
intelligence, or other technical collection activities are generally standoff platforms. CI can only provide 
assessments on the capabilities and make recommendations for countermeasures to mitigate the threats. 
The facts presented make Army CI focused generally on counter-HUMINT activities. 


1-6. CI is the fusion of intelligence, security, and law enforcement functions into a single element that 
thinks like a FISS and ITO entity, and employs a broad range of functions to protect Army personnel, 
property, information, operational intentions, and critical technologies. This ensures operational and 
technological superiority over existing and future adversaries. Although proper CI employment protects 
national defense information, proper CI employment can also undermine the adversaries’ understanding 
and knowledge of U.S. policies and objectives and make them react predictably if Army CI can effectively 
control the adversary’s abilities to collect against U.S. interests. The following elements support the 
different CI objectives: 


e Intelligence (exploitation)—CI sensitive and investigative source operations. 


e Security (deter, detect, identify, counter)—advice and assistance, briefings, debriefings, 
screenings, security program inspections. 


e Law enforcement (neutralize)—CI investigations. 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


COUNTERINTELLIGENCE CORE COMPETENCIES 


1-7. CI core competencies are interrelated, mutually supporting, and can be derived from one another. No 
single competency can defeat the FISS and ITO intelligence collection threat targeting U.S. interests, in 
general, and Army interests, specifically. The CI core competencies include— 


e Operations. 

e Investigations. 

è Collection. 

e Analysis and production. 
e Intelligence analysis. 


e Operational analysis. 


OPERATIONS 


1-8. CI operations are broadly executed CI activities that support a program or specific mission. CI 
operations use one or more of the core CI competencies discussed below. CI operations can be offensive or 
defensive, and they are derived from, transitioned to, or used simultaneously—depending on the scope, 
objective, or continued possibility for operational exploitation. CI operations fall into two categories: CI 
support operations and CI sensitive operations. 


INVESTIGATIONS 


1-9. CI investigations are conducted when national security crimes are allegedly committed by anyone 
under CI authority. The primary objective of any CI investigation is the identification, exploitation, or 
neutralization of threats directed against the Army. CI investigations are also conducted to identify 
systemic security problems that may have damaging repercussions to Army operations and national 
security interests. 


COLLECTION 


1-10. CI collection is the systematic acquisition of information concerning the FISS and ITO intelligence 
collection threat targeting Army equities. CI elements conduct collection activities to support the overall CI 
mission. CI collection is conducted by using sources, elicitation, official liaison contacts, debriefings, 
screenings, and open-source intelligence to obtain information that answers the standing 
counterintelligence collection requirements (SCICRs) or other collection requirements based upon 
commanders’ requirements. Although CI and HUMINT have a collection mission, there are distinct 
differences between their collection objectives. HUMINT focuses on answering the commander’s critical 
information requirements (CCIRs) concerning the plans, intentions, capabilities, and disposition of the 
adversary, as a whole. 


1-11. CI specifically targets the FISS and ITO intelligence collection threat targeting U.S. forces. CI 
collection is conducted to understand how FISS and ITO are targeting U.S. forces, so countermeasures can 
be identified and recommended to commanders and program managers to protect personnel, mission, 
resources, and technology. Collection is only one of five CI functions; whereas, collection is HUMINT’s 
only mission. 


ANALYSIS AND PRODUCTION 


1-12. CI analysis is used to satisfy the supported commander’s intelligence requirements and to provide 
focus and guidance to CI operations. CI analysis and production can be accomplished at any level in which 
Army CI assets are assigned to counter the FISS and ITO collection threat; support protection of U.S. 
personnel, property, and operations; protect the research and development of critical technologies; and 
support Army information tasks to protect U.S. forces information systems. 


21 October 2009 FM 2-22.2 1-3 


FOR OFFICIAL USE ONLY 


Chapter 1 


Intelligence Analysis 


1-13. CI analysis provides the supported commander with situational awareness and understanding of the 
operational environment. CI analysis should be focused on predictive assessments of FISS and ITO plans, 
intentions, and capabilities. This allows the commander to make informed decisions on the protection 
posture and targeting to neutralize or exploit those threats to the advantage of U.S. forces. Accurate CI 
analysis also increases the visibility of proactive and effective CI support and establishes credibility with 
the supported commander. This in turn leads the commander to trust and rely upon the CI assets and often 
give them more flexibility to execute CI operations. 


Operational Analysis 


1-14. Operational analysis allows the operational management elements (2X, counterintelligence 
coordinating authority [CICA] and operational management team [OMT] leaders) to gauge the 
effectiveness and success of their subordinate operational CI teams. This is done through assessments on 
source production (quantity and quality), source vetting (reliability, accuracy, response to control), and 
requirements coverage. Operational analysis also allows operational managers to deconflict CI operations 
and to provide direction and focus to eliminate redundancy and/or increase the efficiency of the CI teams. 


TECHNICAL SERVICES AND SUPPORT 


1-15. CI technical services are used to assist the CI core competencies of investigations, collections, and 
operations or to provide specialized technical support to a program or activity. The proliferation of 
sophisticated collection technology, surveillance, and “eaves-dropping” devices available in the 
commercial markets enable any FISS and ITO with the ability to increase their capability and effectiveness 
in collecting on Army interests. 


1-16. To mitigate this increasing threat requires a specialized expertise. CI organizations with technically 
trained CI special agents are chartered with providing this unique technical capability to augment and 
provide specialized support to the CI mission. This includes CI special agents trained to— 


e Perform technical surveillance countermeasures (TSCM). 


e Perform cyber CI activities that provide protection to information networks as well as identify 
vulnerabilities and attempted intrusions into Army and DOD computer networks. 


e Perform CI scope polygraph examinations. 


e Provide support to Army information tasks. 


COUNTERINTELLIGENCE MISSION 


1-17. The mission of Army CI is to conduct aggressive, comprehensive, and coordinated operations, 
investigations, collection, analysis and production, and technical services. This CI mission is conducted 
worldwide to detect, identify, assess, counter, exploit, or neutralize the FISS and ITO collection threat to 
the Army and DOD to protect the lives, property, or security of Army forces. Army CI has four primary 
mission areas: 


e Counterespionage (CE). 

e Support to protection. 

e Support to research and technology protection (RTP). 
e Cyber CI. 


COUNTERESPIONAGE 


1-4 


1-18. CE detects, identifies, counters, exploits, or neutralizes the FISS and ITO collection threat targeting 
Army and DOD equities or U.S. interests. CE programs use both investigations and collection operations to 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


conduct long-term operations to undermine, mitigate, or negate the ability of FISS and ITO to collect 
effectively on Army equities. CE programs also affect the adversarial visualization and decisionmaking 
concerning the plans, intentions, and capabilities of U.S. policy, goals, and objectives. The goal of CE is 
to— 


e Limit the adversary’s knowledge of U.S. forces, plans, intentions, and capabilities through 
information denial. 


e Limit the adversary’s ability to target effectively U.S. forces by disrupting their collection 
capability. 
COUNTERINTELLIGENCE SUPPORT TO PROTECTION 


1-19. CI support to protection ensures the survivability and mission accomplishment of Army and DOD 
forces. 


1-20. CI’s objective in supporting protection is to— 


e Limit the compromise and exploitation of personnel, facilities, operations, command and 
control (C2), and operational execution of U.S. forces. 


è Negate, mitigate, or degrade adversarial planning and targeting of U.S. forces for exploitation 
or attack. 


e Support the war on terrorism. 


SUPPORT TO RESEARCH AND TECHNOLOGY PROTECTION 


1-21. Support to RTP is focused on preventing the illegal diversion or loss of critical technology essential 
to the strategic advantage of the U.S. 


1-22. CI’s objective in supporting RTP is to— 
e Protect critical technology information from adversarial countermeasures development. 


e Ensure U.S. technological overmatch against existing and future adversaries. 


CYBER COUNTERINTELLIGENCE 


1-23. Cyber CI protects information networks and provides an offensive exploitation capability against 
adversarial networks to ensure information superiority of U.S. forces. 


1-24. CI’s objective in conducting cyber CI activities is to— 


e Maintain U.S. forces information dominance and superiority over existing and future 
adversaries. 


e Protect critical information networks from adversarial attack or exploitation. 


e Undermine adversarial information operations, systems, and networks. 


COUNTERINTELLIGENCE STRUCTURE 


1-25. CI organizations and Army force structure are designed to support the modular force construct 
through scalable teams, operations management, and technical control packages. CI elements assigned to 
battlefield surveillance brigades, divisions, corps, Army Service component commands (ASCCs), and 
strategic units are capable of operating at all echelons and throughout full spectrum operations. The joint 
2X organizational and operational concept has been established in Army force structure to decentralize CI 
operational approval and execution. As the primary force provider for the DOD CI in contingency and 
combat operations, the establishment of the 2X and the CICA throughout the Army ensures a trained and 


21 October 2009 FM 2-22.2 1-5 


FOR OFFICIAL USE ONLY 


Chapter 1 


2X 


1-6 


experienced cadre of CI professionals capable of filling Army, joint, and combined 2X and CICA/task 
force CI coordinating authority (TFCICA) positions. 


Note. 2X denotes the 2X staff officer at all echelons—S-2X (brigade), G-2X (division, corps, 
ASCC), J-2X (joint task force), C-2X (combined task force), and Army G-2X (Department of 
the Army [DA] level). 


1-26. The 2X is the CI and HUMINT manager authorized to coordinate, deconflict, and synchronize all CI 
and HUMINT missions in the area of operations (AO). The 2X manages CI and HUMINT intelligence 
requirements including HUMINT collection requirements, time-sensitive collection requirements, report 
evaluations with source-directed requirements, and source assessments. Although the 2X section may be 
structured differently at each echelon, there is always a requirement for three components—CICA, a 
HUMINT operations cell (HOC), and an operations support cell (OSC). Figure 1-2 provides a graphic 
depiction of the 2X organization. The 2X is responsible for— 


e Participating in predeployment or deployment planning for CI and HUMINT assets to support 
operations. 


e Coordinating, through the HOC and CICA/TFCICA, all CI and HUMINT activities to support 
intelligence collection and the intelligence aspects of protection for the deployed commander. 


è Managing collection requirements for CI and HUMINT in coordination with intelligence, 
surveillance, and reconnaissance (ISR) synchronization. 


e Providing specific CI and HUMINT collection plans to the collection manager for integration 
into the ISR plan. 


e Coordinating and deconflicting all CI and HUMINT operations within the AO. 
e Serving as the release authority for CI and HUMINT reporting. 


e Releasing reports to the Distributed Common Ground System-Army (DCGS-A) only after 
ensuring all technical control measures for reporting have been met. 


1-27. The 2X is a commissioned officer with a CI or HUMINT AOC (35E/F). Within joint and combined 
force commands, the J/C-2X may be either an Army, Navy, Air Force or Marine Corps officer or civilian 
depending upon the requirements of the approved joint manning document. (See TC 2-22.303 for details on 
the 2X.) 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


2X Organization Legend: 


Technical Control 
-—-— ~- Staff Coordination 


Operational Control 
Assigned, Higher, C/J/G/S-2 


Adjacent, and 
Lower Headquarters 


me 
synene aea laff o a paea rara eee Oa 


Coordination Coordination 


Cl Operations HUMINT 
Coordinating Support Operations 
Authority Cell Cell 
(OSC) (HOC) 


Technical Technical 
Control Control 
“N 7 


HUMINT 
Unit 


Figure 1-2. 2X organization 


COUNTERINTELLIGENCE COORDINATING AUTHORITY 


1-28. The CICA is the coordinating authority for all CI activities assigned or attached to Army CI assets 
within their unit or AOs. The CICA for Army divisions and corps will normally be a senior 351L CI WO. 
At the ASCC or theater level, the CICA may be a senior CI WO, CI officer (35E) or equivalent Military 
Intelligence Civilian Excepted Career Program (MICECP) government civilian employee. 


1-29. Within joint and combined force commands, the TFCICA may be an Army, Navy, Air Force, or 
Marine Corps WO, officer, or civilian depending on the requirements of the approved joint manning 
document. Army CICA components are generally comprised of four personnel (a CI WO and three enlisted 
CI Soldiers); however, size and structure may vary depending on the unit and mission. Units engaged in 
operational and strategic missions may have a higher standard of grade for CICAs including the use of 
appropriately credentialed government civilian employees. CICA personnel may be attached, assigned, or 
under operational control (OPCON). 


1-30. Regardless of echelon or Service component, the CICA’s mission is to manage, coordinate, and 
synchronize all CI activities in the designated AO. The CICA exercises technical control over all CI entities 
and deconflicts CI activities with higher, lower, and adjacent CI elements. The CICA accomplishes all 
responsibilities through coordination with the operational units and other 2X staff elements. (See 
TC 2-22.303 for details on the CICA.) See table 1-1 (page 1-8) for the functions performed by CICA. 


21 October 2009 FM 2-22.2 1-7 


FOR OFFICIAL USE ONLY 


Chapter 1 


Table 1-1. Counterintelligence coordinating authority functions 


CICA performs the following functions 


Coordinate and staff all CFSO proposals with the Army component or JTF approval authority, and U.S. national 
agency representatives. 
Serve as the single focal point for all matters associated with Cl in the area of intelligence responsibility. The CICA 
tracks Cl activities and keeps the 2X informed, in turn the 2X keeps the C/J/G/S-2 and commander informed. 
Exercise technical control of all Cl entities and coordinate all Cl activities in the area of intelligence responsibility. 
Coordinate with MI unit commanders who possess Cl assets that execute Cl activities in the AO. 
Coordinate and deconflict all Cl source operations with the source registry manager in the area of intelligence 
responsibility. 
Ensure a robust Cl education and awareness training program by coordinating Cl refresher training, as required, 
and by ensuring the establishment of Cl reporting channels and procedures in the area of intelligence 
responsibility. 
Implement the intelligence program for all Cl activities in the theater in accordance with AR 381-10. 
Note. The MILDEPs always remain in control of Cl investigations. The ATCICA and ACICA provide investigative 
technical control of all Army Cl-conducted investigations. Army Cl investigative reports pass through the CICA and 2X 
while simultaneously passing through the ATCICA and ACICA. 
Keep the 2X, C/J/G/S-2, and commander informed on the status of Cl activities. 
Coordinate with the analytical element and the ISR synchronization staff to identify and refine requirements for Cl 
collection, operations, or investigations. 
Ensure Cl reporting is disseminated to the analytical element for inclusion in the all-source picture, as appropriate. 
Develop and disseminate requirements, orders, and RF Is to Cl entities in the area of intelligence responsibility. 
Ensure registration of all Cl sources with the OSC or other designated source registry manager. (If there is no 
OSC, the CICA will maintain the source registry.) 
Routinely evaluate Cl source operations to ensure proper handling by Cl special agents, source ability to satisfy 
requirements, and to determine value of continuing the operation. 
Ensure exploitation opportunities are preserved while conducting VAs and other protection initiatives. 
Ensure investigations are planned, coordinated, and executed in accordance with applicable directives and 
regulations. 
Establish and maintain connectivity with the supporting ATCICA for investigative oversight of Army Cl-conducted 
investigations. 
Participate in the operations staff targeting process to provide input on the placement, access, availability of 
sources, and reporting reliability of Cl sources that support targeting. (For more information, see appendix B.) 
Ensure Cl support is provided to the JIDC and DHAs in the area of intelligence responsibility. 
Establish quality control and execute release of all Cl reporting. 
Routinely provide feedback to all Cl entities in the area of intelligence responsibility regarding collection activities, 
operations, and investigations. 
After a determination has been made to release a detainee, ensure detainee screening is performed to determine 
the detainee’s suitability as a potential lead for Cl or other collection activities. 
Interact with the HOC and OSC to ensure Cl activities do not conflict with HUMINT activities in the area of 
intelligence responsibility. 
Conduct liaison with the PMO and intelligence entities conducting liaison with HN LEAs to ensure Cl activities are 
coordinated and deconflicted. 
Conduct liaison with HN and U.S. national level Cl organizations. 
Provide staff oversight to LEPs screening activities within the area of intelligence responsibility. 
Provide technical oversight and guidance for coordination or approval requests of Cl operations that require 
approvals outside the local approval authority. 
Recommend to the supported C/J/G/S-2 and maneuver commander the designation of an MI unit or intelligence 
staff element, as appropriate, to serve as the repository for Cl badge and credentials in the area of intelligence 
responsibility. The MI unit or intelligence staff element should have responsibility for accountability and issue of Cl 
badge and credentials. 
Coordinate requests for Cl technical services (cyber Cl unit, TSCM, and polygraph support). 
ACICA—Army Cl coordinating authority JTF-joint task force 
AO-area of operations LEA-law enforcement agency 
ATCICA—Army theater Cl coordinating authority LEP-locally employed person 
Cl-counterintelligence Ml-military intelligence 
CFSO-CI force protection source operations MILDEP-military department 
DHA-detainee holding area OSC-operations support cell 
HN-host nation PMO-Provost Marshal Office 
HOC-—HUMINT operations cell RFl-requests for information 
ISR-intelligence, surveillance, and reconnaissance TSCM-—technical surveillance countermeasures 
JIDC—Joint Interrogation and Debriefing Center VA-vulnerability assessment 


1-8 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


HUMAN INTELLIGENCE OPERATIONS CELL 


1-31. The HOC is an element within the C/J/G/S-2X section that manages all HUMINT military source 
operations and related HUMINT activities, including debriefing, interrogation, screening, contact 
operations, and document and media exploitation (DOMEX) liaison. (See TC 2-22.303 for details on 
HOCs.) 


