Military reference books and manuals (2009-2023, Volume 4)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Botnet. A collection of zombie PCs [personal computers]. Botnet is short for robot network. A botnet can

consist of tens or even hundreds of thousands of zombie computers. A single PC in a botnet can

automatically send thousands of spam messages per day. The most common spam messages come

from zombie computers. (McAfee Labs - Threat Glossary) Also see zombie.

-- Also, Botnets, or Bot Networks, are made up of vast numbers of compromised computers that have

been infected with malicious code, and can be remotely-controlled through commands sent via the

Internet. (CRS Report PL32114, 29 Jan 2008)

-- Also, A network of “zombie” computers controlled by a single actor. Botnets are a common tool for

malicious activity on the Internet, such as denial-of-service attacks and spam, since they provide free

9stolen) computation and network resources while hiding the identity of the controller. (Cybersecurity and

Cyberwar)

Botnets have been described as the

“Swiss Army knives of the underground economy”

because they are so versatile.

Brevity Code. [In intelligence usage] Communications security (COMSEC) term for a code used only for

shortening the length of a message, but not to conceal its content. (Cited as FBI Glossary in CIA’s

Insider’s Dictionary by Leo D. Carl)

[Note: although the brevity code does not conceal content (the actual

words used), it can be used to conceal true meaning]

-- Also, [non intelligence usage] a code which provides no security but which has as its sole purpose

the shortening of messages rather than the concealment of their content. (JP 1-02; JP 3-04; and

FM 1-02.1, Multi-Service Brevity Codes, Jun 2005)

Brief Encounter. A short and discreet operational contact. (HDI Lexicon, April 2008) Also see brush

contact; brush pass.

-- Also, any brief physical contact between a case officer and an agent under threat of surveillance.

(CI Centre Glossary)

Brush Contact. A discreet momentary contact, usually prearranged between intelligence personnel,

during which material or oral information is passed. (ICS Glossary & AFOSI Manual 71-142, OFCO,

9 Jun 2000) Also see brush pass; brief encounter.

Such a contact is extremely brief as well as surreptitious,

and usually it is quite secure if well executed.

-- Victor Marchetti & John D. Marks,

The CIA and the Cult of Intelligence, 2^nd edition (1980), p 230

-- Also, a discreet, usually prearranged momentary contact between intelligence personnel when

information or documents are passed. Also known as a brief encounter. (FBI FCI Terms)

-- Also, a technique used by case officers to receive [or] exchange information from an agent

clandestinely without betraying any signs of recognition between participants. The objective is to

complete the transaction without detection by any hostile surveillance. (Historical Dictionary of Cold

War Counterintelligence, 2007)

Brush Contact - credited largely to Haviland Smith, who served as the CIA station chief in Prague

from 1958 to 1960. See Benjamin Weiser, A Secret Life: The Polish Officer, His Covert Mission,

and the Price He Paid to Save His Country (2004)

“He found that if he walked along a street and turned right, he created a gap in which the

agents [surveillance] trailing him would lose sight of him for a few seconds…. Do not

elude surveillance, accept it as a way of life.”

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Brush Pass. A brief operational encounter (seconds or less) in which the case officer passes something

(verbally or physically) to or receives something from the agent, or a two-way exchange takes place.

(National HUMINT Glossary) Also see brief encounter; brush contact.

-- Also, a discreet, monetary contact during which something is exchanged. (HDI Lexicon, April 2008)

-- Also, a brief encounter where something is passed between a case officer and an agent. (CI Centre

Glossary)

-- Also, the clandestine, hand-to-hand delivery of items or payments - made as one person walks

past another in a public place [The Russian Foreign Intelligence Service (SVR) refers to a brush pass

as a “flash meeting”]. (FBI - Court Affidavit re: Russian Illegals, 25 June 2010)

Bug. [Tradecraft jargon] 1) Concealed listening device or other equipment used in audio surveillance;

2) To install such a device; the term “bugged” refers to a room or object that contains a concealed

listening device. (Spy Book)

-- Also, a concealed listening device or microphone, or other audiosurveillance device; also to install

the means for audiosurveillance of a subject or target. (Senate Report 94-755, Book I - Glossary, 26 Apr

1976)

Bugging… Electronic Surveillance

Bugging is a term in common use that refers to the various forms of clandestine electronic

surveillance, or eavesdropping. See Spycraft, pp. 405-416, for details.

______________________

Bug -- a covert or clandestine listening or viewing device that is noted for its small, inconspicuous

(bug-like) size. Bugs used to primarily mean primarily listening devices, small microphones that

could be hidden in plants or phone handsets, but the term now is also used to describe tiny pinhole

cameras that are as small as audio bugs used to be twenty years ago. A bug may be wired or

wireless and may or may not be sending information a recording device.

-- Julie K. Petersen, Understanding Surveillance Technologies: Spy Devices, Their Origins &

Applications (2001)

______________________

[The FBI’s] Engineering Research Facility at Quantico… makes custom-designed bugging devices,

tracking devices, sensors, and surveillance cameras to watch and record bad guys. It also

develops ways to penetrate computers and defeat locks, surveillance Cameras, and alarm and

access control systems.

…state-of-the-art FBI bug… a circuit board that is the size of a postage stamp and the thickness of

two stacked quarters “It’s a transmitter and stereo recorder… it records for about twenty-one hours,

and will transmit to a local receiver in encrypted form…. This is actually big in comparison to some

of our bugs.”

-- Ronald Kessler, The Secrets of the FBI (2011), pp 8-9 and 227-228

Bugged. Room or object that contains a concealed listening device. (JP 1-02)

Burned. [Tradecraft jargon] When a case officer or agent is compromised, or a surveillant has been

made by a target, usually because they make eye contact. (CI Centre Glossary)

Burn Notice. Within DoD: None - term removed from JP 1-02 per JP 2-0 Joint Intelligence (22 Oct 2013).

Previously defined in JP 1-02 as: an official statement by one intelligence agency to other

agencies, domestic or foreign, that an individual or group is unreliable for any of a variety of

reasons.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

C ==========================================

Campaign. A series of related military operations aimed at achieving strategic or operational objectives

within a given time and space. (JP 1-02 and JP 5-0, Joint Operation Planning, 11 Aug 2011) Also see

DoD Strategic CI Campaign.

Campaign Plan. A joint operation plan for a series of related military operations aimed at achieving

strategic or operational objectives within a given time and space. (JP 1-02 and JP 5-0, Joint Operation

Planning, 11 Aug 2011) Also see Campaign; Campaign Planning; DoD Strategic CI Campaign.

Campaign Planning. The process whereby combatant commanders and subordinate joint force

commanders translate national or theater strategy into operational concepts through the development of

an operation plan for a campaign. (JP 1-02 and JP 5-0, Joint Operation Planning, 11 Aug 2011) Also see

campaign; campaign plan.

Capability. The ability to execute a specified course of action. (A capability may or may not be

accompanied by an intention.) (JP 1-02)

Capability Gap. The inability to achieve a desired effect under specified standards and conditions

through combinations of means and ways to perform a set of tasks. The gap may be the result of no

existing capability or lack of proficiency or sufficiency in existing capability.