OPERATIONS SUPPORT CELL 


1-32. The OSC is an element within the C/J/G/S-2X section that manages overall 2X section operations, 
performs office administration functions, and accomplishes tasks that support both the CICA and HOC. 
The OSC serves as the operations officer and office manager for the 2X section. Each echelon with a 2X is 
also required to have an OSC. If the OSC is not authorized or resourced, the 2X determines how and by 
whom the OSC functions will be accomplished. 


1-33. When the OSC is authorized or resourced, it works directly for the 2X. At lower echelons (for 
example, Stryker brigade combat team [SBCT] and brigade combat team [BCT] level), an OSC may not be 
authorized or resourced and may have to be task-organized to provide this capability. At higher echelons, 
an OSC is required given the span of control, the number of CI special agents and HUMINT collectors 
being managed, the amount of CI and HUMINT requirements, the large volume of reporting, and the 
increased burden of administrative requirements. (See TC 2-22.303 for details on the OSC.) 


1-34. When established, the OSC requires intelligence personnel. Personnel qualified for an OSC 
assignment include all-source intelligence officers (35D), CI officers (35E), HUMINT officers (35F), CI 
technicians (351L), HUMINT technicians (351M), area intelligence technicians (351Y), HUMINT 
collectors (35M), CI special agents (35L), and Army, MICECP, and defense civilians. Civilians should be 
job series 0132, intelligence operations specialist (CI or HUMINT), or job series 0134, intelligence 
operations technician (CI or HUMINT). Qualified contractors can be assigned to an OSC in an appropriate 
supporting role such as a portal manager or in a reports officer position. The OSC handles common tasks 
and functions that support the CICA and HOC. See table 1-2 (page 1-10) for the functions performed by 
OSC. 


21 October 2009 FM 2-22.2 1-9 


FOR OFFICIAL USE ONLY 


Chapter 1 


Table 1-2. Operations support cell functions 


OSC performs the following functions 


Provide 24-hour watch for the 2X section and serve as the central communications hub for the 2X section when 
deployed. Serve as the primary point of entry for all reporting from all outside echelons and elements. Maintain 2X 
section computer systems and communications equipment to ensure connectivity to Cl and HUMINT entities in the 
area of intelligence responsibility. 
Receive and track responses to all RFls from all echelons. 
Manage administrative support to the 2X section including in-and-out processing, tracking of efficiency reports and 
awards, and maintaining office files, as appropriate. 
Coordinate logistic support and accounts for 2X section property. 
Maintain a transmittal log for all requests and responses to and from external agencies, staffs, and authorities. 
Coordinate movement of 2X section personnel with the C/J/G/S-3, dispatch and track 2X section vehicles, track 
and account for 2X section personnel in a travel status. 
Serve as the 2X section’s interface with the analytical element and ISR synchronization element. The OSC 
manages the intelligence cycle for the 2X section by receiving requirements and— 
= Ensuring the requirements are clear. 
= Advising the ISR synchronization element on the appropriateness of the received or forthcoming requirements. 
= Helping to ensure that the best Cl and HUMINT assets are tasked to satisfy the requirements. 
= Ensuring that resulting reporting is appropriately disseminated to requestors. 
Manage SDRs and release of IIRs. 
Manage the intelligence property book, ICFs, and the Source Incentive Program. 
Note. Army regulations require that separate individuals manage the ICF and Source Incentive Program, unless an 
exception is granted by the Army G-2. 
Maintain the consolidated source registry and reports databases, and assist the CICA and HOC in deconflicting 
MSO. 
Coordinate with the linguist support section regarding linguist support to Cl and HUMINT entities. 
Coordinate with the C/J/G/S-2 operations section and C/J/G/S-3 regarding release of FRAGOs, as required. 
CICA-Cl coordinating authority HUMINT—human intelligence 
FRAGO-fragmentary order MSO-military source operations 
HOC-—HUMINT operations cell OSC-operations support cell 
ICF-intelligence contingency fund RFl-request for information 
|I[R-intelligence information report SDR-source-directed requirement 
|SR-intelligence, surveillance, and reconnaissance 


Counterintelligence Operational Management Team 


1-35. The OMT is the first operational management element that provides technical control and oversight 
to subordinate CI teams. The OMT manages subordinate CI teams to ensure operational execution and 
direction, quality and control of reporting, and satisfaction of intelligence requirements. An OMT can 
manage between one to four CI teams depending on the operational pace, mission, and geographic 
requirements. OMTs generally consist of four personnel (a 351L, CI WO and three 97L, CI enlisted 
Soldiers), but size and structure may vary depending on the unit and mission. 


1-36. Units engaged in operational and strategic missions may also have a higher standard of grade for 
OMTs including the use of appropriately credentialed government civilian employees. OMT personnel may 
be attached, assigned, or under OPCON. OMTs and subordinate CI teams may be assigned or attached 
from higher echelon units to lower echelon units. Depending on mission requirements, CI OMTs may be 
held at the next higher echelon of the subordinate CI teams. CI OMTs will not normally be located below 
the brigade level. (See TC 2-22.303 for details on the OMT.) See table 1-3 for the functions performed by 
OMT. 


Table 1-3. Operational management team functions 


OMT performs the following functions 
° Disseminate all intelligence or time-sensitive information to the supported or responsible command channels for 
action or operational consideration. 
° Provide guidance and technical control to operational activity. 
° Provide collection and operational focuses for Cl teams. 
° Provide quality control and report dissemination to subordinate CI teams. 


1-10 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


Table 1-3. Operational management team functions (continued) 


OMT performs the following functions 
° Receive, edit, and provide feedback on all administrative reports, such as readiness status and operational reports, 
and on intelligence reports, such as IIRs, submitted by subordinate teams. 
Ensure Cl reporting and related traffic is fused into all-source intelligence. 
Conduct Cl analysis and assist in mission analysis for the supported commander. 
Coordinate Cl activities with the CICA and with Cl element commanders in the area of intelligence responsibility. 
Perform liaison with HN and U.S. national level security, intelligence, and law enforcement organizations. 
Inform respective CICA when Army Cl elements are conducting Cl investigative activities within the purview of AR 
381-20. 
e Actas a conduit between subordinate CI teams, the CICA, and 2X, and the supported unit headquarters. 
° Provide administrative support to subordinate CI teams, including reporting mission and equipment status to the 
CICA or HOC and the supported unit headquarters. 
° Educate the supported commander on the subordinate teams’ capabilities. 
° Integrate subordinate Cl teams directly into the maneuver commander’s ISR planning. 


AR-Army regulation IIR—intelligence information report 
CICA-CI coordinating authority ISR-intelligence, surveillance, and reconnaissance 
HOC-—HUMINT operations cell HN-host nation 


Counterintelligence Team 


1-37. The CI team conducts CI investigations, CI collection (debriefings, source operations, liaison, and 
screening), CI analysis, and CI technical services support to protect the supported unit from threat 
intelligence activities. 


1-38. The CI team provides the supported commander, through 2X channels, a capability to help protect 
the force and affect the adversaries’ understanding of friendly force operational capabilities. The CI team 
also provides capabilities to help answer CCIRs and SCICRs related to FISS and ITO collection activities 
targeted against the supported unit, Army, and DOD equities. 


1-39. A CI team generally consists of four 35L, CI noncommissioned officers (NCOs), and enlisted 
Soldiers. Units engaged in operational and strategic missions may also have a higher standard of grade for 
CI teams including the use of appropriately credentialed government civilian employees. Specialized CI 
teams, including technical counterintelligence (TCI), cyber CI, and polygraph teams, may vary in size and 
composition (2- to 3-person military or civilian teams) based on mission requirements and unit 
organization. CI teams— 


e May be attached, assigned, or under OPCON. 
e May be attached or assigned from higher echelon units to lower echelon units. 


e Are typically assigned at division and above levels; however, they may be attached or 
assigned at brigade level depending upon mission requirements. 


1-40. Table 1-4 (page 1-12) lists the functions performed by the CI team. 


21 October 2009 FM 2-22.2 1-11 


FOR OFFICIAL USE ONLY 


Chapter 1 


Table 1-4. Counterintelligence team functions 


OSC performs the following functions 


Prepare and submit command reports, such as readiness status reports that provide status of equipment, 

personnel, and ICF in accordance with supporting OMT SOPs. 

Prepare protected reports, such as contact reports, in accordance with OMT SOPs, that document each source 

contact. 

= Disseminate contact reports to supporting OMT for review or comment. 

= Maintain contact report files on every source. 

= Provide contact report files to relief team during relief in place or transfer of authority. 

Prepare and submit intelligence reports, such as spot reports, using the SALUTE format, and IIRs in accordance 

with OMT SOPs. 

Assist in the production of threat and vulnerability assessments. This function provides support to evaluations of 

installations and operating bases with MP, CA, engineers, and medical units to identify the intelligence threat to the 

operating location. The VA identifies weaknesses in operational and physical security procedures and recommends 

countermeasures to mitigate intelligence collection on friendly forces, limiting the ability of adversaries to plan and 

conduct hostile acts against U.S. and multinational activities and locations. 

Conduct Cl analysis to support mission requirements and contribute to the all-source common operational picture. 

To verify adequate area coverage, use backwards planning and source profiling to choose Cl targets. Develop and 

use Cl target overlays and other CI analytical tools that illustrate the Cl situation, identify Cl gaps, and help refocus 

Cl collection efforts. 

Conduct CI debriefings. This function involves the systematic questioning—using direct and indirect questioning 

techniques—of individuals to procure information that answers specific Cl collection requirements. Sources for 

debriefing include friendly forces (for example, MP, CA, engineers, and medical units), U.S. and non-U.S. civilians 

including members of NGOs, refugees, displaced persons, and local inhabitants. The Cl team regularly and 

systematically debriefs all ISR assets. 

Conduct Cl investigations within the jurisdictional boundaries of Army Cl regulations and the guidelines of AR 381- 

10, AR 381-12 and AR 381-20. Regularly coordinate with the supporting staff judge advocate to ensure 

investigations are conducted to support eventual trial and prosecution, if necessary, and in compliance with all 

DOD policy and U.S. laws. 

Conduct Cl screenings. Cl screenings serve two purposes: 

= Collect information of CI interest or to collect established information requirements through the interview of 
indigenous, third-country nationals, foreign expatriates, or U.S. military personnel in the AO. 

= Interview and assess the suitability and security risks of employing potential candidates with U.S. forces to 
support LEP screening programs at installations and forward operating bases. 

Conduct CI collection. This function includes activities focused on identifying adversary intelligence threats that 

target U.S. and multinational interests. CI collection is conducted through use of sources and other multimedia 

sources to obtain information that impacts the supported unit. CI collection activities will not be used as a substitute 

for Army HUMINT collection. “Collect” specific information or develop leads that can obtain information concerning 

adversary intelligence collection requirements, adversary capabilities, adversary personalities, and adversary 

methods of operation targeting U.S. and multinational forces. 

Register all CI contacts through the OMT and CICA in the source registry. Disseminate CI administrative, technical, 

and intelligence reports through the OMT and CICA. 

Conduct CI liaison with U.S., multinational, and host-nation military and civilian agencies, including NGOs, for the 

purpose of obtaining information of CI interest and to coordinate and deconflict CI activities. Liaison activities are 

designed to ensure a cooperative operating environment for CI elements and to develop CI leads for further 

exploitation. 

= Maintain constant contact with the supported S-2 to identify intelligence requirements, information gaps, and 
to deconflict operations within the support commander’s AOs. 

= Maintain constant contact with other ISR assets (scouts, PSYOP, CA, and MP) to coordinate and deconflict 
operations in adjacent AOs and cross-checks collected information. 

Support the CI Education and Awareness Training Program by coordinating with the S-2 to present CI awareness 

training to all units in the area of intelligence responsibility. CI teams should be the focal point for all CI training to 

identify incidents of CI interest and educate Army personnel about their responsibilities to report incidents outlined 

in AR 381-12. The Cl Education and Awareness Training Program supports the commander’s overall protection 

program. 

Provide CI technical service support, such as polygraph, TSCM, computer forensics, to the supported unit when 

properly trained and equipped personnel are available. 


AO-area of operations MP-military police 

CA-—civil affairs HUMINT—human intelligence 

Cl-counterintelligence NGO-nongovernmental organization 

CICA-—ClI coordinating authority OMT-operational management team 
DOD-Department of Defense PSYOP-psychological operations 

ICF—intelligence contingency fund SALUTE-size, activity, location, unit, time, equipment 
lIR—intelligence information report SOP-standing operating procedure 

|SR-intelligence, surveillance, and reconnaissance TSCM-technical surveillance countermeasures 


VA-vulnerability assessment 


1-12 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


U.S. AND DEPARTMENT OF DEFENSE COUNTERINTELLIGENCE 
COMMUNITY 


1-41. Each of the following organizations serve the U.S. and DOD intelligence community, specifically in 
CI matters: 


e Office of the National Counterintelligence Executive (ONCIX). 

e Federal Bureau of Investigation (FBI). 

e Central Intelligence Agency (CIA). 

e Deputy Under Secretary for Defense (DUSD), Counterintelligence and Security (CI&S). 
e Defense CI and HUMINT Center. 

e Counterintelligence staff officer (CISO). 


OFFICE OF THE NATIONAL COUNTERINTELLIGENCE EXECUTIVE 


1-42. The ONCIX is subordinate to the Office of the Director of National Intelligence (DNI). The ONCIX 
serves as the U.S. Government executive agent for all CI matters and is responsible for developing the CI 
strategy for the U.S. CI community including DOD CI elements. The ONCIX advises the DNI on CI 
program budgets and evaluations to ensure the CI community is properly funded to execute operations that 
support national policy and strategic priorities. The ONCIX establishes priorities for CI collection, 
investigations, and operations to— 


e Exploit and defeat FISS and ITO collection activities directed against U.S. interests. 
e Protect and sustain U.S. intelligence systems and agencies. 


è Neutralize and exploit adversarial intelligence activities targeting the armed forces. 


FEDERAL BUREAU OF INVESTIGATION 


1-43. The FBI is the investigative arm of the Department of Justice and is a member of the intelligence 
community under the provisions of Title 50, USC The FBI is the lead U.S. Government agency for CI 
within the United States. Army CI often conducts joint CI investigations with the FBI when the offense or 
the subject falls within the investigative jurisdiction of Army CI. 


CENTRAL INTELLIGENCE AGENCY 


1-44. The CIA is the lead U.S. Government agency responsible for foreign intelligence and CI activities 
outside the United States. However, most CIA CI activities are focused on protecting the integrity and 
security of CIA operations from compromise. Army CI collection and operations outside the United States 
must be deconflicted with the CIA to avoid intelligence conflicts and ensure unity of the intelligence effort. 


DEPUTY UNDER SECRETARY FOR DEFENSE, COUNTERINTELLIGENCE AND SECURITY 


1-45. The DUSD (CI&S) is responsible for providing oversight of the DOD CI Program and making 
recommendations on policy issues to the DUSD for intelligence. DUSD (CI&S) serves as the OSD staff 
focal point for all issues relating to DOD CI initiatives. DUSD (CI&S) also interacts with other DOD staff 
elements, the National Counterintelligence Executive and other national agencies to help direct and shape 
CI strategies. 


DEFENSE COUNTERINTELLIGENCE AND HUMAN INTELLIGENCE CENTER 


1-46. In August 2008, the DOD simultaneously disestablished the CI Field Activity and activated the 
Defense CI and HUMINT Center, which is under the direction of the Defense Intelligence Agency (DIA). 


21 October 2009 FM 2-22.2 1-13 


FOR OFFICIAL USE ONLY 


Chapter 1 


The new center has no law enforcement function. It manages CI programs for DOD and integrates 
overlapping CI and HUMINT operational and support areas. 


COUNTERINTELLIGENCE STAFF OFFICER 


1-47. The CISO serves as an advisor on CI matters to the combatant command J-2 and commander. The 
CISO assists in providing oversight on all the command’s CI activities and ensuring all command plans and 
operational planning include CI operations, requirements, and tasking when appropriate. The CISO also 
provides management and deconfliction of CI collection, production, investigations, operations, and 
technical services capabilities within their theater or area of responsibility. 


1-48. The CISO establishes combatant command CI priority intelligence requirements (PIRs) to support 
the commander’s information requirements. When a combatant command is designated as a joint task force 
(JTF) command headquarters, the CISO can serve as the TFCICA until joint manning documentation 
establishes a recurring requirement to fill that position for the duration of the operation. CISOs may also be 
documented in ASCC staffs as required and authorized. 


ARMY COUNTERINTELLIGENCE LEVELS OF EMPLOYMENT 


1-49. CI is critical to Army operations at all echelons, across the spectrum of conflict. Army CI can and 
will execute all five CI core competency functions from the tactical to strategic operational environments. 
The only difference in the operational execution is generally what mission areas are being supported. Even 
CI special agents providing CI technical services and support are leveraged to provide their unique 
capabilities during stable peace and during major combat operations. 


1-50. All Army commanders, including commanders of MI units, need to be educated by senior CI and 
HUMINT personnel to clearly define the distinctions between the two disciplines to ensure the effective 
use of both disciplines to support the unit’s mission. Since CI personnel have been used instead as 
HUMINT collectors during the past 15 years, senior CI special agents have failed to articulate the CI’s true 
mission to their commanders and how proper employment of CI is a warfighting enabler. This failure to 
articulate—combined with a lack of HUMINT resources and an increased reliance on human-derived 
information as a catalyst for military operations execution—has blurred the identity of CI, especially at the 
tactical level. 


STRATEGIC AND DEPARTMENTAL CI 


1-51. Strategic operations are conducted by CI elements supporting national and DOD missions (for 
example, support to North Atlantic Treaty Organization [NATO] and special operations and missions). 
Strategic CI also conducts compartmented investigations and operations to affect the knowledge of FISS 
and ITO regarding contingency operations and defense information. Strategic CI executes the full range of 
CI functions and missions including CI investigations and operations, offensive counterintelligence 
operations, RTP, special access program support, treaty verification, and technical CI services (polygraph, 
TSCM, and computer forensics). Strategic CI also supports special operations forces and special mission 
units within the scope of applicable national, DOD, and DA policies and regulations. Strategic and 
departmental CI assets generally conduct the following activities: 


e Advice and assistance—assist unit security managers and commanders with knowledge on 
security programs and provide details on reporting potential FISS and ITO targeting and 
incidents of CI interest. 


e Education and awareness—provide FISS and ITO threat and Army program briefings to 
educate unit personnel, satisfy mandatory training requirements, and generate potential leads 
for incidents of CI interest. 


e Threat assessments (TAs) and vulnerability assessments (VAs)—conduct collection and 
analysis of FISS and ITO threat data for a specific unit, facility, operation or activity to 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


provide the supported commander knowledge on protection and security posture and make 
countermeasures recommendations to overcome deficiencies. 


è CI investigations—exploit or neutralize potential FISS and ITO collection threats targeting 
Army and DOD equities. 


è CI collection—detect and identify FISS and ITO intelligence collection activities targeting 
U.S. forces and to devise other CI initiatives to counter, exploit, or neutralize the FISS and 
ITO collection capability. 


Army G-2X 


1-52. At the departmental level, the Army G-2X is the executive agent for all Army CI activities including 
policy implementation, operational oversight, intelligence funding programs, and Army staff level 
management. It coordinates with other military Service and national agency intelligence and CI services to 
coordinate CI strategies and mutually supporting activities, including joint CI operations and investigations. 
The Army G-2X is responsible for making recommendations to the DA G-2 concerning all budgetary 
issues concerning CI and HUMINT. 


1-53. The Army G-2X provides oversight and guidance to Army CI elements. It staffs and coordinates 
approval of CI operational concepts and plans, as outlined in AR 381-20, to ensure they meet legal 
sufficiency satisfy validated requirements. The Army G-2X also provides oversight of all approved Army 
CI operational concepts and plans. It manages and maintains the Army’s centralized CI and HUMINT 
source registry and product library, as part of a joint Service CI and HUMINT database. The Army G-2X 
coordinates functional and technical support services, as well as comprehensive worldwide FISS and ITO 
threat analysis products. The Army G-2X collaborates with theater and maneuver CI staff and field 
elements to ensure unity of the CI effort and efficient use and employment of Army CI assets. 


Army Counterintelligence Coordinating Authority 


1-54. The ACICA is subordinate to the Army G-2X and is responsible for implementing and enforcing 
U.S. and DOD policy within the Army and providing oversight and technical control of all Army CI 
activities. The ACICA reviews, staffs, and coordinates all special investigative and collection techniques 
requested by Army CI elements. ACICA is responsible for approving all Army CI investigations, and for 
reviewing, staffing, and coordinating all CI operational plans and concepts with the appropriate agencies 
and approval authorities. It coordinates with other U.S. Government and military CI agencies to assist in 
the development and implementation of national CI strategies. 


Intelligence and Security Command 


1-55. The Army Intelligence and Security Command (INSCOM) executes departmental and operational CI 
activities with guidance from the Army G-2X. INSCOM has the responsibility for administrative C2 of all 
MI brigades supporting their respective theaters. INSCOM CI assets are task-organized and operationally 
employed based on mission and geographic requirements. Most MI brigades organize their CI assets into 
detachments with subordinate field or resident offices. 


OPERATIONAL 


1-56. Operational level CI assets are generally assigned to ASCC or combatant command organizations 
and are focused on a specific theater. CI, at the operational level, is primarily focused on CE and CI support 
to protection. Operational CI assets are instrumental in protecting bases of operations from infiltration, 
collection, planning, and targeting by FISS and ITO entities. Although operational CI elements have a vital 
mission to counter the FISS and ITO threat on a daily basis, they may be tasked to deploy and support 
contingency or combat operations. This is especially true in large-scale combat operations when the size, 
scale, and scope of the operation exceeds the capability of organic tactical CI assets to provide adequate 
support in the AO. When required, operational CI assets may be tasked to support strategic CI operations. 
Operational CI assets generally conduct the following activities: 


21 October 2009 FM 2-22.2 1-15 


FOR OFFICIAL USE ONLY 


Chapter 1 


e Advice and assistance—assist unit security managers and commander’s with knowledge on 
security programs and provide details on reporting potential FISS and ITO targeting and 
incidents of CI interest. 


e Education and awareness—provide FISS and ITO threat and CI awareness briefings to 
educate unit personnel, satisfy mandatory training requirements, and generate potential leads 
for incidents of CI interest. 


e TAs and VAs—conduct collection and analysis of FISS and ITO threat data for a specific 
unit, facility, operation, or activity to provide the supported commander knowledge on 
protection and security posture and make countermeasures recommendations to overcome 
deficiencies. 


e CI screening—vet locally employed persons (LEPs) in overseas and deployed locations for 
suitability to work, protection liabilities, associations, or contacts that may allow them to be 
used in other CI collection initiatives. 


e CI investigations—exploit or neutralize potential FISS and ITO collection threats targeting 
Army and DOD equities. 


è CI collection—detect and identify FISS and ITO intelligence collection activities targeting 
U.S. forces and devise other CI initiatives to counter, exploit, or neutralize the FISS and ITO 
collection capability. 


Theater Army G-2X 


1-57. The theater Army G-2X is the principal advisor to the theater Army G-2 and commander for all CI 
and HUMINT matters. The theater Army G-2X consists of the G-2X staff officer, theater HOC, Army 
theater counterintelligence coordinating authority (ATCICA), and OSC. It provides guidance and oversight 
based upon Army G-2X directives and theater requirements. It provides technical control, operational 
coordination, and CI oversight of all theater Army CI and HUMINT elements. The theater Army G-2X also 
coordinates technical support services, source registration and national level product support with the Army 
G-2X. Regional analysis and production is provided to theater consumers and forwarded to the Army G-2X 
for inclusion into the national database. 


Army Theater Counterintelligence Coordinating Authority 


1-58. The ATCICA is subordinate to the theater G-2X and is responsible for providing direct oversight, 
guidance, and technical control of all Army CI collection, investigative, and operational activities within 
their theaters of operations, including CI elements assigned to tactical organizations. ATCICA is 
responsible for reviewing and staffing all requests for special investigative and collection techniques and 
investigative and operational plans and concepts. The ATCICA is the interface between subordinate Army 
CI operational management elements and the ACICA. It is responsible for implementing Army CI policy as 
directed by the ACICA and Army G-2X. It conducts liaison with other U.S. Government, military, and 
host-nation (HN) intelligence, security, and law enforcement agencies (LEAs) to coordinate and deconflict 
CI activities. 


Military Intelligence Brigade 


1-59. MI brigades provide operational support to the separate ASCCs. CI elements in MI brigades support 
combatant commanders. Operational level CI activities and functions include: investigations, collection, 
analysis and production, and technical services and support. CI elements must be capable of quickly 
transitioning from a peacetime mission to crisis operations to support combatant commander requirements. 
Theater CI assets conduct Army, joint, and multinational operations in designated theaters. Operational 
elements may also be deployed to support or reinforce operating forces. 


1-16 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Mission, Structure, and Organization 


TACTICAL 


1-60. Tactical level CI generally denotes all CI assets assigned to Army division and below echelons 
(BCTs, and divisions). CI at the tactical level is primarily focused on CI support to protection to their 
supported commander’s during operations. CI assets at the tactical level are instrumental in protecting 
bases of operations from infiltration, collection, planning, and targeting by FISS and ITO entities. 


1-61. Tactical level CI assets generally do not have a robust peacetime mission since their focus is 
providing support to their Army forces parent organization; however, in some cases, operational and 
strategic CI elements may formally request their support on a case-by-case basis or through formal written 
agreements. Even during peacetime, garrison operations tactical CI assets are essential in providing advice 
and assistance to their supported command. Depending on the size, scale, and scope of ongoing operations, 
operational and strategic CI assets may also be tasked to augment tactical operations. CI assets assigned to 
tactical units generally conduct the following activities: 


e Advice and assistance—assist unit security managers and commanders with knowledge on 
security programs and provide details on those CI assets that can respond to FISS and ITO 
targeting. 


e Education and awareness—provide FISS and ITO threat and CI awareness briefings to 
educate unit personnel, satisfy mandatory training requirements, and generate potential leads 
for CI elements chartered to conduct investigations during peacetime. 


e TAs and VAs—conduct collection and analysis of FISS and ITO threat data for a specific 
unit, facility, operation, or activity to provide the supported commander knowledge on 
protection and security posture and make countermeasures recommendations to overcome 
deficiencies. 


e CI screening—vet LEPs in overseas and deployed locations for suitability to work, protection 
liabilities, associations, or contacts that may allow them to be used in other CI collection 
initiatives. 

e Cl investigations—identify potential CI investigation requirements and triage those incidents 
for other CI assets chartered to conduct the investigation. This can be accomplished during 
peacetime and contingency or combat operations. During contingency or combat operations, 
the chartered CI element may request the assistance of tactical CI personnel to fulfill 
investigative requirements. Tactical CI assets generally do not have the resources to 
effectively execute a complex CI or CE investigation. 


è CI collection—detect and identify FISS and ITO intelligence collection activities targeting 
U.S. forces and to devise other CI initiatives to counter or neutralize the FISS and ITO 
collection capability. CI collection is only conducted in contingency or combat operational 
environments and when approved by the CICA. 


CoRPS/DIVISION/BRIGADE G-2X 


1-62. The G/S-2X is the principal advisor to the supported commander for all CI and HUMINT matters 
within the AO. The G/S-2X consists of the G/S-2X staff officer, HOC, and the CICA. At lower echelons 
(for example, SBCT and BCT level), an OSC may not be authorized or resourced and may have to be task- 
organized to provide this capability. 


21 October 2009 FM 2-22.2 1-17 


FOR OFFICIAL USE ONLY 


Chapter 1 


1-63. The G/S-2X provides direct technical control and oversight to all CI and HUMINT assets within the 
unit and area of intelligence responsibility. The G/S-2X— 


e Coordinates and deconflicts all CI and HUMINT activities between higher, lower, and 
adjacent 2X elements. 


e Is responsible for providing and maintaining a consolidated source registration for all CI and 
HUMINT elements within the area of intelligence responsibility and providing source data to 
the next higher echelon 2X element. 


e Coordinates requests for technical support services, source registration, and higher level 
analytical support with the next higher echelon 2X element. 


e Must have knowledge of CI and HUMINT resources and capabilities for all military, DIA, 
and U.S. Government agencies. The G-2X must be able to transition from an Army force 
operation to functioning as a J-2X if the unit is designated as a JTF headquarters. 


Corps/Division Counterintelligence Coordinating Activity 


1-64. The corps/division CICAs are directly subordinate to their respective corps/division G-2X element. 
The CICA provides direct oversight and control for all CI activities within the supported unit and area of 
intelligence responsibility. The CICA is responsible for coordinating and deconflicting all CI activities with 
next higher echelon CICA. It conducts liaison with other U.S. Government, military, and HN intelligence, 
security, and LEAs within their area of intelligence responsibility to coordinate and deconflict CI activities. 
The CICA— 


e Reviews and provides quality control and dissemination of all CI reporting from subordinate 
CI elements. 


e Provides operational analysis to focus CI activities, assess responsiveness and effectiveness of 
CI activities, and ensures coverage of information requirements for their supported 
commander. 


e Must have knowledge of the CI resources and capabilities of all military, DIA, and U.S. 
Government agencies. 


e Must be able to transition from an Army force operation to functioning as a TFCICA if the 
unit is designated as a JTF headquarters. 


Corps/Division Counterintelligence Elements 


1-65. CI assets supporting division and JTF operations are generally leveraged from battlefield surveillance 
brigades (BFSBs). The G-2X at division will provide CI investigation and operational oversight along with 
technical control of CI elements supporting division elements. The division G-2X will coordinate CI 
activities through the JTF J-2X in theater and the theater CICA and senior CISO. The division G-2X is 
trained and equipped to act as a J-2X if the division is designated as the JTF command element during a 
contingency operation. At corps/division level, the BFSB MI battalion has three companies with CI assets. 
The C&E company has one CI OMT that controls three CI teams. Each CI team consists of four enlisted CI 
Soldiers. The C&E company’s mission is to provide general support coverage for the division. Each of the 
two CI and HUMINT companies has two CI teams and no CI OMT. The CI and HUMINT company’s 
mission is to provide its assets in direct support to the BCTs. 


Brigade Combat Team 


1-66. Within a BCT are no organic CI OMTs or CI teams in the MI company. CI support assigned or 
attached to the BCT includes an OMT or is controlled by the BCT S-2X/CICA. CI teams assigned or 
attached to the BCT conduct operations in a direct support role throughout the BCT’s AO. 


1-18 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Chapter 2 
Counterintelligence Investigations 


Counterintelligence (CI) investigations are conducted to detect, identify, assess, 
counter, neutralize, or exploit the foreign intelligence and security services (FISS) 
and international terrorist organizations (ITO) threat to the Army and Department of 
Defense (DOD). The first priority for all CI investigative situations is to assess for 
possible exploitation. Offensive exploitation of situations or persons involved 
wittingly or unwittingly in providing information to a FISS and ITO entity provides 
the best long-term solution for controlling damage to national security, fully 
exploiting or understanding the threat to Army and DOD equities, and degrading the 
adversarial collection activity. If a situation or person cannot be controlled to the 
advantage of Army CI, neutralization of the threat through exposure or prosecutorial 
measures will be pursued. 


INVESTIGATIVE PERSONNEL 


2-1. CI investigations are conducted only by CI personnel who have been trained and certified by the 
Army Intelligence Center and Fort Huachuca (USAIC&FH). Additionally, only those CI personnel 
assigned or attached to units with a CI investigative mission are authorized to conduct a preliminary inquiry 
(PJ) or a full field investigation (FFI). Personnel authorized to conduct CI investigations are commissioned 
officers who possess area of concentration (AOC) 35E; warrant officers (WOs) who possess AOC 351L; 
enlisted military occupational specialty (MOS) personnel who possess MOS 35L and have been issued 
badge and credentials; or by Army civilian employees in career field 0132, who are assigned to CI units, 
have been school-trained, and are issued badge and credentials. (See AR 381-20 for more information on 
training and badge and credentials requirements.) 


2-2. Local national and contract investigators employed by overseas Army CI units that have been issued 
military intelligence (MI) representative credentials may support the investigative effort through analysis, 
research, and by obtaining documentation. They will not be primary or sole investigators on any 
investigation. 


2-3. Contractors are not authorized to perform CI investigations and operations. They are authorized to 
support CI activities that include conducting CI analysis, forensic examinations and analysis, translations 
and interpretations, CI database maintenance, CI awareness briefings, CI threat assessments (TAs), 
vulnerability assessments (VAs), and CI screenings of contract linguists. 


COUNTERINTELLIGENCE INVESTIGATION OBJECTIVES 


2-4. CI investigations are essential to counter threat collection efforts targeting Army equities. CI places 
emphasis on investigative activity to support force and technology protection, homeland defense, 
information assurance, and security programs. CI investigations focus on resolving allegations of known or 
suspected acts that may constitute national security crimes under U.S. law or the Uniform Code of Military 
Justice (UCMJ). 