Captured or Detained Personnel. Any person captured, detained, held, or otherwise under the control of

DoD personnel (military or civilian). This does not include DoD personnel or DoD contractor personnel

being held for law enforcement purposes. (DoDD 3115.09, DoD Intelligence Interrogations, Detainee

Debriefings, and Tactical Questioning, 11 Oct 2012 w/ chg 1 dated 15 Nov 2013)

Car Pick-Up. A personal meeting wherein the handler picks up the source. (HDI Lexicon, April 2008)

Car Toss. A form of dead drop using a concealment device thrown to a preselected site from a vehicle

traveling along a designated route. (HDI Lexicon, April 2008) Also see brief encounter; brush contact,

brush pass.

-- Also, the method of conveying information clandestinely by throwing a package into, or out of,

a vehicle is known as the “car toss.” (Historical Dictionary of Cold War Counterintelligence, 2007)

[P]ull just far enough ahead of [surveillance] so that when he turned a curve…. or disappeared over

a small hill, he was able to create ten- to twenty-second gaps during which he could throw a soda

can or bottle out the window and in to a ditch by the road. In such “car tosses”, beepers might be

placed inside the object along with a message, so that the agent with a small radio could find it

easily.

-- Benjamin Weiser, A Secret Life (2004) pb, p.79

Carbons. Paper that produces secret writing [SW] through the use of chemicals. (FBI FCI Terms and Spy

Book) Also see secret writing.

-- Also, paper invisibly impregnated with chemicals which, when used in accordance with directions,

will produce secret writing. Illegals and agents often posses carbons which appear as ordinary sheets in

writing pads that are manufactured in the target country. (AFOSI Manual 71-142, OFCO, 9 June 2000)

Carve-Out. A provision approved by the Secretary or Deputy Secretary of Defense that relieves DSS

[Defense Security Service} of its National Industrial Security Program obligation to perform industrial

security oversight functions for a DoD SAP [Special Access Program]. (DoDD 5205.07, SAP Policy,

1 Jul 2010)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, a classified contract for which the Defense Security Service (DSS) has been relieved of

inspection responsibility in whole or in part. (DSS Glossary)

CARVER. A special operations forces acronym used throughout the targeting and mission planning cycle

to assess mission validity and requirements. The acronym stands for criticality, accessibility,

recuperability, vulnerability, effect, and recognizability. (JP 1-02 and JP 3-05.1, Joint Special Operations

Task Force Operations, 26 Apr 2007)

Case. The framework which not only acts as the repository for all logically/physically related facts, issues,

allegations and products (outputs) associated with the investigative process, but also serves to document,

in a case file, the approvals, authorities, waivers, plans, notes and other artifacts relevant to that particular

instance of the process. (ONCIX Insider Threat Detection - Glossary)

-- Also, an intelligence operation in its entirety; the term also refers to a record of the development of an

intelligence operation, how it will operate, and the objectives of the operation. (Senate Report 94-755, Book I

- Glossary, 26 Apr 1976)

Can also be used as a verb, to case, meaning to surreptitiously observe a physical location to

determine its suitability for possible future operational use.

Previously defined in DoD (JP 1-02) as: 1) An intelligence operation in its entirety; or 2) Record of

the development of an intelligence operation, including personnel, modus operandi, and objectives.

Approved for removal per JP 2-0 Joint Intelligence (22 Oct 2013).

Case Officer (C/O). A professional employee of an intelligence or counterintelligence organization who is

responsible for providing directions for an agent operation and/or handling intelligence assets. (JP 1-02;

JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011; CI Community

Lexicon; and ICS Glossary) Also see Agent Handler.

-- Also, [an intelligence employee] who is responsible for managing and directing agents (assets) in

the field. Case officers are sometimes referred to as “operations officers.” (Encyclopedia of the CIA, 2003)

“…the case officer’s job is to handle operational cases and assets; this is to say the case officer

recruits and directs foreign indigenous spies who are known as “agents.”

-- Fred Rustmann, Jr., “Debunking the CIA Case Officer Myth,” AFIO Newsletter; 25: 1&2 (2002)

Casing. Reconnaissance of an operating area, whether for surveillance or for personal or impersonal

communications. (CI Community Lexicon)

-- Also, a study of a site to determine operational suitability. (HDI Lexicon, April 2008)

-- Also, covert or clandestine inspection or surveillance of an area, place, or building to determine its

suitability for operational use or its vulnerability to an intelligence operation. (AFOSI Instruction 71-101,

6 Jun 2000 and AFOSI Manual 71-142, OFCO, 9 Jun 2000)

Catastrophic Event. Any natural or man-made incident, including terrorism, which results in extraordinary

levels of mass casualties, damage, or disruption severely affecting the population, infrastructure,

environment, economy, national morale, and/or government functions. (JP 1-02 and JP 3-28, Defense

Support of Civil Authorities, 31 Jul 2013) Also see complex catastrophe.

Caveat. A designator used with or without a security classification to further limit the dissemination of

restricted information, e.g., FOUO and NOFORN. (IC Standard 700-1, 4 Apr 2008)

-- Also, a designator used with a classification to further limit the dissemination of restricted

information. (JP 1-02 and JP 3-07.4, Joint Counterdrug Operations, 13 Jun 2007)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cell.

[In intelligence usage,] a small group of individuals who work together for clandestine or subversive

purposes.

CELLEX. See cellular telephone exploitation.

Cellular Telephone Exploitation (CELLEX). Exploitation of cellular phones at the logical or physical level

to extract cogent contextual information, includes holistic examinations of mobile devices and associated

digital media (e.g., SIM cards, media cards).

Center [British spelling: Centre]. The headquarters site in the home country where control of intelligence

and espionage operations in foreign countries is maintained. (AFOSI Manual 71-142, OFCO, 9 Jun 2000)

-- Also, intelligence service headquarters. (FBI FCI Terms)

Center of Gravity (COG). The source of power that provides moral or physical strength, freedom of action,

or will to act. (JP 1-02 and JP 5-0, Joint Operation Planning, 11 Aug 2011)

Central Intelligence Agency (CIA). An independent US Government agency responsible for providing

national security intelligence to senior US policymakers. Primary mission: collect, analyze, evaluate, and

disseminate foreign intelligence to assist the President and senior US government policymakers in

making decisions relating to national security. Major components: National Clandestine Service (NCS),

Directorate of Intelligence, Directorate of Science & Technology and Directorate of Support. (cia.gov)

Also see National Clandestine Service.

We do espionage. That is the nature of what we do. We steal secrets.

-- DCI George Tenet, 23 June 1998

Interview in Studies in Intelligence, 42:1 (1998)

Director CIA is designated the Functional Manager for human intelligence IAW EO 12333; and is

also the National HUMINT Manager IAW ICD 304, Human Intelligence.

Director CIA coordinates the clandestine collection of foreign intelligence through human sources

or through human-enabled means and counterintelligence activities outside the United States (EO

12333).

The CIA may engage in covert action at the President’s direction and in accordance with applicable

law; see covert action.

_____________________

The Director CIA serves as the head of the Central Intelligence Agency and reports to the Director

of National Intelligence. The CIA director's responsibilities include:

-- Collecting intelligence through human sources and by other appropriate means, except that he

shall have no police, subpoena, or law enforcement powers or internal security functions;

-- Correlating and evaluating intelligence related to the national security and providing appropriate

dissemination of such intelligence;

-- Providing overall direction for and coordination of the collection of national intelligence outside

the United States through human sources by elements of the Intelligence Community authorized

to undertake such collection and, in coordination with other departments, agencies, or elements

of the United States Government which are authorized to undertake such collection, ensuring

that the most effective use is made of resources and that appropriate account is taken of the

risks to the United States and those involved in such collection; and

-- Performing such other functions and duties related to intelligence affecting the national security

as the President or the Director of National Intelligence may direct.