21 October 2009 FM 2-22.2 2-1 


FOR OFFICIAL USE ONLY 


Chapter 2 


2-5. The initial objective of CI investigations is to identify people, organizations, and other entities 
engaging in national security crimes and to determine the full nature and extent of damage to national 
security. The intent is to develop information of sufficient value to permit its use in the appropriate civil or 
military court. However, investigations should not be limited to the production of evidence. Investigative 
reports should include all relevant information as it pertains to the person or incident involved in the 
investigation. CI investigations are conducted to— 


e Identify people, organizations, and other entities engaging in national security crimes that 
impact Army equities. 


e Determine the full nature of national security crimes within the authority and jurisdiction of 
Army CI. 


e Prove or disprove allegations or indications that person or persons are engaged in national 
security crimes or incidents of CI interest. 


e Prevent the loss, control, or compromise of sensitive or classified defense information and 
technology. 


e Protect the security of Army personnel, information, operations, installations, and technology. 


e Acquire and preserve evidence used to support exploitation, prosecution, or any other legal 
proceedings or punitive measures resulting from CI investigations. 


e Detect and identify terrorist activities that may present a threat to Army, DOD, and national 
security. 


2-6. CI investigations must conform to applicable U.S. laws and DOD and DA regulations. CI special 
agents must report information accurately and completely. They maintain files and records to allow transfer 
of an investigation without loss of control or efficiency. Coordination with other CI or law enforcement 
organizations ensures that investigations are conducted as rapidly as possible. It also reduces duplication 
and assists in resolving conflicts when jurisdictional lines are unclear or overlap. CI investigative activity 
must be discreet, ensuring the rights and privacy of individuals involved, as well as the preservation of all 
investigative prerogatives. This is required to protect the rights of individuals and to preserve the security 
of investigative techniques. 


2-7. CI special agents need to have a thorough understanding of all investigative techniques and planning, 
approval processes, and legal requirements before requesting and initiating any type of CI investigative 
activity. A lack of understanding in any one of these areas may potentially invalidate any investigation 
from a prosecutorial standard and may jeopardize the ability to exploit a threat to the United States. 


INVESTIGATIVE AUTHORITY 


2-2 


2-8. DODI 5240.04 and AR 381-20 are the source documents for policy on the conduct of CI 
investigations in DOD and Army, respectively. In addition, the Delimitations Agreement of 1979 
establishes jurisdictional boundaries and operational procedures that govern the conduct of CI activities by 
the DOD CI organizations in conjunction with the Federal Bureau of Investigation (FBI). 


2-9. SIA represents the investigative acts an agent conducts without the Army CI coordinating authority 
(ACICA) opening an investigation. It allows the CI special agent to gather enough information to provide a 
detailed CI incident report concerning all incidents within the purview of CI investigative authority. This 
allows adjudication by the ACICA or the responsible Army theater CI coordinating authority (ATCICA) to 
determine whether further investigative activities are required or a CI incident report is submitted to the 
ATCICA. SIA is not to be used to circumvent case control mechanisms or to expedite cases. 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


2-10. CI SIA includes— 


e Interviewing the source or best sources or other persons knowledgeable of the suspected 
incident to establish facts of the incident, fully identify subjects, identify all associated 
persons, and additional investigative leads. 


e The conduct of records checks including local agency checks (LACs) and military agency 
checks (MACs), Army personnel and unit records, and local intelligence files to fully identify 
the subject or subjects of the incident. 


è Collection and retention of physical evidence not requiring approval under the provisions of 
AR 381-10. 


e CI debriefing of returned special category absentees, defectors, detainees, and repatriated 
prisoners of war (POWs) in the special agent’s AO immediately upon notification. 


e Monitoring command inquiries for incidents that may be of CI interest. 


Note. Under no circumstances will the subject or potential subject be interviewed without prior 
approval from ATCICA or ACICA. 


COUNTERINTELLIGENCE INVESTIGATIVE JURISDICTION 


2-11. In accordance with EO 12333, DODD 5240.1-R and 5240.2, and AR 381-20, Army CI has 
investigative authority concerning criminal statutes under USC Title 18 and corresponding criminal articles 
in the UCMJ or incidents of CI interest, if the subject or potential subject meets the CI investigative 
jurisdiction. Army CI has primary jurisdiction, concurrent jurisdiction, or joint jurisdiction in investigative 
matters under the provisions of AR 381-20. 

PRIMARY AUTHORITY 


2-12. Army CI has investigative primacy for the national security crimes and incidents of CI interest listed 
below when they are committed by persons identified as subjects. If either the subject, potential subject, 
incident, or crime falls outside Army CI jurisdiction, Army CI may still retain joint investigative 
responsibilities. 


e Sedition. 

e Aiding the enemy by providing intelligence to the enemy. 
e Spying. 

e Espionage. 

@ Subversion. 

e Treason. 


e Terrorism activities or materiel support to a known or suspected terrorist organization or 
person (DCS G-2, G-2 Memorandum (S//NF), 24 August 2005). 


e Incidents of CI interest. 


Note. Under no circumstances will the subject or potential subject be interviewed without prior 
approval of the ACICA. 


21 October 2009 FM 2-22.2 2-3 


FOR OFFICIAL USE ONLY 


Chapter 2 


CONCURRENT AUTHORITY 


2-13. CI investigating elements will coordinate with other agencies to ensure efficient exchange of 
investigative information when the element discovers information that may also fall under the investigative 
purview or jurisdiction of another agency. Army CI will concurrently investigate the following incidents 
when a CI interest has been established: 


e Sabotage. 


e Incidents of CI interest. 


JOINT AUTHORITY 


2-14. Army CI may seek joint investigative authority with the agreement of the other military or civilian 
law enforcement agencies (LEAs) and the ATCICA or ACICA for— 


e National security crimes involving other DOD affiliated individuals when Army equities 
exist. 


e Incidents of CI interest. 


SUBJECTS 


2-15. Inside the United States, Army CI is responsible for investigations of active duty U.S. military 
personnel. The FBI is responsible for investigations of all civilian personnel, private DOD contractors, and 
their employees. Army CI has primary investigative jurisdiction for retired personnel, active and inactive 
Reservists, and National Guard members when the act or acts under investigation occurred while the 
individual was on Active Duty status. 


2-16. Outside the United States, Army CI has investigative jurisdiction over active duty military personnel 
and their family members, current and former DOD civilian employees and their family members, current 
and former foreign national employees and their family members, and DOD contractors and their family 
members, subject to coordination with the FBI, CIA, or host government agencies; retired military 
personnel; Army Reserve personnel; members of the National Guard while in the performance of DOD 
duties; and foreign nationals who are applicants for DOD employment. 


INCIDENTS OF COUNTERINTELLIGENCE INTEREST 


2-4 


2-17. The following is not an all-inclusive list of incidents of CI interest: 


e The activities of ITO or material support to an ITO or person. Terrorist organizations are 
specified in DCS, G-2 Memorandum (S//NF), dated 13 February 2007, Operational Planning 
List (OPL) 2005 (U), as revised. 


e Unreported contact with foreign government personnel, persons or groups involved in foreign 
terrorism or intelligence, or unauthorized requests for classified or sensitive unclassified 
information. 


e Unauthorized disclosure of classified information or material. Not all incidents in this 
category may meet the threshold for a CI investigation. However, those that do will often 
include other indicators of espionage that are identified associated with the incident or when 
there are acts which are known methods of operations of FISS and ITO entities. Investigations 
are conducted to ascertain those entities involvement. CI special agents may also act to secure 
classified material and to determine if the actions of the subject were an act of omission or 
commission. The command requirements to report compromises or conduct inquiries as 
specified in AR 380-5, chapter VI, may also apply to these incidents. 


e Matters developed as a result of counterintelligence scope polygraph (CSP) examination as 
specified in AR 381-20. 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


e Military personnel or DAC employees who perform unofficial travel to those countries 
designated in the operational planning list, who have unauthorized contact with official 
representatives of foreign countries, or who contact or visit foreign diplomatic facilities 
without authorization. 


e Attempts by authorized users of information systems to gain unauthorized access. 


e Known, suspected or attempted intrusions into classified or unclassified information systems 
when there is reasonable suspicion of foreign involvement or it has not been ruled out. 


e Unauthorized removal of classified material or possession of classified material in 
unauthorized locations. 


e Special category absentees (SCAs), which include those absent without leave (AWOL), 
deserters defectors, and military absentees who have had access to TS, SCI, SAP information, 
or TS cryptographic access or an assignment to a special mission unit within the year 
preceding the absence. CI special agents will conduct investigations of the circumstances 
surrounding the absences of SCA personnel using the guidelines presented in this manual. 


e Army military, civilian, or overseas contractor personnel declared AWOL and deserters who 
had access within the preceding year to TS, SCI, critical military technology as defined in 
AR 381-20, chapter 7, SAPs; personnel who were assigned to a special mission unit; 
personnel in the DA Cryptographic Access Program (DACAP); and personnel with access to 
critical nuclear weapons design technology. 


e Army military, civilian, or overseas contractor personnel who go absent without authority, 
AWOL, or deserters who do not have assignments or access; however, there are indications of 
FISS and ITO contact or involvement in their absence. 


e DA military and civilian personnel who defect and those persons who are absent without 
authorization and travel to or through a foreign country other than the one in which they were 
stationed or assigned. 


e DA military and civilian personnel detained or captured by a government, group, or adversary 
with interests inimical to those of the United States. Such personnel will be debriefed upon 
return to U.S. control. 


e Attempted or actual suicide or suspicious death of a DA member if they have an intelligence 
background, were assigned to an SMU, or had access to classified information within the year 
preceding the incident, or where there are indications of FISS and ITO involvement. 


e Suspected or actual unauthorized acquisition or illegal diversion of military critical 
technology, research and development information, or information concerning an Army 
acquisition program. If required, Army CI will ensure all appropriate military and civilian 
intelligence and LEAs are notified. Army CI will also ensure Army equities are articulated 
and either monitor the status of the agency with primary jurisdiction or coordinate for joint 
investigative authority. 


e Impersonation of intelligence personnel or unlawful possession or use of Army intelligence 
identification, such as badge and credentials. 


e Communications security (COMSEC) insecurities, except those which are administrative in 
nature. (See AR 380-40, chapter 7.) 


e Suspected electronic intrusions or eavesdropping devices in secure areas which could be used 
for technical surveillance. DA personnel discovering such a device will not disturb it or 
discuss the discovery in the area where the device is located. 


e Willful compromise of clandestine intelligence personnel and CI activities. 


21 October 2009 FM 2-22.2 2-5 


FOR OFFICIAL USE ONLY 


Chapter 2 


COUNTERINTELLIGENCE INVESTIGATIVE CONTROL AND 
OVERSIGHT 


2-18. The Deputy Chief of Staff, G-2 (DCS G-2), exercises DA staff oversight and technical authority for 
all CI activities and is responsible for appointing Army G-2X. The Army G-2X is the Army’s executive 
agent for all Army CI activities at the Army staff level. On behalf of the DCS G-2, the Army G-2X 
formulates policies for the conduct, management, direction, and control of CI investigations. 


2-6 


2-19. For the Army G-2, the Army G-2X maintains the ACICA who provides daily technical management, 
control and oversight for all Army CI functions, including, investigations, collection, operations, projects, 
programs, collection, reporting and analysis. The ACICA exercises technical control and coordination for 
all Army CI elements and is the ultimate case control over all investigations. 


2-20. The ACICA exercises technical control, review, coordination, and oversight of Army CI controlled 
activities. The ACICA has specific responsibility to— 


Act as the ultimate approval authority to open or initiate and close or terminate CI 
investigations. 


Assign case control numbers for tracking and operations security (OPSEC) purposes. 


Serve as the single focal point for all CI investigative referrals to or operational coordination 
with national intelligence, CI, and LEAs, Office of Personnel Management (OPM). 


Provide CI expertise to outside continental United States (OQCONUS) ASCCs in the 
establishment of ATCICA when directed. 


Refer information which is not under Army CI investigative jurisdiction and which does not 
involve Army equities to appropriate security, intelligence, or LEAs. 


Review of CI investigative and operational reports for quality assurance and intelligence 
oversight. 


Coordinate for review of legal sufficiency. 


Ensure that closed, completed, or terminated case files, project files, source dossiers records, 
and reports are properly classified or declassified and retired to the U.S. Army Investigative 
Records Repository (USAIRR). 


In coordination with appropriate ATCICA, review information derived from active and 
terminated CI investigations to ensure any information meeting intelligence reporting 
requirements is properly submitted using IIR format. 


Maintain a database for all Army CI investigations. 


2-21. The ATCICA is responsible for providing the ASCC with the technical expertise to ensure that CI 
activities are conducted in a competent, legal, and proper manner within their AOR. The ATCICA will 
perform the following functions: 


Serve as the central focal point for monitoring the conduct of CI controlled activities within 
an AOR. 


Assignment of case control numbers to CI preliminary inquiries for tracking and OPSEC 
purposes. 


Coordinate with the ACICA opening and closing CI investigations, and be responsive to 
requirements of and direction from ACICA. 


Provide theater-wide technical management, control, and oversight of all Army CI activities, 
including investigations. This includes activities conducted by non-INSCOM CI units and 
elements operating in a deployed status in the ATCICA AOR. 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


e Actas the principal Army interface with the theater joint or combatant commander on all CI 
activities. 


e Provide action or information copies to ACICA on all CI investigative reporting, including CI 
incident reports, investigative plans (IPs), and requests for approval for special investigative 
techniques in accordance with AR 381-10. 


e Task investigative elements within theater and pass lateral leads to other ATCICA elements, 
with an information copy to the ACICA. 


e Ensure all 381-10 procedural requests are reviewed by the command legal officer or SJA and 
intelligence officer before being forwarded to approval officials. 


2-22. Commanders of units with a CI investigative mission are responsible for ensuring that the ACICA 
has full knowledge of all CI investigations. The commander has responsibility to— 


e Ensure all CI units and personnel submit all CI reporting to the ATCICA and respond to 
tasking from the ATCICA and ACICA using the most direct channel. 


e Ensure the ATCICA is informed of all significant CI investigations and operations so that the 
ATCICA and ACICA are properly prepared to inform or brief the chain of command. 


COUNTERINTELLIGENCE INVESTIGATION TYPES AND 
CATEGORIES 


2-23. CI investigations focus on a person, incident, or systemic issue that are of potential interest to CI. 
The subject and type of incident identified during the initial reporting of a CI matter will often determine 
the type of investigation required as well as the scope of the investigation, resources, and various types of 
investigative techniques required to effectively investigate and resolve the incident. Investigations 
generally begin as incident investigations concerning acts or activities which are committed by, or involve, 
known or unknown persons or groups. The amount of information obtained during lead development 
concerning persons involved and the threat posed to Army equities will determine the type of investigation 
that will be conducted. 


LIMITED COUNTERINTELLIGENCE ASSESSMENT 


2-24. Army CI investigative elements conduct investigative activity under limited CI assessment (LCA) in 
response to information which normally does not require the submission of a CI incident report in 
accordance with AR 381-12, paragraphs 3-1, 3-2 and 3-3, but which still represents a potential CI threat to 
the Army and DOD. LCA investigative objectives are to quickly collect available information through 
relatively nonintrusive means to clarify and establish CI interest, or to effectively determine that no CI 
threat information exists. Army CI investigative elements may engage in the following investigative 
activities under LCA, consistent with their assigned CI investigative mission: 


e Collect publicly available information, as well as information from online services and 
resources available to and as approved for use by the reporting CI element. 


e Conduct records checks with military units and offices, including Army personnel and finance 
centers, for example: 


= Checks with other federal, state, and local law enforcement and intelligence 
organizations. 


= Checks with HN law enforcement and intelligence organizations OCONUS. 
=" Reviews Army CI and Army intelligence files and databases. 


e Collect and retain items for evaluation as physical evidence not requiring approval under the 
provisions of AR 381-10. 


21 October 2009 FM 2-22.2 2-7 


FOR OFFICIAL USE ONLY 


Chapter 2 


2-8 


e Interview previously established Army CI sources and liaison contacts. This does not allow 
for the new tasking of those recruited assets. 


e Accept information voluntarily provided by any military, government, or private persons or 
entities. Army CI special agents may always accept and review voluntarily provided 
information or materials to determine potential CI interest. 


e Interview or request information (other than under pretext) from Army affiliated persons and 
members of the public and private entities. Interviews or RFIs from non-Army affiliated 
personnel or entities are authorized, subject to existing coordination requirements with other 
agencies or authorities, such as the FBI in the continental United States (CONUS), and CIA 
chiefs of station and HN authorities OCONUS in accordance with an existing Status of Forces 
Agreement (SOFA). In areas without a SOFA or in contingency areas, local commanders will 
provide appropriate guidance. Interviews of investigative subjects, potential subjects, or any 
other persons which would require a rights warning are not authorized during investigative 
activities associated with LCA. 


e Provide assistance to inquiries of supported commands conducted in accordance with 
AR 380-5 and AR 15-6 when related to matters of possible CI interest. Army CI investigative 
assistance to support such command inquiries will be limited to those activities identified 
above, and may be conducted in coordination with the appropriate commander or 
investigating officer. Additionally, Army CI special agents may participate in AR 380-5 and 
AR 15-6 investigative interviews only upon request by the command investigating officer. 
Army CI may not provide any assistance to investigating officers to support AR 380-5 and 
AR 15-6 investigations when no indication of possible CI interest exists, except as identified 
in AR 381-20. Army CI investigative personnel will ensure command investigative 
representatives fully understand that Army CI investigative assistance is conducted under 
authority of Army CI and not the command. AR 381-20 currently authorizes Army CI 
personnel to provide investigative advice to command security investigations. 


2-25. Investigative activity under LCA is authorized for 60 days upon written approval by an Army CI 
special agent at or above the grade of 03/CW3/GG13 who occupies the position of commander, leader, or 
operations officer of an Army CI detachment, resident office, region, or other field element of an INSCOM 
major subordinate command (MSC) or the 650th MI Group. LCA approvals will be forwarded within 3 
days for informational purposes to the INSCOM MSC/650th MI Group headquarters. Army CI special 
agents in possession of CI badge and credentials who are not assigned to INSCOM MSC/650th MI Group 
elements may conduct LCA investigative activities only upon written approval from the covering ATCICA 
or the ACICA. 


2-26. In support of contingency deployments, the ATCICA or ACICA may grant temporary LCA approval 
authority to CI special agents at the grade of O3/CW3/GG13 or above, who are assigned to leadership or 
staff positions in non-INSCOM MSC/650th MI Group elements. LCA investigations will not exceed 60 
days, unless specifically approved by the ATCICA, ACICA or an INSCOM MSC/650th MI Group 
commander based on written justification for the continued LCA investigative activity. Once terminated, 
results of LCA activity will be reported to respective INSCOM MSC/650th MI Group headquarters or the 
covering ATCICA by means of an executive summary or information paper which will include, at a 
minimum, the initial case predication, a summary of investigative results, and the reason for termination. 


2-27. Investigative activities conducted under LCA will be documented within five work days via a 
memorandum for record (MFR) using locally assigned case control numbers and maintained in a standard 
investigative case file. Investigative reporting under LCA will not normally be archived in the USAIRR 
unless specifically required by the ACICA, ATCICA, or the INSCOM MSC/650th MI Group commander. 
If the matter progresses to a preliminary or full investigation, all investigative reporting under the LCA will 
be incorporated into the main preliminary or full investigative case file. At a minimum, investigative 
reporting under LCA will be maintained in accordance with the requirements under the Army Records 
Information Management System (ARIMS). 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


2-28. All activities conducted under LCA are subject to provisions of AR 381-10 regarding the collection, 
retention, and dissemination of U.S. person information, and will be regularly inspected under 
organizational inspection programs regarding their scope, management, and execution. All Army CI 
investigative elements will report statistics on a quarterly basis to their respective INSCOM MSC/650th MI 
Group headquarters or covering ATCICA concerning the number of LCA’s initiated and terminated during 
the reporting period. 


2-29. Army CI investigative elements will not utilize LCA as the basis for delaying or not submitting a CI 
incident report or local threat report as required by AR 381-12. After submission of a CI incident report, 
investigative elements will await case determination by the ACICA, ATCICA, or INSCOM MSC/650th MI 
Group headquarters before continuing investigative activity. If no preliminary or full investigation is 
opened as the result of a CI incident report, investigative elements have the authority to continue LCA 
activities to clarify or expand on information of possible CI interest. 


PRELIMINARY INQUIRIES 


2-30. A PI is a limited scope inquiry concerning reported incidents of CI interest to ascertain if a threat to 
national security exists; or a criminal offense within Army CI authority has occurred and warrants further 
CI investigative actions or resources. A PI can be locally approved by the CI investigating unit’s 
responsible ATCICA after the submission of an CI incident report has been submitted. PIs may include the 
conduct of all investigative activities under SIA as well as the following: 


e Interviews of sources other than the subjects or potential subjects to identify the subject. 


e Regional, state, or HN records checks and National Crime Information Center (NCIC) 
queries. 


e ACICA approval—pretext or subject interviews. 


e When timing is critical and the action is approved by an official specified by AR 381-10, 
chapter 9, emergency surveillance may be conducted to identify a known or suspected agent, 
or official of foreign power or known or suspected member of a terrorist group. (See 
AR 381-20.) 


2-31. PIs will be conducted at the direction of the responsible ATCICA. The ACICA, with the responsible 
ATCICA, will decide dispositions of all PIs. Disposition may include the following: 


e Continuance or extension of PI. 
e Transition to an FFI. 


e Transfer of investigative interest to another investigative agency based upon priority of 
authority or investigative responsibility. 


e Closure of the investigation if it is determined that no matters of CI interest are involved. 


2-32. A PI must either be closed or transitioned to an FFI within six months, unless an extension is 
approved by the ACICA. If a reported incident or allegation has sufficient merit upon CI incident reporting, 
a PI need not be conducted as a precursor to the approval of an FFI. 


FULL FIELD COUNTERINTELLIGENCE INVESTIGATIONS 


2-33. FFIs are conducted when specific facts have been identified that someone under Army CI authority 
has committed or allegedly committed a national security crime or incident of CI interest. 


2-34. An FFI may be initiated with the concurrence of the ACICA after the submission of a CI incident 
report. 


2-35. The ATCICA is responsible for monitoring all investigative activities of opened FFIs within their 
AOR and to coordinate all requests for all special investigative techniques with appropriate approving 


21 October 2009 FM 2-22.2 2-9 


FOR OFFICIAL USE ONLY 


Chapter 2 


authority within AR 381-10 and to consult with the ACICA concerning the status and investigative activity 
for all FFIs within their AOR. 


2-36. The ACICA may designate an FFI as a high priority based upon the significance of the investigation 
and threat to Army equities involved. Commander’s of CI units who have an open FFI that has been 
designated as high priority by the ACICA will ensure that the FFI takes precedence over all other CI 
functions and will allocate appropriate levels of resources, manpower, and effort to the FFI. 


SPECIAL CATEGORY ABSENTEE INVESTIGATIONS 


2-37. SCA are personnel considered AWOL, deserters, defectors, and military absentees who are of 
potential interest to CI. CI investigative focus in SCA investigations is to determine if any national defense 
information was compromised or the offense was conducted at the direction or with the support of a foreign 
government, military, or intelligence agency or a known terrorist entity. Army CI SCA investigations are 
conducted to determine the following: 


e Circumstances and motivation of the absence. 


e Evidence of foreign intelligence or terrorist involvement or indications of potential espionage 
or subversion at the behest of a foreign entity. 


e Indications of loss or compromise of classified or national defense information. 
e Indications of or potential for defection or travel to or through a foreign country. 
e Any connections in or with persons in foreign countries, including relatives. 


e Depending upon the SCA status, AWOL, deserter or defector, refer to this manual for specific 
debriefing criteria. 


2-38. Primary investigative jurisdiction for Army personnel declared AWOL rests with the Provost 
Marshal. Should the military member be declared a deserter, the U.S. Army Criminal Investigations 
Command (USACIC) assumes primary jurisdiction. Although Army CI does not have primary jurisdiction 
in SCA cases, Army CI may investigate for the reasons under CI investigative control and oversight. 


2-39. When a CI element is notified of the absence of an SCA meeting, a CI incident report, citing the 
SCA as the subject, will be submitted within 72 hours to the responsible ATCICA. If the subject is not 
immediately returned to U.S. military control, the ACICA will make a determination to designate the case 
OPEN or TERMINATED. 


2-40. CI elements need to establish a close working relationship with all PMOs, MP, and criminal 
investigation units within their AOR to ensure that these units are aware of the topics of potential CI 
interest that should be referred to CI. 


INVESTIGATIVE PROCESS 


2-41. The CI investigation process consists of lead development, planning and approval, investigative 
activities, and termination or transfer. See figure 2-1 for the investigative life cycle. 


2-10 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


pment 


Legend: 
| - Process © - Decision Point Ga - Document CD - Termination O - Database 


Figure 2-1. Investigative life cycle 


LEAD DEVELOPMENT 


2-42. A proactive CI program at all echelons, tactical to strategic, is required to educate military members 
(Soldiers, civilians, and contractors) and generate CI leads. Military members often do not understand what 
types of incidents are of interest to CI and may also not understand their reporting obligations under the 
provisions of AR 381-12. All five functions of CI (investigations, operations, collection, analysis, and 
technical services) can be used to identify and generate potential CI investigative leads. 


2-43. A proactive CI program should, at a minimum, consist of an aggressive education and awareness 
program, close and professional relationship with supported commanding officers and unit security 
managers or officers. In addition to generating potential CI investigative leads, these activities can also 
support CI collection activities to answer SCICRs or unit CCIRs. 


21 October 2009 FM 2-22.2 2-11 


FOR OFFICIAL USE ONLY 


Chapter 2 


THE COUNTERINTELLIGENCE AWARENESS AND REPORTING PROGRAM 


2-44. The CI Awareness and Reporting Program is an education, awareness, and reporting program to help 
identify potential incidents of CI interest. The program is a primary factor in obtaining information that is 
the basis for initiating CI investigations in response to suspected national security crimes under Army CI 
jurisdiction. AR 381-12 requires Army personnel, both civilian and military, to report matters of potential 
interest to CI. This program also mandates CI awareness training be scheduled by all units on an annual 
basis with the supporting CI office. CI training of personnel assigned to all units is subject to inspection by 
the Inspector General (IG) office as well as under the Command Inspection Program. CI awareness 
briefings should be given by qualified CI special agents whenever possible. CI awareness presentations 
should, at a minimum, contain— 


e FISS and ITO collection methods of operation. 
e Criminal penalties for the various national security crimes under CI authority. 


e Type of situations and CI incidents of additional matters of CI interest that should be reported 
(see AR 381-12, chapter 3). 


e Indicators of espionage (see figure 2-2). 
e Reporting procedures, responsible CI elements, and the 1800 CALL SPY program. 
e Initial Reporting. 


2-45. The CI Awareness and Reporting Program, along with persons who have good situational awareness 
of CI reporting requirements, will generally be the initial source for identifying indicators or anomalies for 
incidents under the purview of CI authority. 


Note. When operationally feasible, all CI incidents will be reported by the investigating CI 
special agent within 72 hours after receipt of the information. If the reported information 
identifies an imminent threat to U.S. forces, then the information needs to be reported 
immediately through command channels with a follow-up report provided to the ACICA or 
ATCICA. 


2-46. All initial reports will be reported directly to the ACICA and a courtesy copy provided 
simultaneously to the responsible ATCICA and the chain of command (if the investigating agent belongs to 
an operational CI unit). If the investigating CI special agent is unsure whether the reported incident meets 
the criteria of those reportable matters specified in AR 381.12, a report will be submitted to the ACICA and 
ATCICA for a determination. The investigating CI special agent will obtain as much information as 
possible from the initial source including— 


e Pertinent details of the suspected incident, date, time, time span, locations, suspected acts, 
conversational details, information involved. 


e Personal information concerning known additional sources of the reported incident, witnesses 
to the incident or subjects or potential subjects involved in the incident. A person is 
considered known when they can be identified by at least a first and last name and unit of 
assignment or employment location). 


e Physical descriptions of unidentified witnesses to the incident or subjects or potential subjects 
involved in the incident. 


e Personal information concerning the source of the information. 


PLANNING AND APPROVAL 


2-47. Due to the legal complexities involved in CI investigations, investigative planning and approval has 
to be detailed and meticulous to maintain the legal integrity of the case and/or to compartmentalize the 


2-12 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


21 October 2009 


Counterintelligence Investigations 


knowledge of the incident to allow for potential exploitation of the incident. The ACICA will review and 
approve all IPs and subject interview plans (SIPs) submitted by the investigating element. 


Indicators of Espionage 


* Any attempt to expand access to 
classified information by repeatedly 
volunteering for assignments or duties 
beyond the normal scope of responsibilities 
or attempting to obtain information for 
which the person has no authorized access 
or need to know. 


* Unauthorized removal of classified materials 
from work area or unauthorized possession 
of classified materials outside the work areas, 
such as in residences or vehicles. 


+ Extensive use of copy, facsimile, or computer 
equipment to reproduce or transmit classified 
material which may exceed job requirements. 


* Repeated or unrequired work outside normal 
duty hours, especially unaccompanied. 


* Obtaining witness signatures on classified 
document destruction forms when the witness 
did not observe the destruction. 


* Bringing unauthorized cameras, recording 
devices, computers, or modems into areas 
where classified data is stored, discussed, 
or processed. 


+ Unexplained or undue affluence, including 
sudden purchases of high-value items (real 
estate, stocks, vehicles, or vacations, for 
example) where no logical income source 
exists. Attempts to explain wealth by 
reference to inheritance, luck in gambling, 
or some successful business venture. 


* Opening several bank accounts containing 
substantial sums of money where no 
logical income source exists. 


* Free spending or lavish display of 
wealth which appears beyond 
normal income. 


* Sudden reversal of financial situation 
or sudden repayment of large debts 
or loans. 


* Correspondence with persons in 
countries listed in AR 381-12. 


e Unreported contact with officials of 
countries listed in AR 381-12. 


* Frequent or unexplained trips of short 
duration to foreign countries. 


* Attempts to offer extra income from an 
outside endeavor to personnel with 
sensitive jobs or to entice them into 
criminal situations which could lead 
to blackmail. 


* Homesteading or repeatedly requesting 
extensions to tours of duty in one 
assignment or location, especially when 
the assignment offers significant access 
to sensitive information or the job is not 
desirable. 


* Repeated involvement in security 
violations. 


* Joking or bragging about working for a 
foreign intelligence service. 


e Visits to a foreign embassy, consulate, 
trade, or press office. 


Figure 2-2. Indicators of espionage 


FM 2-22.2 


2-13 


FOR OFFICIAL USE ONLY 


Chapter 2 


2-48. If the ACICA determines that a CI incident report merits CI investigation, it will direct that one be 
initiated and, except for full field CI investigations, the responsible ATCICA will maintain technical 
control, management, and oversight of all investigative activities within their AOR. All investigative 
reporting, plans, and requests for special investigative techniques will be forwarded to the ATCICA for 
review and quality control before submission to the ACICA for higher levels of approval or before 
forwarding to the approving authority. Interagency investigative coordination will be the responsibility of 
the CI element on the ground. If problems with interagency cooperation arise, they will be forwarded to the 
appropriate element commander to raise the issue to the appropriate agency headquarters. 


Investigative Plan 


2-49. The IP is the document that provides a detailed road map on the conduct of CI investigations 
including all investigative participants, all investigative activities required, all resources and external 
support required, and all interagency or legal coordination required to successfully resolve the incident. IPs 
are living documents and may require revision due to information development and case direction. All 
updates or revisions will be forwarded to and approved by the ACICA before implementation. 


2-50. An IP is required in all open FFIs for investigative actions. IPs are not usually required for a PI; 
however, the responsible ATCICA may direct the submission of an IP based upon the circumstances of the 
PI. An IP is prepared by the lead agent in collaboration with the senior supervisory CI special agent and the 
ATCICA. The IP is used to outline and request approval for investigative authority; however, some 
investigative activities may require submission of additional documentation for coordination and approval. 
The submission date for the IP will be directed by the responsible ATCICA and unit SOPs. Note that in 
especially sensitive or high visibility cases IP approval may rest with a higher headquarters, ASCC, 
ACICA, or Headquarters, DA (HQDA) level. While the format for IPs may vary slightly between all the 
ATCICAs, the content of the IP will, at a minimum, include the following: 


e References. The subject block or title for the CI incident report and any subsequent 
investigative reports that precipitated the opening of the investigation by the ACICA. 


è Title. The subject block with the assigned Army case control number assigned by the ACICA 
in the investigation opening message. 


e Background. A synopsis of the incident under investigation. 


e Investigative objectives. Identification of subjects and relationships between subjects and 
FISS and ITO; confirming, mitigating, or refuting the suspected allegations concerning the 
subjects; the nature and/or extent of the compromise of classified information or technology; 
to assess the damage to national security; determine the involvement and methodologies of 
FISS and ITO. 


e Investigative actions. All projected activities required to conduct the investigation and 
resolve the incident including records checks (local and military), interviews of all persons 
who may be able to provide details concerning the incident, all persons who may be 
considered witnesses to the incident and subjects interviews, any projected approvals for 
interviews, general or investigative techniques, submission of final report of investigation 
(ROD. 


e Joint investigative coordination. All activities conducted with or supported by external 
military, civilian, or HN agencies during the course of the investigation. 


e ICF. The projected amount of funds required to support all investigative activities through the 
life of the investigation. 


e Coordination required. All activities by external agencies required to support the 
investigation which may include technical support for special investigative techniques; legal 
coordination before subjects interview; coordination for apprehension, detention, and searches 
by the appropriate approval authority. 


2-14 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


Updating Investigative Plans 


2-51. An IP will be updated when there is a change in focus of the investigation, or a major occurrence that 
sheds new light on the evidence or shows a new direction for the investigation to follow. To avoid 
confusion and errors in communications, there can be only one IP as the sole investigative guide for 
planned or projected investigative activity in the affected case. Therefore, an updated IP must supersede all 
previous versions. The lead agent and the desk officer must assume that, in the natural course of an 
investigation, developed facts and information will dictate a revision to the IP. A revised IP can be written 
at any time. It is not necessary to wait for the ATCICA or ACICA to update IP. At or near the transition 
from one phase to another, the entire case should be reviewed to ensure it remains focused, the 
investigative activity supports the objectives and follow-on activities are appropriate. It is not necessary to 
finish every investigative action in the original approved IP before submitting an updated IP or to finish all 
investigative actions in the original IP before starting the investigative actions requested and approved in 
the updated IP. 