The function of the Central Intelligence Agency is to assist the Director of the Central Intelligence

Agency in carrying out the responsibilities outlined above.

Source: https://www.cia.gov/about-cia/index.html (accessed 20 Aug 2012)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

CFIUS. See Committee of Foreign Investment in the United States.

Chain of Custody. A chronological written record reflecting the release and receipt of evidence from initial

acquisition until final disposition. (AR 195-5, Evidence Procedures, 25 Jun 2007) Also see evidence;

chain of evidence.

-- Also, a process that tracks the movement of evidence through its collection, safeguarding, and

analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected

or transferred, and the purpose for the transfer. (CNSSI No. 4009, National Information Assurance

Glossary, 26 April 2010)

-- Also, a process used to maintain and document the chronological history of the evidence.

(Documents should include name or initials of the individual collecting the evidence, each person or entity

subsequently having custody of it, dates the items were collected or transferred, agency and case

number, victim’s or suspect’s name, and a brief description of the item.) (Crime Scene Investigation: A

Guide for Law Enforcement, Sep 2013)

Chain of Custody is a process used to document the chronological history of evidence to maintain

the security, integrity and accountability of its handling.

Chain of Evidence. A process and record that shows who obtained the evidence; where and when the

evidence was obtained; who secured the evidence; and who had control or possession of the evidence.

The “sequencing” of the chain of evidence follows this order: collection and identification; analysis;

storage; preservation; presentation in court; return to owner. (CNSSI No. 4009, National Information

Assurance Glossary, 26 April 2010) Also see evidence; chain of custody

Chairman’s Guidance (CG). Provides a common set of assumptions, priorities, intent, and critical

planning factors required to develop future strategies and plans. It is an integral part of the strategy

development process. CG may be established pursuant to conducting a Joint Strategy Review, to

preparing a Joint Vision, or to Drafting a new National Military Strategy; or it may be provided separately

if deemed appropriate. (CJCSI 3100.01A, Joint Strategic Planning System, 1 Sep 1999)

Chancery. The building upon a diplomatic or consular compound which houses the offices of the chief

of mission or principal officer. (JP 1-02)

Characterization.

[In critical infrastructure protection usage] the analytic decomposition of functions,

systems, assets, and dependencies related to supporting DoD operational capabilities and assets. DoDD

3020.40, ( DoD Policy and Responsibilities for Critical Infrastructure, 14 Jan 2010, w/ chg 2 dated 21 Sep

2012)

Chief of Mission (CoM). The principal officer in charge of U.S. Diplomatic Missions and U.S. offices

abroad, which the Secretary of State has designated as diplomatic in nature. The CoM reports to the

President through the Secretary of State. Also see Ambassador.

-- Also, the principal officer (the ambassador) in charge of a diplomatic facility of the United States,

including any individual assigned to be temporarily in charge of such a facility. The CoM is the personal

representative of the President to the country of accreditation and is responsible for the direction,

coordination, and supervision of all US Government executive branch employees in that country (except

those under the command of a US area military commander). The security of the diplomatic post is the

CoM's direct responsibility. (JP 1-02 and JP 3-08, Interorganizational Coordination During Joint

Operations, 24 Jun 2011)

The U.S. Ambassador to a foreign country, for example, is the Chief of the U.S. Mission (CoM) in

that country. Other CoMs include the Chiefs of permanent U.S. Missions to international

organizations (e.g., the U.S. Mission to International Organizations in Vienna), the Principal Officers

of Consulates General, and the U.S. Interest Section in the Swiss Embassy in Havana.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

The CoM has full responsibility and authority for the direction, coordination, and supervision of all

USG executive branch employees in country and at international organizations, regardless of their

employment categories or location, except those under command of a U.S. area military

commander or on the staff of an international organization.

Chief of Station (CoS). The senior United States intelligence officer in a foreign country, and is the direct

representative of the Director National Intelligence, to whom the officer reports through the Director

Central Intelligence Agency. Usually the senior representative of the Central Intelligence Agency

assigned to a US Mission. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg

1 dated 26 Aug 2011)

Choke Point. A narrow passage--such as a bridge, tunnel, or Metro station--used as a surveillance or

countersurveillance tool for channeling the opposing force or monitoring their passage. (CI Centre

Glossary)

CHROME. Acronym for Counterintelligence and Human Intelligence Requirements-Reporting and

Operations Management Environment. Interoperable, synchronized information technology architecture

to replace and retire legacy software systems to accelerate workflow, increase efficiency, and broaden

intelligence sharing within DoD and across the IC. (DoD FCIP Strategy FY 2013-2017)

Church Committee (aka the United States Senate Select Committee to Study Governmental Operations

with Respect to Intelligence Activities). A U.S. Senate committee chaired by Senator Frank Church (D-ID)

in 1975. A precursor to the U.S. Senate Select Committee on Intelligence (SSCI), the committee

investigated intelligence gathering by the CIA, FBI, and NSA after certain activities had been revealed by

the Watergate affair. (Wikipedia at <http://en.wikipedia.org/wiki/Church_Committee>)

In 1975 and 1976, the Church Committee published fourteen reports on the formation of U.S.

intelligence agencies, their operations, and the alleged abuses of law and of power that they had

committed, together with recommendations for reform, some of which were put in place. Under

recommendations and pressure by this committee, President Gerald Ford issued Executive Order

11905 (ultimately replaced in 1981 by President Reagan's Executive Order 12333).

Regarding counterintelligence see Book I Foreign and Military Intelligence, pp. 163-178

Copies of the Church Committee reports at the following two web sites:

<http://www.intelligence.senate.gov/churchcommittee.html>

<http://www.aarclibrary.org/publib/contents/church/contents_church_reports.htm>

CI. See counterintelligence.

CI-21. Counterintelligence for the 21st Century. (See White House Fact Sheet, “The PDD on CI-21:

Counterintelligence for the 21st Century” - copy at <http://www.fas.org/irp/offdocs/pdd/pdd-75.htm>)

Designed to provide a national counterintelligence system which is predictive and proactive, one

that includes integrated oversight of national CI activities across government and the private sector.

Established: 1) the National CI Policy Board of Directors (Dir FBI, Dep SECDEF, DDCI, and DoJ

Representative); 2) the National CI Executive (NCIX); and the Office of the National CI Executive.

________________________

“The general premise behind CI-21 is to try and determine what are America’s true equities, and

then extend this interagency cooperation in a systematic way to try and better protect those assets

and deter acts of espionage that target them. We can no longer afford to focus our

counterintelligence efforts only after an incident has sparked a full criminal case, because at that

point it’s too late. The damage has already been done.”

-- DCI George Tenet quoted in “Anti-Terror Alliance,” Government Executive Magazine, 1 Feb 2001

________________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

“CI-21 is a manifestation of a process… we all began to realize that the threats to U.S. security

were changing in a way that our traditional organizations and structures couldn’t match…

Globalization and technology were lowering traditional boundaries between what constitutes an

international or domestic threat, and terrorists, drug cartels, spies and hackers were all leaping

those boundaries with impunity.”

-- John MacGaffin, Former ADDO, CIA and Former FBI Consultant who spearhead CI-21

CI Campaign. See DoD Counterintelligence Campaign.