Joint Investigative Plans 


2-52. IPs are required for the Army CI portion of joint investigations. Investigative planning in joint 
investigations can be problematic. Other military and other government agencies (OGAs) do not have the 
same organizational culture or administrative requirements as Army CI. In some cases their planning 
process is more diffuse and approval levels are much lower. Early and frequent coordination is the key to 
avoiding misunderstandings and miscommunication. This is critical in joint investigations where Army CI 
is not the lead agency. 


2-53. IPs in joint investigations will be prepared in the normal format and provided to the supervisory 
agent for the lead agency for coordination and concurrence. In cases in which Army CI participates in a 
joint investigation with another agency, it will document the action with a written agreement between the 
parties. In either case it will be reflected in the IP forwarded to the ATCICA for approval with the name of 
the lead agency official and date of concurrence. Field agents should be aware that coordination and 
discussion may occur at multiple headquarters levels on their investigations. The joint IP is the foundation 
of common understanding regarding the investigation and is the basis for all coordination at higher levels. 


Subject Interview Plan 


2-54. Once the ACICA has directed or granted approval for a subject interview of a CI investigation, the 
CI element will develop a SIP. The purposes of the SIP are—to ensure the agent is familiar with all 
information obtained during the course of the investigation and clearly understands the goals of the subject 
interview; serves as a mechanism to identify and coordinate outside support as required; serves as approval 
to actually schedule and conduct the subject interview, and may serve as the vehicle for legal review of the 
subject interview proposal. 


2-55. It is not required including specific questions in the SIP; however, depending on the complexity of 
the issues to be discussed this can often be helpful. At a minimum, before conducting the interview the 
agent should develop a topical outline that can be used to ensure all subject interview objectives and 
requirements are met. If it is likely that a polygraph examination will follow the subject interview, the 
polygraph detachment should review the case file and suggest questions for inclusion in the SIP to ensure 
an effective polygraph. The ATCICA, or a CI supervisor with the delegated authority, will approve all SIP 
in writing, before their execution. The SIP will include the following: 


e Title. The subject block with the assigned Army case control number assigned by the ACICA 
in the investigation opening message. 


e Background. A synopsis of the incident under investigation. 


e Investigation objectives. Lists all the goals of the subject interview including— 


21 October 2009 FM 2-22.2 2-15 


FOR OFFICIAL USE ONLY 


Chapter 2 


= Obtaining information to confirm, mitigate, or refute, for example, the possibility the 
subject promised to provide, caused to be provided, and/or provided restricted U.S. 
defense information to unauthorized personnel in an unauthorized manner. 


= Identifying the subject’s affiliation with any other foreign entity; that subject deliberately 
compromised or willfully disclosed classified U.S. defense information. 


= Ascertaining that the subject engaged in any national security crime. Investigative 
objectives also include identifying FISS and ITO methods of operation and the extent of 
damage caused to national security. 


e Results of the investigation to date. A brief synopsis of all investigative activities and the 
corresponding results preceding the subject interview. 


e Purpose of the interview. Identification of all persons involved in the suspected allegations; 
the extent of compromise; all the details concerning the suspected allegations; assessment for 
potential exploitation. 


e Administrative information. Include all participants in the subject interview, date, location 
and whether or not the interview will be audio or video recorded. 


e Conduct of the interview. Include introductions, identification, rights warning or waiver and 
other administrative procedures, topical areas of the interview or, if required by the ATCICA, 
a line of questioning; closure of the interview including assessment on subject disposition 
(released, released to his chain of command or detention or apprehension by appropriate 
authorities). 


e Coordination required. Any type of external CI coordination required to support the 
interview including the SJA for legal advice on charges; MP for possible custody assumption; 
any joint participants (for example, Army CID or FBI). 


e Lead agent. Name, title, and contact information for the investigating agent conducting the 
interview. 
Requesting Special Investigative Techniques 


2-56. All requests for the below listed special investigative techniques will be submitted through the 
ATCICA to the ACICA for coordination and approval by the appropriate authority. AR 381-10 provides 
detailed guidance on the separate approval authorities for all special investigative techniques both in the 
United States and abroad. The IP may discuss the potential use of special investigative techniques, but will 
not be used as the vehicle to document, coordinate, and approve these techniques. 


Note. No special investigative techniques will be conducted unless coordinated by the ACICA 
and approved by the responsible authority. 


2-57. When considering the use of a special investigative technique to support a CI investigation, the least 
intrusive means of achieving the goals of the investigation must be the primary consideration. If a more 
intrusive special investigative technique is used other than one that would or could reasonably achieve the 
same investigative result, the legal integrity of the CI investigation may be subject to challenge or dismissal 
during potential criminal proceedings. The following special investigative techniques are used to support 
CI investigations: 


e Procedure 5—Electronic Surveillance. 
e Procedure 6—Concealed Monitoring. 
e Procedure 7—Physical Searches. 


èe Procedure 8—Mail Searches and Examination. 


2-16 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


e Procedure 9—Physical Surveillance. 


e Procedure 10—Undisclosed Participation. 


Staff Judge Advocate Coordination 


2-58. While the primary objective in all established CI investigations is exploitation, if the situation does 
not allow for Army CI to control the situation, then the threat has to be neutralized. In cases where 
prosecution is a possibility, CI investigative personnel should consult with the SJA throughout the 
investigation, after coordination with the ACICA and obtaining command approval. Continuous legal 
consultation during the investigation will support the prosecution’s case and provide insight to the 
investigating CI special agent regarding case direction. SJA can assist the CI investigative process by— 


e Providing legal advice for unique situations, such as offenses rarely charged or pursued. 
e Helping to clarify or resolve multiagency jurisdiction disputes and questions. 
e Assisting with identifying specific criminal offenses for individual cases. 


e Coordinating with the CI special agent to discuss interview legalities, rights warning waivers, 
and hostile interview courses of action (COAs). 


e Assisting with the legal coordination and approval for apprehension, detention, and search 
warrants with prior coordination and approval of the ACICA. 


e Preparing criminal proceedings. 
e Providing intelligence oversight review for proposed CI activities. 


e Providing advice and assistance in the preparation of proposals for special investigative 
techniques. 


2-59. All CI investigations will be conducted to a prosecutorial standard in accordance with applicable 
U.S. laws and DA and DOD regulations. CI investigations of national security crimes must produce 
findings which are accurate, concise, and legally sufficient for admission into a court of military or civil 
law. Investigations must be conducted in accordance with the principles of law and the rules of evidence 
which govern the prosecution of any criminal activity. AR 195-5 and FM 3-19.13 cover the legal aspects of 
gathering, handling, documenting, and controlling evidence. CI personnel must have a thorough 
understanding of the legal principles and procedures involved in conducting an investigation for three 
reasons: 


e To strictly apply them in all investigative activity. 


e To ensure prosecutorial integrity even during emergency circumstances that does not permit 
the opportunity to seek legal guidance before exercising investigative authority. 


e To provide the CI special agent an experience base to recognize those cases where specific 
guidance, assistance, and/or approval must be obtained before executing any further 
investigative activities. 


2-60. Basic legal principles will always apply to CI investigative situations. Legal principles are designed 
to ensure that the legal rights of subjects or suspects are observed. It is important to ensure that the potential 
ability to prosecute any given case is not jeopardized by illegal or improper CI investigative techniques. In 
addition, CI personnel involved in investigative activities must obtain advice and assistance from the SJA 
or legal officer to implement recent court decisions interpreting statutes and regulations. 


INVESTIGATIVE ACTIVITIES 


2-61. All investigations will vary in scope, objective, and resources to successfully resolve the incident 
under investigation. The IP is the primary planning tool to spur a logical thought process to identify all the 
various types of investigative activities that should be considered to conduct the investigation. Investigative 


21 October 2009 FM 2-22.2 2-17 


FOR OFFICIAL USE ONLY 


Cha 


2-18 


pter 2 


activities should be tailored to each investigation. Investigative activities should be sequenced to ensure a 
swift and successful completion of the investigation. The following are those general investigative 
activities that will be common to most CI investigations. 


e Files and records checks for pertinent information. 
e Individual interviews for additional information and leads. 


e Exploitation of new leads and consolidation of all available data for analysis and planning a 
COA. 


e Interview of the subject to prove or disprove the allegations. 


e Requests for assistance (RFAs) for CI support or investigative activities from other law 
enforcement, security, or intelligence agencies. 


2-62. Detailed planning is the key to preserving OPSEC and preventing the premature disclosure of the 
investigation. The OPSEC objective is to ensure that the subject not be aware that anything is going on 
until the subject interview; otherwise, the subject will likely change his patterns or habits that could disrupt 
the investigation and potentially destroy any evidence required for prosecution. 


2-63. While preparing the IP, the least intrusive method for obtaining information concerning the incident 
or subject should always be the primary consideration. The least intrusive method will be the one which 
allows the CI special agent to obtain the necessary information to prove or disprove the allegations against 
the subject, while obtaining the necessary probable cause needed to justify more intrusive collection 
techniques. IPs are progressive, and more intrusive investigative techniques may be required based upon 
the complexity and legal sufficiency needed to support the investigation and any follow-on legal 
proceedings. Investigative activities addressed in the IP should consider the following: 


e Sequence investigative activity from least to most visible. The closer the investigation gets to 
the subject the higher the risk to jeopardizing the legal credibility of the investigation. 


e Use less visible, less intrusive techniques to establish the subject’s social network and 
patterns. Detailed knowledge of how the subject lives day-to-day life is critical to OPSEC 
planning. 


e Carefully identify “best sources” for required information and approach the fewest people 
possible to develop critical information. There is always time to interview additional 
witnesses after subject becomes aware. 


e Be cognizant of how much information you are giving away as you collect evidence. Do not 
reveal specific accusations or details to witnesses. When conducting records checks, consider 
asking for information about the subject’s entire section or unit vice solely focusing on the 
subject. 


© Remember that your presence alone can reveal your interest. 


e Consider the use of ruses and cover stories. A survey can sometimes be used to develop 
general information about the subject’s workplace and work habits. 


e When making inquiries or conducting interviews the CI special agent should refrain from 
using threatening terms such as espionage or terrorism. For example, the CI special agent 
should address the investigation as an inquiry into an incident of CI interest, security matter, 
or violation. This will usually gain more cooperation from witnesses or persons with 
knowledge of the subject or incident being investigated. 


e Always have a backup plan if the subject discovers your investigative interest. Examples: 
What would change? Would simultaneous interviews of friends and co-workers now be 
appropriate? How about an early subject interview? Do you want to conduct searches before 
the subject can hide or destroy evidence? Is the subject likely to flee? Do you have enough 
evidence and do you know how to have the subject detained if necessary. 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


Media Inquiries 


2-64. Be prepared for inquiries by local, national, or foreign media. In some cases subjects themselves will 
contact local media in an effort to undermine an investigation. Under no circumstances will CI special 
agents respond to media inquiries without the consent and approval of the responsible ACICA. The 
standard response to such requests will be to refer the caller to INSCOM or other appropriate Public Affairs 
Office (PAO), followed by immediate telephonic notification to the ATCICA that a media request has been 
received. Any appropriate response to media requests will be developed and coordinated at the DA level. 
Each office should maintain the name and phone number of their current appropriate PAO and should 
ensure the local PAOs are also aware of this information. 


“BIGOT” Cases and Close Hold Investigative Activity 


2-65. In some instances, a case, due to its sensitivity or the sensitivity of the information involved, will 
require that it be handled on a strict need-to-know basis. These cases are often referred to as BIGOT cases 
because access to them is controlled by a BIGOT list. In this type of case, investigative actions are 
sometimes tasked directly to the field element by the ATCICA and all responses are returned directly to the 
ATCICA only. The ATCICA will notify the appropriate chain of command that a close-hold action has 
been initiated, identify the action element involved, and estimate the approximate degree of field element 
involvement. ATCICA will notify the chain of command upon completion of the close-hold action. 


Handling Sensitive Compartmented Information Material in Investigations 


2-66. All agents will keep their eyes open to the possible involvement of sensitive compartmented 
information (SCI) in their investigations. 


2-67. Indicators that this might become an issue, include— 
e Subject has a TS/SCI security clearance with SCI access. 
e Subject is assigned to an intelligence unit or holds an intelligence MOS. 
e Subject works in a sensitive compartmented information facility (SCIF). 
e Reportable incidents that occur in SCIFs. 


e The presence of unmarked information which deals with subject matter which has a high 
probability of being SCI (for example, SIGINT, HUMINT, cryptography). 


2-68. Upon determining the involvement or potential involvement of SCI information in an investigation, 
the lead agent will coordinate with the local Special Security Office (SSO) for appropriate storage of the 
SCI information. The lead agent will wrap and seal the SCI material being stored in the SSO against access 
by personnel without the need to know. 


2-69. Such protection will be afforded information until a final determination is made as to the 
classification of the information involved. If possible SCI material of investigative interest will be stored 
separately and in a security container accessible only by the CI special agents assigned to the case. A two- 
drawer safe, a drawer in a container where each drawer has a lock, or a “drop safe” are preferable. 


2-70. The lead agent will notify the responsible ATCICA immediately upon determining the actual or 
potential involvement of SCI material in an investigation. All review and handling of SCI material involved 
in a CI investigation will be conducted in a SCIF. The Defense Courier Service and approved facsimiles 
(faxes) between SSOs are the only two authorized methods of transmittal of SCI material. The lead agent 
will contact the local SSO for assistance. The ATCICA will provide the lead agent with final disposition 
instructions for all SCI material obtained during a CI investigation. These instructions will include the 
procedures for addressing SCI material within a ROI. 


21 October 2009 FM 2-22.2 2-19 


FOR OFFICIAL USE ONLY 


Chapter 2 


Special Access Program 


2-71. AR 380-381 governs the security of SAPs in the Army. A SAP is an approved security program 
imposing strict controls on individual access and dissemination of information. These controls are 
selectively applied to especially sensitive Army programs involving military research and development, 
activities, or operations. Agents will be familiar with the indicators of SAPs (for example, special handling 
instructions, special caveats, nicknames, and code words). 


2-72. The ATCICA will be notified by the most expeditious means available regarding the involvement of 
SAP information in an investigation. AR 380-381 requires that the possible compromise of SAP 
information be reported within 24 hours to the Technology Management Office (TMO), HQDA. Whenever 
investigating agents encounter potential SAP material during the course of their duties, the material will be 
brought under immediate control, inventoried, and handled as evidence. Exposure to the material and 
knowledge of its involvement will be strictly limited. 


SAP Read-On 


2-73. The ATCICA and lead agent will identify the requirements for SAP read-on (additional agents, 
technicians, and desk officers) to conduct an investigation involving SAP material. Unless otherwise 
indicated, no SAP case will be run without read-on for key management and oversight personnel. This may 
include, but is not limited to, all CI special agents participating in or conducting investigative activities to 
support the investigation, command personnel as required and ATCICA or ACICA providing direction and 
oversight for that particular CI investigation. SAP read-on will be conducted with the appropriate SAP 
control officer. 


Case Files 


2-74. Two case files will be maintained on SAP investigations. One will be kept at the collateral level and 
the other will contain the SAP material. When an IMFR or other documents must contain SAP information, 
a dual reporting system will be followed. The investigating agent will submit two reports: one containing 
the SAP information and one containing collateral, sanitized information. 


Reports of Investigations 


2-75. On termination of the investigation, two ROIs will be prepared. One ROI will contain all case 
documentation, including the code word material. It will be retired through the TMO or the Special 
Records Information Activity (SRIA). The second ROI will contain only the sanitized material. This will be 
submitted through normal channels for retirement in the IRR. The collateral report will be a one-for-one 
match to the SAP report, unless a specific document cannot be included. In the latter case, a statement will 
be provided, generically describing the document and the information contained therein. The collateral 
version will make reference to the SAP version and provide a location, point of contact (POC), and 
telephone number for anyone required to view the complete record. 


Security Procedures 


2-76. SAP security procedures will be strictly adhered to in the conduct of a SAP investigation. Storage, 
handling, transmission and accountability of SAP information, physical security requirements, and other 
SAP security procedures will apply. Normal secure communication means is usually acceptable, as long as 
only cleared personnel are involved in the process (for example, a fax). 


TERMINATION OR TRANSFER 


2-77. Terminated case files. Upon receipt of a message from the ATCICA terminating investigative 
activity, the CI investigating element will take the following actions: 


e If directed, an ROI will be completed and forwarded, along with all original signature 
investigative documentation and summary of information (SOT), to the responsible ATCICA. 


2-20 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


e Ensure original signature investigative documentation includes the original CI incident 
reports, IMFRs, original exhibits, and originals of other documents predicating the 
investigation. 


e Ensure supporting documentation is retained in the field dossier, including case logs, copies 
of the final correct CI incident report, ATCICA and ACICA message with operational interest 
determination, any tasking messages, copies of all IMFRs, documentation of any phone 
conversations between ATCICA and agent concerning the case, ACICA response 
memorandums, and copies of Summaries of Information. 


2-78. Open/Terminated (operational interest assumed). Forward all original signature investigative 
reporting to the ATCICA. Retain supporting documentation for a minimum of one year from operational 
interest determination date. Due to OPSEC sensitivities, caution should be exercised in retaining theses file 
past the one-year mark. In no instance should follow-on coordination or support to the exploiting unit be 
filed with the original report. 


2-79. Open/Terminated (transferred). Transferred CI cases occur when a CI investigation is initiated by 
one CI office (based upon ATCICA or ACICA approval) but a majority of the investigative activity will 
take place in another CI element’s AO. In these instances, copies of the CI incident report (DA Form 2823 
[Sworn Statement], and any ACICA correspondence transferring the case) will be maintained on file with 
the initiating CI element. All original documentation will be forwarded to the CI office designated as the 
lead investigating element by the ATCICA or ACICA. All transferred cases will be maintained on file until 
the case has been closed by the ATCICA or ACICA, the ATCICA or ACICA directs otherwise. 


2-80. Referred. When information is determined to be under the purview of another agency, the 
information will be retained only long enough to refer the information to that agency. Forward all original 
signature investigative documents to the ATCICA upon transfer decision. No information concerning a 
U.S. person in referred cases will be retained in the local intelligence files. Referred cases containing no 
information on a U.S. person may be retained for as long as deemed necessary to support CI operations, 
subject to annual intelligence oversight inspections. 


2-81. Terminated (pending ROI). Forward completed ROI (both hardcopy and softcopy) and all original 
signature documentation to ATCICA upon termination of investigative activity. Retain a complete copy of 
the ROI, all investigative reporting, and all supporting documents in the field dossier in suspense until 
notification of case closure (acceptance of ROI by IRR). 


2-82. Closed. The lead element will maintain the complete field dossier until the date of destruction 
designated by ATCICA in the case closure message. Under no circumstances will the field element destroy 
a case file before this date without prior written approval of the ATCICA. The lead element will label the 
field case file with the following: “DO NOT DESTROY PRIOR TO .” (Destruction date, 
normally one year from case closure for field dossiers, will be provided by ATCICA or ACICA in the case 
closure message.) The original field dossier may be retained past this date until no longer needed to support 
current operations not to exceed six years. Upon notification of a decision to prosecute or take adverse 
administrative action against the subject, place the field dossier back in suspense until action is resolved. 
Retention periods begin again upon notification completion of legal or administrative action. 


2-83. Case file destruction. ARIMS allows longer periods of retention of field files and offers the agent 
wider latitude in what to keep. Files must be reviewed annually in accordance with AR 381-10. To ensure 
no important or original signature paperwork is destroyed, CI investigative elements will contact their 
ATCICA before destroying any investigative documents or material. The ATCICA will assist in 
determining if destruction is the appropriate action. Most problems with file destruction arise when CI 
investigating elements fail to forward original signature documents, copies of SOIs, or exhibits with IMFRs 
before case file destruction. 


RECORDS CHECKS 


2-84. The examination of files and records for pertinent information on the subjects of the investigation is 
the first action in most CI investigations. Records checks are conducted to identify indicators or anomalies 


21 October 2009 FM 2-22.2 2-21 


FOR OFFICIAL USE ONLY 


Chapter 2 


to substantiate or refute allegations or indications that a person or persons may be engaging in acts that 
constitute treason, spying, espionage, and/or subversion. Indicators and anomalies are based upon historical 
commonalities of persons involved in national security crimes, incidents of CI interest, or fit a profile of 
someone who may be cooperating with a FISS and ITO. Records checks should begin with local unit files 
and expand including a broad range of U.S. and HN law enforcement records that consist of civilian 
agencies that maintain records concerning the subject’s personal background. 


2-85. There are occasions when documented information or evidence is best obtained through other 
investigative means. Some recorded data could be wrong, out of date, or simply misinterpreted due to 
human error; however, the possibility of intentional deception or false information in both official and 
unofficial records must always be considered. Not all information contained in official government or 
civilian files should be considered absolutely true and should be corroborated via other records analysis and 
investigative activities. 


2-86. If the record is to be used in a court or board proceeding, the manner in which it is collected, copied, 
extracted, or preserved will have a bearing on its use as evidence. Handling and storage for all information 
collected to support a CI investigation will adhere to the rules of evidence. 


2-87. There is a risk factor with records checks. Exposure of the subject’s name and the fact that he is 
under investigation may alert the subject. Due to the sensitivity of CI investigations, the subject’s name 
may be submitted in a list of persons to mask the true focus of the records check and investigation. The 
investigating agent should examine all records requested and appear to review all records equally so the 
true target of the examination is not exposed to observant records custodians or other bystanders. CI special 
agents using this method during the course of approved investigative activities should exercise extreme 
caution to not use or retain any data on U.S. persons that would be in violation of AR 381-10, chapters 2 
and 3. 


GAINING ACCESS 


2-22 


2-88. A variety of procedural methods are available to the CI special agent to obtain access to and copies 
of records of investigative interest. The type of information being requested, the privacy rights afforded that 
type of information, and the nature of the agency holding it drive the decision on which method is 
appropriate. In general, government records are easier to get. Records of commercial companies are more 
difficult to obtain, often require formal written requests, and may require authorization by a high-level 
Army official, especially where specific privacy rights have been established in the law (for example, 
telecommunications and financial records). Checks can be either consensual or nonconsensual. 
Nonconsensual checks of records that have been afforded specific privacy rights under USC are the most 
difficult to obtain. 


e Informal request. A verbal, or unofficial written request, by the CI special agent for access 
to records of interest. These requests are most often used for MACs and LACs where an 
existing liaison relationship exists and authority to access the records will not be questioned 
or can be established simply by the CI special agent’s official status and authority with badge 
and credentials and regulatory reference. 


e Access with consent. In cases where formal privacy rights have been afforded to a record, it 
can almost always be accessed with consent of the subject. Subjects may even be willing to 
give consent if they believe information in the record will refute, explain, or mitigate 
allegations against them. Usually this consent must be in writing and frequently, depending on 
the type of record, may require a specific form. This often occurs during the later stages of CI 
investigations, when the subject is already aware that he is under investigation. 


è Formal written requests. Most national agency checks (NACs) and checks of commercial 
company records are requested formally in writing. Formal requests may take a number of 
forms. For example: 


=" NACs are typically requested electronically or by memorandum, almost always through 
the ATCICA or ACICA. 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


= Nonconsensual checks of commercial company records are requested by formal 
memorandum. These memorandums certify that the agency presenting them has the 
authority under a specific section of the USC to obtain the records and has met the legal 
thresholds required to exercise their authority. These memorandums are strictly formatted 
and often require specific approval authorities and signatures depending on the language 
in the supporting section of the USC Authorities differ depending on the type and subject 
matter of the record and the matters being investigated (for example, foreign CI versus 
terrorism). 


= Other formal written requests are simple requests for voluntary cooperation from 
commercial companies. These are used for travel related and general businesses. While 
the companies involved do not have to grant access, they are not prohibited by law from 
doing so. 


è Warrants, subpoenas, and court orders. In some cases the only way to obtain access to a 
record is through a warrant or court order. This is the most formal method of obtaining access 
and is complex and time consuming. Warrants and court orders may be sought from military, 
federal, or the Foreign Intelligence Surveillance Court or a grand jury as appropriate. In joint 
investigations the Army will usually defer to the FBI to obtain a warrant or court order. 


e Access to records by MI investigators. AR 381-20, paragraph 8-15a, provides regulatory 
authority for access to Army records. Upon presentation of badge and credentials, CI special 
agents will be permitted access to Army records under the provisions of AR 340-21, 
paragraph 3-la, as required for the conduct of CI investigations or operations. Additionally, 
AR 210-10, paragraph 10-7, applies. They are also authorized to make extracts or transcripts 
of specific information obtained. Access to records of other Federal agencies is provided for 
in 5 USC 552a (b)(7). 


2-89. Checks are generally categorized by whether they are conducted with a government agency or a 
commercial entity. Government checks are further divided into MACs or civilian government agencies. A 
distinction is also made between LACs and NACs. Checks of commercial companies which hold records of 
investigative interest are often described by topical category (for example, financial institutions, 
telecommunications providers, travel-related services). More importantly, however, is whether the USC has 
afforded specific privacy rights to that type of record and what exceptions have been allowed for CI and CT 
purposes under the law. For example, the disclosure of both financial and telecommunications records are 
generally prohibited with specific exceptions. 


LOCAL AGENCY CHECK 


2-90. A LAC is a records or files check of official or publicly available information retained by any local 
office or government agency within the AO of the field element conducting the check. These records may 
include holdings and databases maintained by local and state LEAs, local courts, and local offices of 
federal agencies. Some examples include files and databases maintained by— 


e Local police departments. 

e State police. 

e Regional police and law enforcement networks. 

e JTFs (for example, joint terrorism task forces [JTTFs]). 
e State Department of Motor Vehicles. 

e Tax assessment offices. 

e Bureau of vital statistics (birth and death records). 

e Voter registration records. 


e Public utilities. 


21 October 2009 FM 2-22.2 2-23 


FOR OFFICIAL USE ONLY 


Chapter 2 


© Local courts. 
e Local offices of the U.S. Postal Service. 
e Local offices of federal agencies. 


e Schools and universities. 


MILITARY AGENCY CHECK 


2-91. A MAC is a records or files check conducted at any military agency within the AO of the field 
element conducting the check. In accordance with AR 340-21, the DA Privacy Program allows disclosure 
of records to officers and employees of DOD who have a need for the record in the performance of their 
duties. This authority applies to records on Army installations. Military service records of current and past 
members of the armed services of most nations are detailed and usually accurate. MACs include, but are 
not limited, to the following: 


e Personnel network. 

e Joint Personnel Security Adjudication System. 

e Unit and installation security manager. 

e Unit S-1 and resource management officer. 

e MP or PMO. 

e Post Vehicle Registration Office. 

e MP investigations. 

e MP customs. 

e Local and regional CID offices. 

e Local offices of other military service law enforcement or intelligence offices. 
e Military finance and personnel offices. 

e Military medical facilities. 

e Post Dishonored Check Office. 

e Post education center. 

e Civilian Personnel Office (employment and finance information). 
e Post locator. 

e Worldwide locator. 

e Defense Eligibility Enrollment System. 


e Defense Manpower Data Center. 


MEDICAL RECORDS CHECKS 


2-92. Medical record checks are considered a LAC or MAC depending on the status of the facility holding 
the record. For active duty military, the most readily available source for medical information is the 
servicing or local medical treatment facility. CI special agents should be aware that in-patient and 
psychological treatment records may be retained at the facility that provided treatment and may not always 
be fully reflected in outpatient records. For retired and separated Service members records may be located 
at the Army Personnel Center (ARPERCEN) records facility in St Louis, MO. Medical record checks 
should be done when one or more of the following exist: 


2-24 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


e A suicide investigation. (This is rare and would usually be conducted as part of the USACIDC 
investigation.) 


e Source states subject was directed for counseling for a problem which began to affect work 
habits. 


e Information obtained during the course of the investigation indicates subject has been or is 
being treated for a medical condition or drug or alcohol problem to stop self-destructive 
behavior that was affecting work and life. 


e Directed by ATCICA or ACICA. 


e In a CSPE investigation for medical indication as to why the subject could not pass the 
polygraph examination (for example, effect of prescription medications). 


2-93. CI special agents will not directly review medical records. The review will be done by the medical 
facility’s reviewing medical officer. Information in psychiatric evaluation files generally will not be made 
available to special agents, but a medical authority will review and discuss the contents in general. It is 
suggested that Army Intelligence brief the medical officer before the review on what type of information 
Army intelligence needs out of the records. This is considered a record check even though the medical 
officer is doing the record review. The following information of the reviewing medical officer should be 
noted in introductory paragraph: Name, rank, position, medical facility name, and address. 


2-94. If the subject is in possession of his medical record, discretely contact the commander of the medical 
facility and/or the subject’s commander to have the medical records returned to the medical facility for 
review. 


2-95. Should medical personnel refuse, attempt to determine if the file contains any type of information 
that would adversely affect the individual’s suitability for access to classified information. 


Note. In the above instance, the issue of suitability is related to the subject’s possible inability to 
properly handle classified information or his willingness to compromise it. 


CIVILIAN MEDICAL RECORDS 


2-96. To conduct a check of civilian medical records, a warrant, subpoena, or written release from the 
subject is required. Civilian medical records are considered privileged information and will not be released 
to investigators except as indicated above. 


2-97. Under no circumstances will previously executed personal records release forms (Defense Security 
Service [DSS] or OPM forms) from personnel security investigations be used in the conduct of CI 
investigations. 


2-98. Any agent who determines that civilian medical, financial, or educational checks are required during 
the course of an investigation will submit an updated IP to ATCICA outlining the reason for the check. 


2-99. If the records are deemed essential to the investigation, the ATCICA will assist in obtaining the 
required approvals or warrant. 


NATIONAL AGENCY CHECKS 


2-100. NACs are formal requests to federal agencies for searches of their records and supporting 
databases and files for information of investigative interest. NACs include DOD agencies as well as other 
federal agency holdings. NACs may be requested by the field element through the ATCICA. In accordance 
with local SOPs, the ATCICA will request NACs directly or through the ACICA and will submit and track 
all requests to other federal agencies at the headquarters level. Field elements will not attempt to initiate a 
NAC directly, with the exception of NCIC checks as outlined below. These types of requests add confusion 
to an already complicated process. Examples of national agencies that can be checked are listed below: 


21 October 2009 FM 2-22.2 2-25 


FOR OFFICIAL USE ONLY 


Chapter 2 


2-26 


DOD: 

=" Defense Central Index of Investigations. 
" DODIG. 

=" Defense Manpower Data Center. 


= Defense Industrial Security Clearance Office. 


= Directorate for Industrial Security Clearance Review. 


FBI: 

= Criminal records. 

= Intelligence records. 

= FBI fingerprint checks (requires a fingerprint card). 
Bureau of Alcohol, Tobacco, Firearms, and Explosives. 
Federal Prison System. 

Federal Aviation Administration, DOT. 

Social Security Administration. 

CIA. 

DHS: 

= Immigration and Customs Enforcement. 

=" Border and Transportation Security Agency. 

=" U.S. Coast Guard. 

U.S. Treasury Department: 

= Internal Revenue Service. 

=" USS. Secret Service. 

= Financial Crimes Enforcement Center (FINCEN). 
State Department: 

= Security Division. 

= Passport Division. 

=" Intelligence and Research Division. 

Military Departments: 

= Army. 

= Army Crime Records Depository (ACRD). 

=  USAIRR. 

= National Guard Bureau. 

= Air Force. 

= Navy. 

OPM. 


FM 2-22.2 


FOR OFFICIAL USE ONLY 


21 October 2009 


Counterintelligence Investigations 


NATIONAL CRIME INFORMATION CENTER 


2-101. While technically a NAC, in accordance with AR 381-20, all CI investigative elements will access 
and use NCIC terminals locally, wherever possible. On military installations NCIC access can usually be 
obtained at the local MP station, PMO, or installation security office. Access can also be arranged via 
liaison with local police departments, JTTFs, or other LEAs with NCIC access. 


PROCEDURES 


2-102. NACs are considered investigative actions and must be recorded by IMFR, regardless of the status 
of the investigation at the time the NAC results and/or investigative dossiers are received. Resulting IMFRs 
must be filed with the ROI. The IMFR for investigative dossiers will contain sufficient information in the 
introductory paragraph to identify the file for retrieval if necessary. The body of the report will contain 
sufficient detail to state the contents of the file, and not merely reflect that the file “contained no derogatory 
information,” “no information pertinent to this investigation,” or “no significant information.” NACs are 
conducted and investigative dossiers are reviewed for information that will— 


e Confirm or expand on information already known and/or reported. 
© Determine known or suspected FISS and ITO affiliation. 
e Attempt to identify someone. 


e Obtain background or lead data. 


COUNTERINTELLIGENCE INTERVIEWS 


2-103. As part of their investigation, CI special agents conduct interviews. Each situation dictates the type 
of interview the CI special agent use when interviewing a subject: 


e Noncustodial interview. 

e Custodial interview. 

e Walk-in interview. 

© Source or witness interview. 


e Subject interview. 


NONCUSTODIAL INTERVIEW 


2-104. Noncustodial interviews are conducted when subjects are interviewed without depriving them of 
their freedom in any significant manner (for example, arrest or detention). Subjects voluntarily consent to 
an interview and are advised that they may depart at any time. Exercise caution during these interviews so 
as not to impart suggestions of confinement or restraint, either through the type of room used (for example, 
bars on windows, locked doors), statements of the interviewing agent, or by the number of agents 
participating in the interview. 


CUSTODIAL INTERVIEW 


2-105. Custodial interviews are conducted when subjects are interviewed following a formal arrest or 
detention. Subjects are made fully aware of their deprivation of freedom or of their “in custody” status. 


WALK-IN INTERVIEW 


2-106. Interviewees are regarded as walk-in sources when they have knowledge of a national security 
crime or incident within the purview of Army CI, and they report their knowledge to the local Army CI 
office. The walk-in interview may provide information that results in a CI incident report. 