CI Mission Tasking Authority. See Counterintelligence Mission Tasking Authority.

Cipher. Any cryptographic system in which arbitrary symbols (or groups of symbols) represent units of

plain text of regular length, usually single letters; units of plain text are rearranged; or both, in accordance

with certain predetermined rules. (JP 1-02) Also see code; cipher pad.

Cipher Pad. A small thin pad of paper sheets having nonrepetitive key, usually machine printed. A sheet

is used once for enciphering and another sheet used once for deciphering a communication. Occasionally

called a one-time pad (OTP). (AFOSI Manual 71-142, OFCO, 9 Jun 2000)

CISO Acronym for Counterintelligence Staff Officer. Within DoD, term rescinded.

Note: within DoD this term replaced by “Command CI Coordinating Authority” or CCICA.

CIR. Acronym for Counterintelligence Incident Report.

Civil Authorities. Those elected and appointed officers and employees who constitute the government of

the United States, the governments of the 50 states, the District of Columbia, the Commonwealth of

Puerto Rico, United States territories, and political subdivisions thereof.

(JP 1-02 and JP 3-28, Defense Support of Civil Authorities, 31 Jul 2013)

Civil Aviation Intelligence. Activities undertaken to understand how trends in the global civil aviation

industry impact U.S. interests; or detect, analyze, monitor, and warn of illicit activity or threats to the

United States, its allies, or its interests involving civil aviation. (DoDI 3115.14, Civil Aviation Intelligence,

29 Jul 2011)

Civil Disturbance. Within DoD: None -- term removed from JP 1-02.

Previous defined in JP 3-28, Civil Support (14 Sep 2007) as: Group acts of violence and disorder

prejudicial to public law and order.

Civilian Internee. A civilian who is interned during armed conflict, occupation, or other military operation

for security reasons, for protection, or because he or she committed an offense against the detaining

power. (JP 3-63, Detainee Operations, 30 May 2008)

Clandestine. Any activity or operation sponsored or conducted by governmental departments or agencies

with the intent to assure secrecy or concealment. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint

Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011) See clandestine collection; clandestine

intelligence; clandestine intelligence activity; clandestine intelligence collection clandestine operation;

covert.

-- Also, any HUMINT [Human Intelligence] or other activity or operation sponsored or conducted by

governmental departments or agencies with the intent to assure secrecy or concealment. (ICD 304,

HUMINT, 1 Mar 2007 and DoDD S-5200.37, Management & Execution of Defense HUMINT, 9 Feb 2009)

-- Also, any illicit/illegal activity that is designed not to be detected by anyone, including a local

security service. Concealed, hidden, secret, or surreptitious operation conducted without the knowledge

of anyone but the organization conducting the operation or investigation. (CI Community Lexicon)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, method of conducting operations with secrecy by design. Differs from covert in that covert

conceals the identity of the sponsor, whereas clandestine conceals the identity of the operation. (National

HUMINT Glossary)

-- Also, secret or hidden activity conducted with secrecy by design. (ICS Glossary, 1978)

Clandestine, from the Latin clam, ''secretly, in private.''

Words have meaning… clandestine and covert are not synonymous

_______________________

“I don't take lightly the distinction between clandestine and covert…

It makes all the difference in the world.”

Senator Jay Rockefeller, Senate Select Committee on Intelligence

Clandestine Collection. The acquisition of protected intelligence information in a way designed to protect

the source, and conceal the operation, identity of operators and sources, and actual methodologies

employed. (Previously in DoDI S-5240.17, CI collection, 12 Jan 2009) Also see clandestine intelligence;

clandestine intelligence collection.

Clandestine Intelligence. Intelligence information collected by clandestine sources. (Senate Report

94-755, Book I - Glossary, 26 Apr 1976)

Clandestine Intelligence Activity. An activity conducted by or on behalf of a foreign power for intelligence

purposes or for the purpose of affecting political or governmental processes if the activity is conducted in

a manner designed to conceal from the U.S. Government the nature or fact of such activity or the role of

such foreign power; also, any activity conducted in support of such activity. (AR 381-12, Threat

Awareness and Reporting Program, 4 Oct 2010)

Clandestine Intelligence Collection. The acquisition of protected intelligence information in a way

designed to conceal the nature of the operation and protect the source. (JP 1-02 and JP 2-01.2, CI &

HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

-- Also, the acquisition of protected intelligence information in a way designed to protect the source.

(National HUMINT Glossary)

Clandestine Operation. An operation sponsored or conducted by governmental departments or agencies

in such a way as to assure secrecy or concealment. A clandestine operation differs from a covert

operation in that emphasis is placed on concealment of the operation rather than on concealment of the

identity of the sponsor. In special operations, an activity may be both covert and clandestine and may

focus equally on operational considerations and intelligence-related activities. (JP 1-02 and JP 3-05.1,

Joint Special Operations Task Force Operations, 26 Apr 2007)

-- Also, activities to accomplish intelligence, CI, or similar activities in such a way as to maintain

secrecy or concealment especially for the purpose of deception or subversion. (CI Community Lexicon)

-- Also, a pre-planned secret intelligence information collection activity, technical operation, or covert

political, economic, propaganda, or paramilitary action conducted so as to assure the secrecy of the

operation; encompasses clandestine collection, counterintelligence, and covert action. (National HUMINT

Glossary)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, any HUMINT or other activity or operation sponsored or conducted by governmental

departments or agencies with the intent to assure secrecy or concealment. (DHE-M 3301.002, Vol II,

Collection Operations, 23 Nov 2010)

Clandestine operations are sometimes incorrectly referred to as “covert operations.” Although both

are secret and sensitive activities, the terms are not interchangeable. See covert operation.

Clandestine Nuclear Threat. A nuclear or radiological attack by anyone for any purpose, against the

United States and/or U.S. military operations, and delivered by means other than (military) missiles or

aircraft. A large subset of this threat is the smuggling of nuclear weapons, devices, or materials for use

against the United States. (DSB Report, Jun 2004)

Today, it would be easy for adversaries to introduce and

detonate a nuclear explosive clandestinely in the United States.

-- Defense Science Board Report (June 2004)*

*Copy of “Report of the Defense Science Board Task Force Report on Preventing and Defending Against

Clandestine Nuclear Attack,” June 2004 available at: <http://www.acq.osd.mil/dsb/reports/ADA429042.pdf>

Clandestine Service. See National Clandestine Service (NCS); Defense Clandestine Service (DCS).

Classification. The determination that official information requires, in the interests of national security, a

specific degree of protection against unauthorized disclosure, coupled with a designation signifying that

such a determination has been made. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar

2011 w/ chg 1 dated 26 Aug 2011)

Classification—Driving Security

The classification system is designed primarily to protect the confidentiality of certain military,

foreign policy, and intelligence information. It deals only with a small slice of the government’

information that requires protection although it drives the government’s security apparatus and

most of its costs.

-- Joint Security Commission, Redefining Security: A Report to the Secretary of Defense and the Director

Central Intelligence, 28 Feb 1994, pp.7

Classified Information. Official information that has been determined to require, in the interests of

national security, protection against unauthorized disclosure and which has been so designated.

(JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

-- Also, information or material designated and clearly represented, pursuant to the provisions of a

statute or Executive order (or a regulation or order issued pursuant to a statue or Executive order), as

requiring a specific degree of protection against unauthorized disclosure for reasons of national security.

(50 USC § 426[1])

Classified Information Procedures Act (CIPA). The tool with which the proper protection of classified

information may be ensured in indicted cases. After a criminal indictment becomes public, the prosecutor

remains responsible for taking reasonable precautions against the unauthorized disclosure of classified

information during the case. This responsibility applies both when the government intends to use

classified information in its case-in-chief as well as when the defendant seeks to use classified

information in his/her defense. (18 USC, App III, Sec 1-16) Also see graymail.

Congress enacted CIPA (Public Law 96-456) in 1980. The procedural protections of CIPA protect

unnecessary disclosure of classified information. The primary purpose was to limit the practice of

“graymail” by criminal defendants in possession of sensitive government secrets.

"Gray mail" refers to the threat by a criminal defendant to disclose classified information during the

course of a trial. The gray mailing defendant essentially presented the government with a

"Hobson's choice": either allow disclosure of the classified information or dismiss the indictment.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

CIPA is a procedural statute that balances the right of a criminal defendant with the right of the

sovereign to know in advance of a potential threat from a criminal prosecution to its national

security. CIPA's provisions are designed to prevent unnecessary or inadvertent disclosures of

classified information and to advise the government of the national security "cost" of going forward.

See: <http://www.usdoj.gov/usao/eousa/foia_reading_room/usam/title9/crm02054.htm>

Classified Military Information (CMI). Information requiring protection in the interest of national security

and is limited to three classifications: TOP SECRET, SECRET and CONFIDENTIAL as described in

Executive Order 13526, Classified National Security Information (previously EO 12958 13526) and which

is under the control or jurisdiction of the DoD or its Departments or Agencies.

Basic USG policy provided in National Security Decision Memorandum (NSDM) 119 “Disclosure of

Classified United States Military Information to Foreign Governments and International

Organizations”: CMI is a national security asset which must be conserved and protected and which

must be shared with foreign governments and international organizations only where there is a

clearly defined advantage to the U.S.

Copy of NSDM 119 at: <http://www.nixonlibrary.gov/virtuallibrary/documents/nsdm/nsdm_119.pdf>

Classified National Intelligence (CNI). National intelligence as defined in 50 USC 401a(5), classified

pursuant to EO 13526. (ICD 703, Protection of Classified National Intelligence Including Sensitive

Compartmented Information, 21 Jun 2013) Also see Sensitive Compartmented Information.

Protection of CNI, including SCI, is also achieved through adherence to counterintelligence (CI)

and security practices.

-- ICD 703, Protection of Classified National Intelligence, including Sensitive Compartmented Information,

21 Jun 2013, p. 2

Clean. [Tradecraft jargon] To be free of hostile surveillance. (A Spy’s Journey)

Clean Phone. Tradecraft jargon which typically refers to a disposable, pre-paid cellular telephone

that cannot be traced back to the original retail purchaser or subsequent user(s).

Clearance. Formal security determination by an authorized adjudicative office that an individual is

authorized access, on a need to know basis, to a specific level of collateral classified information (TOP

SECRET, SECRET, CONFIDENTIAL). (CNSSI No. 4009, National Information Assurance Glossary,

26 April 2010)

Cleared Contractor (CC). A person or facility operating under the National Industrial Security Program

(NISP), that has had an administrative determination that they are eligible, from a security point of view,

for access to classified information of a certain level (and all lower levels). There are approximately 8500

cleared contractors with over 13,000 facilities. (DSS - Glossary to Insider Threat Awareness Course)

The Defense Security Service (DSS) refers to “cleared contractors” as they support DoD as well as

other U.S. Government Departments and Agencies. DSS oversees the protection of U.S. and

foreign classified information and technologies in the hands of industry under the National Industrial

Security Program (NISP). "The NISP applies to all Executive Branch Departments and Agencies

and to all cleared contractor facilities located within the United States" (para 1-102, NISPOM).

Cleared Defense Contractor (CDC). A company or academic institution (i.e., university or college) that

has entered into a security agreement with the DoD, and was granted a facility (security) clearance

enabling the entity to be eligible for access to classified information of a certain category, as well as all

lower categories. (DoDI O-5240.24, CI Activities Supporting RDA, 8 Jun 2011 with change 1 dated 15 Oct

2013)

-- Also, a subset of contractors cleared under the NISP who have contracts with the Department of

Defense. Therefore, not all cleared contractors have contracts with DoD. (DSS - Glossary to Insider

Threat Awareness Course)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Click-jacking. Concealing hyperlinks beneath legitimate clickable content which, when clicked, causes

a user to unknowingly perform actions, such as downloading malware, or sending your ID to a site.

Numerous click-jacking scams have employed “Like” and “Share” buttons on social networking sites.

(FBI; see <http://www.fbi.gov/about-us/investigate/counterintelligence/internet-social-networking-risks >)

Coalition. An arrangement between two or more nations for common action. (JP 1-02 and JP 5-0, Joint

Operation Planning, 11 Aug 2011) Also see alliance; multinational.

Coast Guard Counterintelligence Service (CGCIS). Component of Coast Guard Intelligence that provides

full-spectrum counterintelligence support to the U.S. Coast Guard. Office symbol: CG-2-CI.

CGCIS preserves the operational integrity of the Coast Guard by shielding its operations,

personnel, systems, facilities and information from Foreign Intelligence and Security Services

(FISS), and the intelligence efforts of terrorist organizations, drug trafficking elements and other

organized crime groups, and adversaries, and insider threats. CGCIS supports the identification,

understanding, neutralization, and exploitation of the operations of FISS and of non-state actors

who employ intelligence tradecraft. CGCIS manages the Foreign Visitor Program, providing tailored

foreign intelligence threat and awareness briefings specific to foreigners visiting Coast Guard

commands. CGCIS also conducts foreign travel briefs and debriefs, providing tailored foreign

intelligence threat and awareness briefings on FISS, terrorism, and criminal threats, and health

concerns to educate Coast Guard personnel traveling to high-threat countries.

-- Coast Guard Publication 2-0, Intelligence, May 2010

Code. 1) Any system of communication in which arbitrary groups of symbols represent units of plain text

of varying length. Codes may be used for brevity or for security; 2) a cryptosystem in which the

cryptographic equivalents (usually called "code groups"), typically consisting of letters or digits (or both) in

otherwise meaningless combinations, are substituted for plain text elements which are primarily words,

phrases, or sentences. (Previously in JP 1-02) Also see cipher.

-- Also, system of communication in which arbitrary groups of letters, numbers, or symbols represent

units of plain text of varying length. (CNSSI No. 4009, National Information Assurance Glossary, 26 April

2010)

-- Also, a system of communication in which arbitrary groups of symbols represent units of plain text.

Codes may be used for brevity or for security. (Senate Report 94-755, Book I - Glossary, 26 Apr 1976)

“There is no sharp theoretical line between codes and ciphers; [a] useful distinction is that code

operates on linguistic entities, dividing its raw material into meaningful elements and cipher does

not.”