21 October 2009 FM 2-22.2 2-27 


FOR OFFICIAL USE ONLY 


Chapter 2 


SOURCE OR WITNESS INTERVIEW 


2-107. Interviewees who may have knowledge of a national security crime or incident of CI interest are 
considered sources. Interviewees who may have actually witnessed a reported national security crime or 
incident of CI interest are considered witnesses. Persons providing access to records or any other type of 
documentation to support the investigation are also considered as sources. Depending on the attitude or 
association of the source or witness to the subjects, a source or witness can be cooperative, uncooperative, 
or even hostile. 


SUBJECT INTERVIEW 


2-108. The person who has committed or allegedly committed a national security crime or incident of CI 
interest is the subject. During CI investigations there can be one or multiple subjects. Due to the legal 
complexities involved in CI investigations and the potential for criminal proceedings, thorough preparation 
and consultation with the ATCICA, ACICA, and SJA should always be a priority to ensure all legal 
considerations and individual rights are observed and the prosecutorial integrity of the investigation is 
maintained. 


INTERVIEW PREPARATION 


2-109. Interviewing persons knowledgeable of, witnesses to, or involved in, alleged national security 
crimes or incidents within Army CI purview is the basis of all CI investigations. Interviews can 
successfully resolve suspected allegations when conducted meticulously and with all legal requirements or 
can jeopardize the ability to neutralize or exploit threats to national security. Thorough preparation for 
interviews is critical to establishing the CI special agent’s authority and professional credibility to 
interviewees. While walk-in interviews cannot be planned, the CI special agent’s knowledge of procedures, 
laws, policies, and investigative techniques will help during a walk-in interview. 


SOURCE OR SUBJECT ASSESSMENT 


2-110. After the initial walk-in, the investigating CI special agent will begin preparing for follow-on 
source and potential subject interviews. Agents must anticipate and mentally prepare for the interviews that 
may range from cooperative to hostile. Most walk-in interviews are cooperative since the interviewee is 
volunteering the information. However, source interviews may be cooperative or hostile depending on the 
attitude of the interviewee or relationship between the source and subject. 


2-111. If interviewees are resentful of people in authoritative positions or have a close relationship with 
the subject, they may be uncooperative and hostile during the interview. The investigating CI special agent 
should be firm, but professional, and establish authority. Subjects in subject interviews are often 
uncooperative or hostile. People confronted with allegations of criminal activities are naturally defensive 
and confrontational. Senior-ranking subjects may be resentful of an interviewer or accuser whom they 
perceive is junior to them in age or rank. The investigating CI special agent should anticipate hostile 
reactions during subject interviews; however, these reactions should not impact professionalism or 
tactfulness during the interview. The CI special agent’s professionalism, knowledge, and interpersonal 
skills are instrumental to manage the interview—1induce interviewee cooperation and exploit interviewee’s 
knowledge. 


TELEPHONIC CONTACT WITH SOURCE OR SUBJECT 


2-112. When making telephonic contact with a source or subject to arrange to coordinate an interview, the 
investigating agent has to balance security of the investigation while providing the minimum amount of 
information to induce cooperation. The CI special agent should conduct telephonic contacts as follows: 


e Identification. Identify themselves and ask for the prospective source or subject’s rank (if 
military) and name. 


2-28 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


Source or subject identification. Verify that they are talking to the prospective source or 
subject. 


Reason for contact. Explain they are investigating or conducting an inquiry into a security 
matter and that they would like to arrange to speak with the interviewee. Using verbiage like 
“matter of national security,” CI special agent,” or “CI investigation” may spook the 
prospective source or subject. The CI special agent will never provide details of a CI 
investigation over the phone. 


Obtain agreement. The prospective source or subject may believe he does not have any 
knowledge of an incident or security-related matter. The CI special agent needs to stress the 
importance of the interviewee’s cooperation and that the prospective source or subject would 
be assisting the special agent in resolving a sensitive security matter. 


Establish interview. Establish the date, time, and location of the interview and ensure the 
prospective source or subject has directions to the interview. Ensure the prospective source or 
subject understands that the interview may last one to two hours. If the prospective source or 
subject is hesitant about being away from his place of employment for that long, offer other 
alternatives such as during lunch or before or after duty hours. 


Provide security warning. Advise the prospective source or subject of the official nature of 
the interview and that they are not to disclose their cooperation with anyone, including their 
supervisor. If they are adamant that their supervisor or chain of command should know, the 
special agent should obtain contact data for those persons and coordinate with the ATCICA 
for these contacts. 


Provide re-contact information. Provide official cellular or telephone numbers should the 
prospective source or subject need to contact the CI special agent before the interview. 


Summarize. Reiterate security warning, date, time, and location of the interview and thank 
the prospective interviewee for his time. 


INVESTIGATIVE AIDS 


2-113. CI investigative interviews are complex and time consuming. Regardless of the level of 
experience, investigating CI special agents should never go into an interview thinking they will be able to 
remember all the different protocols, legal warnings, and documentation required to complete an interview 
and still be able to effectively exploit all the information a source or subject may know. 


2-114. Investigative aids assist in the exploitation of information. Investigative aids include Known and 
Unknown Person, Location, and Vehicle Identification sheets. CI special agents may also develop 


investigative 


aids for actions and objects (documents, electronic media) as these may likely be a part of a 


CI incident. Aids allow for full identification of persons involved in the incident that assist with future 


investigative 


activities, including records checks, and help in completing all documentation required during 


the investigation. 


21 October 2009 


Known person identification: 
= Name. 

= Rank and title. 

= Component. 

= Social security number. 
= Date and place of birth. 
= Duty position. 


=" Duty location. 


FM 2-22.2 2-29 


FOR OFFICIAL USE ONLY 


Chapter 2 


2-30 


Unit of assignment. 

Residence. 

Permanent change of station date. 

Temporary duty date. 

Expiration of term of service (ETS) date. 
Security clearance. 

Level of daily access to classified information. 


Special access—SCI only. 


Unknown person identification: 


Sex—nmale, female. 

Race—Caucasian, Black, Asian, Other. 

Skin color—dark, tan, white. 

Skin complexion—smooth, pock-marked. 
Age—within a 5-year range. 

Height—within a 2-inch range. 

Weight—within a 10-pound range. 

Build and posture—small, medium, and stooped. 
Hair—black, brown, grey, blond, red, bald. 
Eyes—brown, black, blue, grey, green. 
Dress—headwear, upper- to lower-body wear, foot wear, jewelry (top to bottom). 


Distinguishing characteristics—physical handicap, tattoos, body piercing, 
birthmarks, moles. 


Location identification: 


Room number and name. 
Floor number. 

Building number and name. 
Street address (intersection). 
Nearby landmarks. 
Surrounding area description. 
Installation. 

City. 

State. 

Country. 

ZIP code. 


scars, 


FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


e Vehicle identification: 
= Make. 
=" Model. 
= Year—can use time span. 
=" Color. 
= License plate number. 
= License plate state. 
= Distinguishing characteristics—stickers, damage, other. 
= U.S. military installation decals—include associated color labels denoting, civilian, 
enlisted, officer. 
INTERVIEW AGENDA 


2-115. An interview agenda is another type of investigative aid that allows investigating CI special agents 
to decide how they want the flow of the interview to go. Interview agendas allow investigating CI special 
agents to manage the interview and serve as a road map to key them on the completion of mandatory 
documentation and security warnings required during the interview process. 


2-116. Interviews are conducted based upon the experience level of the investigating CI special agent and 
how he likes to transition between different topical areas. For example, some investigating CI special 
agents like to complete all administrative documentation (for example, Privacy Act of 1974, Secrecy 
Affirmation) at the beginning of the interview, complete information exploitation, and follow up with 
executing the Sworn Statement and final security warning. Other investigating CI special agents may prefer 
to conduct all the information exploitation, get source data, cover all administrative documentation, and 
then execute the Sworn Statement and issue the security warning. 


2-117. When using interview agendas, the investigating agent should always keep it concealed or out of 
sight. If a source recognizes the agent is relying on this document to complete the interview, it may 
undermine the credibility and professionalism of the investigating agent, and may result in the source being 
more cautious, confrontational or uncooperative. The amount of detail the agenda contains is left to the 
discretion and amount of experience of the investigating CI special agent. The following is an example of 
an interview agenda: 


e ID source. 

e Present badge and credentials. 

e Synopsis of the information. 

è Detailed account of the incident by the source. 
e Use of Interrogatives. 

è Privacy Act of 1974. 

e Secrecy Affirmation. 

e Sworn Statement. 


e Security Warning. 


21 October 2009 FM 2-22.2 2-31 


FOR OFFICIAL USE ONLY 


Chapter 2 


INTERVIEW ROOM SETUP 


2-118. It is important to determine what physical setting or environment will be most conducive to 
gaining the trust and confidence of the source and will produce the most truthful and meaningful 
information. Interviews can be and frequently are conducted in a myriad of settings, locations, and 
environments. It is completely acceptable to conduct an interview at a source’s place of work, home, or 
other location where he may feel more comfortable. Comfort sometimes allows a subject to talk more 
openly and freely, which can greatly benefit the investigative process. 


2-119. A subject interview needs to be strictly planned and controlled. A subject interview should rarely, 
if ever, be conducted in an area where the subject works, socializes, or feels secure. The location selected 
for a subject interview should provide complete privacy (free from distraction or disruption). Interview 
rooms should not be equipped with phones, outside windows, wall ornamentation, and so forth. In addition 
to these requirements, the room should be strategically arranged to ensure the most practical and conducive 
environment. If the room is equipped with a two-way mirror, the subject should not face directly toward it. 
This serves as a constant reminder that someone may be monitoring the interview. 


2-120. Interview rooms should be equipped with a desk and at least three chairs if using an assisting agent 
or four chairs if an interpreter is used. The interviewing CI special agent should be located directly across 
from the interviewee. If an assisting agent is used for note taking or witnessing, they should be located to 
the side of the interviewing CI special agent, far enough away so they are not in direct line of sight of the 
interview. 


2-121. When possible, the interview chair should be a four-legged chair with no arm rests. This removes 
any potential psychological barriers or defense mechanisms and allows for easier recognition of body 
posture and physiological indicators of deception during the interview. Additionally, investigating CI 
special agents should use a hydraulic-type chair to manipulate their level above the interviewee to establish 
a psychological dominance and position of authority. If using an interpreter, they should be placed to the 
side and slightly behind the interviewee to ensure that their focus is directed towards the investigating CI 
special agent. If the room is equipped with video recording equipment, it should be mounted in a corner 
with visibility on the interviewee’s face, yet still out of direct eyesight so that it is not a distracter. 
Figure 2-3 shows an example of a room setup. 


RECORDING INTERVIEWS 


2-122. As a general rule, Army CI does not record interviews. Taping interviews requires prior written 
approval of the responsible ATCICA. The ATCICA will coordinate this action with the unit intelligence 
oversight officer and SJA. A careful risk or gain assessment must be done to ensure the benefits expected 
by taping the interview outweigh potential risks to the investigation. There is a significant logistical and 
administrative burden involved with such activities. 


2-123. Additionally, when the intent of an investigation is to prove a criminal act, a written report 
accompanied by an incriminating signed sworn statement is sufficient. No value is added by including a 
recorded confession. More often than not, the recording becomes a target for the defense to accuse 
wrongdoing on behalf of the investigating agency or prosecution. Interviews and debriefings of subject as 
part of a plea bargain or after the trial is complete for the purpose of conducting damage assessment are 
common. Taping interviews should be considered when— 


e Interviews are conducted in foreign languages. 
e An interpreter is used. 
e Interviews are lengthy. 


e Interview topics are technical or extremely complicated in nature. 


2-32 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


Information Exploitation 


2-124. At the beginning of an interview, the investigating agent will have the interviewee provide a 
detailed explanation of the incident starting with the earliest relevant date and time concerning the incident. 
The investigating CI special agent will not interrupt and will take very few notes. This helps the 
interviewee refresh his memories and mentally recount the incident. After this initial dialogue, the 
investigating agent will have the interviewee go back to the beginning of the incident and slowly have him 
or her recount the details while the investigating agent takes detailed notes. 


2-125. The interview should flow sequentially to develop a logical time line of what happened. As the 
interviewee provides details concerning the incident and reveals other information, the special agent should 
make a note and follow-up with a separate line of questioning of that lead or string after the current topic 
has been fully exploited. 


Two-Way Mirror 


Interpreter 


Interviewee 


Assistant 


Figure 2-3. Example of an interview room setup 


21 October 2009 FM 2-22.2 2-33 


FOR OFFICIAL USE ONLY 


Chapter 2 


2-126. When asked for specific dates, times, and locations, the interviewee may not be able to provide 
exact information. In this case the investigating CI special agent needs to identify the details as precisely as 
possible. If the interviewee cannot remember a specific date, the agent needs to gradually broaden time 
spans to a day of the week, week, month, or time of year, or even season, to get the most precise 
information available. 


Note Taking 


2-127. Accurate, detailed, legible, and properly sequenced notes are critical in articulating the information 
obtained during all interviews. During the interview, as information is developed, if the interviewee 
provides another lead or string that requires exploitation, make a note in the margin, fully develop the 
current topic, and go back and exploit the lead or string provided earlier. This helps maintain the tempo of 
the interview, limits interviewee confusion by disrupting a sequence of events, and makes it easier to 
transcribe the notes into a report or sworn statement. If the interviewee is providing details about a specific 
event and mentions a name, for example, “John”, do not interrupt to request John’s personal identifying 
information. Make a note. After exhausting the current topic, go back and follow-up with questions 
concerning John. 


Backup Information 


2-128. Part of the interview preparation is to have prepared copies of all administrative and legal 
documentation that may be required in a particular interview. These include copies of the Privacy Act of 
1974, DA Form 2823 (Sworn Statement), DA Form 3881 (Rights Warning Procedure/Waiver Certificate), 
and Consent to Release Forms and Secrecy Affirmations. The investigating agent should have blank copies 
of all these documents available as well as ones that have all areas that require signatures and/or initials 
highlighted to ensure they are properly documented during the interview. Copies of the DA 3881 should 
also be available during walk-in and source or witness interviews since there may be times when these 
interviewees, although cooperative, may implicate themselves in a criminal offense. During subject 
interviews, investigating CI special agents should also have a copy of all charges (Title 18, USC, and 
UCMJ) available to explain why their suspected actions are viewed as criminal offenses. 


Questioning Techniques 


2-129. How an investigating CI special agent asks questions in an interview is also important. Good 
questioning techniques limit confusion of the interviewee; maintain the tempo and control of the interview; 
and save time by limiting repetitive clarifying questions. 


2-130. Direct questioning using the basic interrogatives who, what, when, where, why, and how” is the 
most efficient way to exploit information in most interviews. Investigating CI special agents will never use 
compound or leading questions. The investigating agent should avoid asking questions like these: 


e WRONG. Can you spell John’s name? This creates two questions and two answers. The 
initial question and the answer, which will usually be Yes or No, and the follow-up question, 
spell John’s name. 


è RIGHT. Spell John’s name. 
e WRONG. You saw John take the classified document home, right? 


è RIGHT. Who took the classified document home; or did you see John take the classified 
document home? 


e WRONG. Was John in the office and who was with him? 
e RIGHT. Was John in the office? (After the answer, ask the follow-up: Who was with him?) 


2-131. Elicitation is the use of generalized questions to ascertain someone’s knowledge on a particular 
topic. In some cases of source or witness interviews where it is unknown whether the interviewee has 
knowledge concerning the incident, it may be necessary to begin elicitation to ascertain his knowledge of 


2-34 FM 2-22.2 21 October 2009 


FOR OFFICIAL USE ONLY 


Counterintelligence Investigations 


the incident. If the interviewee has no information concerning an incident under investigation, then the 
investigating CI special agent will not have given away any circumstances surrounding the incident that 
could be compromised later on. 


2-132. To elicit an interviewee’s knowledge, the interviewing agent may simply ask, “do you know of any 
security incident that may have happened in a specific timeframe?” or “where were you on this date and did 
you notice anything suspicious?” Once the interviewee has acknowledged knowing about the incident in 
question, the investigating agent may then begin asking direct questions. 


INDICATORS OF DECEPTION 


2-133. Detection of deception is not a simple process, and it normally takes years of experience before a 
CI special agent can readily identify deliberate deceit. Inconsistencies in the source’s actions or words do 
not necessarily indicate a lie, just as consistency is not necessarily a guarantee of the truth. However, a 
pattern of inconsistencies or unexplainable inconsistencies normally indicate deceit. 


Internal Inconsistencies 


2-134. Frequently when an interviewee is lying, the investigating CI special agent will be able to identify 
inconsistencies in the time line, the circumstances surrounding key events, or other areas within the 
questioning. For example, the interviewee may spend a long time explaining something that took a short 
time to happen, or a short time telling of an event that took a relatively long time to happen. These internal 
inconsistencies often indicate deception. 


2-135. Body language does not match verbal message. An extreme example of this would be the 
interviewee relating a harrowing experience while sitting back in a relaxed position. The investigating CI 
special agent must be careful in using this clue since body language is culturally dependent. Failing to 
make eye contact in the
…[truncated]