-- David Kahn, The Code Breakers (1967)

Code Book. Document containing plain text and code equivalents in a systematic arrangement, or a

technique of machine encryption using a word substitution technique. (CNSSI No. 4009, National

Information Assurance Glossary, 26 April 2010)

Code Word. A single word assigned a classified meaning by appropriate authority to ensure proper

security concerning intentions and to safeguard information pertaining to actual, real-world military plans,

activities or operations classified CONFIDENTIAL or higher. (DoDI 5205.11, Management, Administration,

and Oversight of DoD Special Access Programs, 6 Feb 2013)

-- Also, a single classified word assigned to represent a specific SAP or portions thereof. (DoD

5220.22.22-M-Sup 1, NISPOM Supplement, Feb 1995)

-- Also, 1) A word that has been assigned a classification and a classified meaning to safeguard

intentions and information regarding a classified plan or operation; and 2) A cryptonym used to identify

sensitive intelligence data. (JP 1-02 and JP 3-50, Personnel Recovery, 20 Dec 2011)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, a prearranged word used in communication or conversation to disguise the identity of

someone or something or to convey a meaning other than its conventional meaning. (AFOSI Manual

71-142, 9 Jun 2000) Also see nickname.

Cold Pitch. Recruitment approach without prior development or, in some cases, contact. (National

HUMINT Glossary)

The confrontational “cold pitch” was one of the riskiest methods, putting great psychological

pressure on a target, and often failed. Even when successful, it often produced agents whose

handlers had to maintain constant pressure on them to stay involved. When such agents had a

chance to cut their ties—when they were assigned to new posts or when communications with their

contacts became risky—they often took it.

-- Victor Cherkashin, KGB Counterintelligence Officer and author of Spy Handler (2005)

_________________________________

Nobody likes cold pitches because they’re the worst technique in the profession of intelligence. It’s

going up to somebody whom you don’t know and asking them to do the equivalent of going to bed

with you. It’s a very intimate, and if you’re not developing it from a practical interrelationship human

kind of way, 99.9 percent of the folks will say no.

-- Michael T. Rochford, Chief, Espionage Section, Counterintelligence Division, FBI

as quoted in The Secrets of the FBI (2011) by Ronald Kessler, p. 125

Cold War. Term generally used to describe the long-term, but nonshooting, conflict or state of tension

between the United States and the Soviet Union that lasted from the close of World War II in 1945 until

the collapse of the Soviet Union in 1991. (Encyclopedia of the CIA, 2003)

COLISEUM. See Community On-Line Intelligence System for End-Users and Managers.

Collaborating Analytical Center (CAC). An intelligence organization that has responsibility to support and

assist a Responsible Analytical Center (RAC) produce an intelligence product to answer a specific

COCOM Intelligence Task List (ITL) task or sub-task. CACs may provide all-source analysis, application

of analysis, or single-source analysis, exploitation, or reporting. DoD organizations that may serve as

CACs include: Combat Support Agencies (DIA, NSA, NGA), the COCOM JIOCs, and the Service

Intelligence Centers (NGIC, ONI, NASIC & MCIA). (CJCSM 3314.01, Intelligence Planning, 28 Feb 2007)

Collateral. All national security information classified Confidential, Secret, or Top Secret under the

provisions of an Executive Order for which special systems of compartmentation (such as SCI or SAPs)

are not formally required. (DoDI 5200.01, 9 Oct 2008)

Collation. The organizing of relevant information in a coherent way, looking at source and context. It

includes evaluating the information for accuracy, completeness, and meaning. (Robert M. Clark,

Intelligence Analysis: A Target-Centric Approach, 2004)

Collection. In intelligence usage, the acquisition of information and the provision of this information to

processing elements. (JP 1-02 and JP 2-01, Joint and National Intelligence Support to Military

Operations, 5 Jan 2012) Also see counterintelligence collection; clandestine intelligence collection;

intelligence collection; military counterintelligence collection.

-- Also, the acquisition of information to meet an intelligence requirement. (ICD 300, 3 Oct 2006)

ICD 300 (Management, Integration, and Oversight of Intelligence Collection and Cover Action, 3

Oct 2006) establishes DNI policy to integrate, prioritize, and maximize IC collection capabilities and

activities to produce timely and useful national intelligence information for policymakers, Defense,

and other intelligence consumers.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, the identification, location, and recording and storing of information— typically from an original

source and using both human and technological means—for input into the Intelligence Cycle for the

purpose of meeting a defined tactical or strategic intelligence goal. (ODNI, U.S. National Intelligence - An

Overview 2011)

-- Also, the exploitation of sources by collection agencies, and the delivery of the information obtained

to the appropriate processing unit for use in the production of intelligence. (National HUMINT Glossary)

-- Also, the acquisition of information by any means and its delivery to the proper intelligence

processing unit for use in the production of intelligence. (Senate Report 94-755, Book I, 26 Apr 1976)

“Collection is the gathering of valued information, much of it by clandestine means.”

-- Roy Godson, Dirty Tricks or Trump Card: US Covert Action and Counterintelligence (1995), p.1

“The collection of information is the foundation of everything that the Intelligence Community does.

While successful collection cannot ensure a good analytical product, the failure to collect… turns

analysis into guesswork.”

-- WMD Report (2005); p. 351

EO 12333, US Intelligence Activities, directs that IC elements use the least intrusive collection

techniques feasible within the United States or directed against US persons abroad (para 2.4 -

Collection Techniques).

Collection Agency. Any individual, organization, or unit that has access to sources of information and the

capability of collecting information from them. (JP 1-02 and JP 2-01, Joint and National Intelligence

Support to Military Operations, 5 Jan 2012)

Collection Asset. A collection system, platform, or capability that is supporting, assigned, or attached to a

particular commander. (JP 1-02 and JP 2-01, Joint and National Intelligence Support to Military

Operations, 5 Jan 2012)

Collection Emphasis. Identifies new short- to intermediate-term information needs in response to

unforeseen situations, emerging crises, or contingencies. It can be used to register additional or refined

requirements in connection with a unique collection opportunity. (DoD CI Collection Integrated Working

Group Handbook 1-02, 8 Aug 2006)

Collection Management (CM). In intelligence usage, the process of converting intelligence requirements

into collection requirements, establishing priorities, tasking or coordinating with appropriate collection

sources or agencies, monitoring results, and re-tasking, as required. (JP 1-02 and JP 2-0, Joint

Intelligence, 22 Oct 2013)

CM has two distinct functions: collection requirements management (CRM) and collection

operations management (COM). CRM established the collection need and COM provides the “how

to” for conducting the actual collection. See collection requirements management and collection

operations management.

“The matters that interest an intelligence service are so numerous and diverse that some order

must be established in the process of collecting information.”

-- Allen W. Dulles, The Craft of Intelligence (2006), p.75

Collection Management Authority (CMA). Within DoD, CMA constitutes the authority to establish,

prioritize, and validate theater collection requirements, establish sensor tasking guidance, and develop

theater-wide collection policies. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011

w/ chg 1 dated 26 Aug 2011)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Collection Manager. An individual with responsibility for the timely and efficient tasking of organic

collection resources and the development of requirements for theater and national assets that could

satisfy specific information needs in support of the mission. (JP 1-02 and JP 2-01, Joint and National

Intelligence Support to Military Operations, 5 Jan 2012)

Collection Operations Management (COM). The authoritative direction, scheduling, and control of

specific collection operations and associated processing, exploitation, and reporting resources. (JP 1-02

and JP 2-0, Joint Intelligence, 22 Oct 2013) Also see collection management; collection requirements

management.

COM is the process by which it is determined “how” a requirement will be answered within an

intelligence discipline and “who” will execute the collection activity.

_________________

“Essentially, CRM is what gets done in the collection cycle, while COM is how it gets done.”

-- ODNI, U.S. National Intelligence - An Overview 2011

Collection Plan. A systematic scheme to optimize the employment of all available collection

capabilities and associated processing, exploitation, and dissemination resources to satisfy specific

information requirements. (JP 2-0, Joint Intelligence, 22 Oct 2013)

The collection plan determines how a collection requirement will be satisfied.

Collection Planning. A continuous process that coordinates and integrates the efforts of all collection

units and agencies. (JP 1-02 and JP 2-0, Joint Intelligence, 22 Oct 2013)

Collection Posture. The current status of collection assets and resources to satisfy identified information

requirements. (JP 2-0, Joint Intelligence, 22 Oct 2013)

Collection Requirement. A valid need to close a specific gap in intelligence holdings in direct response to

a request for information (JP 2-0, Joint Intelligence, 22 Oct 2013) Also see intelligence requirement;

information requirements.

-- Also, 1) An intelligence need considered in the allocation of intelligence resources. Within the

Department of Defense, these collection requirements fulfill the essential elements of information and

other intelligence needs of a commander, or an agency; or 2) An established intelligence need, validated

against the appropriate allocation of intelligence resources (as a requirement) to fulfill the essential

elements of information and other intelligence needs of an intelligence consumer. (JP 2-01.2, CI &

HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

Collection Requirements Management (CRM). The authoritative development and control of collection,

processing, exploitation, and/or reporting requirements that normally result in either the direct tasking of

assets over which the collection manager has authority, or the generation of tasking requests to collection

management authorities at a higher, lower, or lateral echelon to accomplish the collection mission.

(JP 1-02 and JP 2-0, Joint Intelligence, 22 Oct 2013) Also see collection management; collection

operations management.

CRM is the process by which it is determined “what” will be collected and by “which” intelligence

discipline. CRM defines “what” intelligence systems must collect and focuses on the requirements

of the customer; it is all-source oriented and advocates “what” information is necessary for

collection.

Collection Resource. A collection system, platform, or capability that is not assigned or attached to a

specific unit or echelon which must be requested and coordinated through the chain of command.

(JP 1-02 and JP 2-01, Joint and National Intelligence Support to Military Operations, 5 Jan 2012)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Collection Strategy. An analytical approach used by collection managers to determine which intelligence

disciplines can be applied to satisfy information requirements. (JP 2-0, Joint Intelligence, 22 Oct 2013)

Collection Support Brief (CSB). A supplement to a collection requirement on key country topics, technical

subjects, and other complex issues. It provides more detailed tutorial information for HUMINT collectors

regarding technical developments, organizations, facilities, and personalities associated with the

collection topic. (DHE-M 3301.002, Vol II, Collection Operations, 23 Nov 2010)

Collector. A person who acquires information or services from a source. (HDI Lexicon, Apr 2008)

Combat Intelligence. Within DoD: None - term removed from JP 1-02 per JP 2-0 Joint Intelligence 22 Oct

2013.

Previously defined in JP 1-02 as: that knowledge of the enemy, weather, and geographical

features required by a commander in the planning and conduct of combat operations.

Combat Support Agency (CSA). A Department of Defense agency so designated by Congress or the

Secretary of Defense that supports military combat operations. (JP 5-0, Joint Operation Planning, 11 Aug

2011)

Combatant Command (COCOM) A unified or specified command with a broad continuing mission under a

single commander established and so designated by the President, through the Secretary of Defense and

with the advice and assistance of the Chairman of the Joint Chiefs of Staff. (JP 1, Doctrine for the Armed

Forces of the United States, 25 Mar 2013)

Combatant Command (command authority). Nontransferable command authority, which cannot be

delegated, of a combatant commander to perform those functions of command over assigned forces

involving organizing and employing commands and forces; assigning tasks; designating objectives; giving

authoritative direction over all aspects of military operations, joint training, and logistics necessary to

accomplish the missions assigned to the command. (JP 1, Doctrine for the Armed Forces of the United

States, 25 Mar 2013) Also see Unified Command Plan.

Combatant Commander (CCDR). A commander of one of the unified or specified combatant commands

established by the President. (JP 1-02) Also see Unified Command Plan.

Combating Terrorism (CbT). Actions, including antiterrorism (defensive measures taken to reduce

vulnerability to terrorist acts) and counterterrorism (offensive measures taken to prevent, deter, and

respond to terrorism), taken to oppose terrorism throughout the entire threat spectrum. (JP 1-02 and

JP 3-26, Counterterrorism, 13 Nov 2009)

-- Also, within DoD, encompasses all actions taken to oppose terrorism throughout the entire

threat spectrum including terrorist use of CBRNE devices. Actions taken include AT, counterterrorism,

terrorism consequence management, and intelligence support (collection, analysis, and dissemination of

terrorism-related information). (DoDI 2000.12, DoD Antiterrorism Program, 1 Mar 2012 with change 1

dated 9 Sep 2013)

Combat Support Agency (CSA). A Department of Defense agency so designated by Congress or the

Secretary of Defense that supports military combat operations. (JP 1-02 and JP 5-0, Joint Operation

Planning, 11 Aug 2011)

Command and Control (C2). The exercise of authority and direction by a properly designated

commander over assigned and attached forces in the accomplishment of the mission. (JP 1, Doctrine for

the Armed Forces of the United States, 25 Mar 2013)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Command Counterintelligence Coordinating Authority (CCICA). The senior command representative to

conduct and exercise staff coordination authority over CI activities. Develops and implements the

Combatant Command’s CI strategy and plans, serves as the focal point for CI issues impacting the

command, identifies command resource requirements, and coordinates CI support to the command.

Formerly known as “CI Staff Officer” [or CISO]. (DoDI 5240.10, CI in the Combatant Commands and

Other DoD Components, 5 Oct 2011 with change 1 dated 15 Oct 2013)

Note: this term is approved for inclusion in the next edition of JP 1-02.

-- Also, the Combatant Commander’s senior representative for CI. The CCICA serves as the

authoritative point of contact for the Combatant Command on CI issues and activities and assists in

exercising the command’s CI activities. JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011

w/ chg 1 dated 26 Aug 2011) Also see Counterintelligence Coordinating Authority (CICA).

The CCICA is a CI subject matter expert and the senior CI adviser to the Combatant Command.

DoD Instruction 5240.10 directs that the CICCA shall be either a military O5/O6 or civilian

equivalent, and shall have CI experience [not further defined].

For additional information see JP 2.01.2, CI & HUMINT in Joint Operations, 11 Mar 2011 (para 2a)

Commander's Critical Information Requirement (CCIR). An information requirement identified by the

commander as being critical to facilitating timely decision-making. (JP 1-02 and JP 3-0, Joint Operations,

11 Aug 2011)

Committee of Foreign Investment in the United States (CFIUS). An interagency committee that serves

the President in overseeing the national security implications of foreign investments. (Department of

Treasury website at <http://www.treas.gov/offices/international-affairs/exon-florio/>)

CFIUS has 12 members under the chairmanship of the Secretary of Treasury consisting of: the

Secretaries of State, Defense, Commerce, and Homeland Security, the Attorney General, Director

OMB, Director of the Office of Science and Technology Policy, Assistant to the President for

National Security Affairs, Assistant to the President for Economic Policy, US Trade Representative,

and Chairman of the Council of Economic Advisers.

-- Department of Treasury website (cited above)

_______________________

Originally established in 1975 by EO 11858 mainly to monitor and evaluate the impact of foreign

investment in the United States. In 1988, EO 12661 designated CFIUS to receive notices of

foreign acquisitions of U.S. companies, to determine whether a particular acquisition has national

security issues sufficient to warrant an investigation and to undertake an investigation, if necessary,

and to submit a report and recommendation to the President at the conclusion of an investigation.

On 26 July 2077, the Foreign Investment and National Security Act of 2007 (PL 110-49) was

enacted. The act was implemented by EO 13456 and addresses many issues, e.g., Congressional

notification requirements; more stringent rules for the review and formal investigation of

transactions, especially those involving foreign governments or critical infrastructure assets;

requires senior-level involvement in various required certifications and reports, limiting the

agencies’ delegation authority; established the membership of CFIUS by statute; and created a

defined role for the Director of National Intelligence as an ex-officio member who must evaluate the

transaction’s national security implications.

Also see CRS Report: <http://www.fas.org/sgp/crs/natsec/RL33388.pdf>

Common Operational Picture (COP). A single identical display of relevant information shared by more

than one command. A common operational picture facilitates collaborative planning and assists all

echelons to achieve situational awareness. (JP 1-02 and JP 3-0, Joint Operations, 11 Aug 2011)

-- Also, (Army) A single display of relevant information within a commander’s area of interest tailored to

the user’s requirements and based on common data and information shared by more than one command.

(ADRP 6-0, Mission Command, May 2012)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Communications Cover. Concealing or altering of characteristic communications patterns to hide

information that could be of value to an adversary. (CNSSI No. 4009, National Information Assurance

Glossary, 26 April 2010)

Communications Intelligence (COMINT). Technical information and intelligence derived from foreign

communications by other than the intended recipients. (JP 1-02 and JP 2-0, Joint Intelligence, 22 Oct

2013) Also see signals intelligence.

-- Also, the capture of information, either encrypted or in “plaintext,” exchanged between intelligence

targets or transmitted by a known or suspected intelligence target for the purpose of tracking

communications patterns and protocols (traffic analysis), establishing links between intercommunicating

parties or groups, or analysis of the substantive meaning of the communication. COMINT is a sub-

discipline of SIGINT. (ODNI, U.S. National Intelligence - An Overview 2011)

COMINT is a sub-category of signals intelligence that engages in dealing with messages or voice

information derived from the interception of foreign communications. It is produced by the

collection and processing of foreign communications passed by radio, wire or other electromagnetic

means, and by the processing of foreign encrypted communications, however transmitted.

Collection comprises search, intercept, and direction finding.

__________________

Communications Intelligence or COMINT: technical and intelligence information derived from

foreign communications by other than intended recipients. COMINT activities… those activities

that produce COMINT by the collection and processing of foreign communications passed by radio,

wire, or other electromagnetic means… and by processing foreign encrypted communications,

however transmitted. Collection comprises search, intercept and direct finding. Processing

comprises range estimation, transmitter, operator identification, signal analysis, traffic analysis,

cryptanalysis, decryption study of plain text, the fusion of these activities and the reporting of

results.

-- NSCID 6, Signals Intelligence, 17 Feb 1972 (redacted copy, complete original version is TOP SECRET)

Available at: http://www2.gwu.edu/~nsarchiv/NSAEBB/NSAEBB23/docs/doc05.pdf

___________________

[T]here ‘is’ something special about communications intelligence… in a nutshell, its special value

lies in the fact that this kind of intelligence is generally accurate, reliable, ‘authentic,’ continuous,

and most of all, ‘timely’.

-- NSA, A History of U.S. Communications Security (U) [Vol I], revised July 1973, p.9; originally classified

SECRET/NORFORN//COMINT, declassified by NSA 10 Dec 2008)

Communications Security (COMSEC). The protection resulting from all measures designed to deny

unauthorized persons information of value that might be derived from the possession and study of

telecommunications, or to mislead unauthorized persons in their interpretation of the results of such

possession and study. (JP 1-02 and JP 6-0, Joint Communications Systems, 10 Jun 2010)

-- Also, protective measures taken to deny unauthorized persons information derived from

telecommunications of the U.S. Government related to national security and to ensure the

authenticity of such communications. Such protection results from the application of security measures

(including cryptosecurity, transmission security, emissions security, and jamming resistance) to

telecommunications and to electrical systems generating, handling, processing, or using national security

or national security-related information. It also includes the application of physical security measures to

COMSEC information or materials. (DoDD 4640.6 Communications Security Telephone Monitoring and

Recording, 26 Jun 1981)

-- Also, measures and controls taken to deny unauthorized individuals information derived from

telecommunications and to ensure the authenticity of such telecommunications. COMSEC includes

cryptosecurity, transmission security, emission security, and physical security of COMSEC material.

(DoDD 5100.20, NSA, 26 Jan 2010)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, a component of Information Assurance that deals with measures and controls taken to deny

unauthorized persons information derived from telecommunications and to ensure the authenticity of such

telecommunications. COMSEC includes crypto security, transmission security, emissions security, and

physical security of COMSEC material. (CNSS Instruction No, 4009, National IA Glossary, 26 Apr 2010)

Communications Security Monitoring. The act of listening to, copying, or recording transmissions of one's

own circuits (or when specially agreed, e.g., in allied exercises, those of friendly forces) to provide

material for communications security analysis in order to determine the degree of security being provided

to those transmissions. In particular, the purposes include providing a basis for advising commanders on

the security risks resulting from their transmissions, improving the security of communications, and

planning and conducting manipulative communications deception operations. (previously in JP 1-02)

Community On-Line Intelligence System for End-Users and Managers (COLISEUM). The management

system for production requirements and requests for information. CI production. (DoDI 5240.18, CI

Analysis & Production, 17 Nov 2009 with change 1 dated 15 Oct 2013)

-- Also, an analysis requirements management tool used throughout the DIE for tasking and

managing requirements for finished intelligence production. (DoDI 3020.51, Intelligence Support to DCIP,

23 Jun 2011)

-- Also, the primary production requirements management system for the Defense Intelligence

Analysis Program (DIAP). It supports the DIAP mission to consolidate and gain synergism of DoD

intelligence production resources by automating the basic production requirement process defined in

the DIAP and its key operational concepts. (DIA DIAP)

-- Also, an analysis requirement management tool used throughout the Defense Intelligence

Community to register and track requests for information/analytical requirements, search for existing

intelligence, and manage/account for analytical resources. It is a web-based application available through

Intelink. (Joint Military Intelligence Training Center, Fundamentals of COLISEUM 5.0, Jun 2008)

Defense CI Components shall use the CI-approved electronic archiving system to validate, task,

and disseminate production requirements for CI analysis. The approved system is the primary

method to communicate analysis and production requirements within the DoD CI enterprise.

Defense CI Components without access to the approved system may use COLISEUM.

-- DoDI 5140.18, CI Analysis & Production, 17 Nov 2009

Compartmentation. The principle of controlling access to sensitive information so that it is available only

to those individuals or organizational components with an official ”need-to-know” and only to the extent

required for the performance of assigned responsibilities. (National HUMINT Glossary) Also see Bigot

List.

-- Also, establishment and management of an organization so that information about the personnel,

internal organization, or activities of one component is made available to any other component only to the

extent required for the performance of assigned duties. (JP 1-02 and JP 3-05.1, Joint Special Operations

Task Force Operations, 26 Apr 2007)

-- Also, management of an intelligence service so that information about personnel, organization, or

activities of one component is made available to any other component only to the extent required for the

performance of assigned duties. (FBI FCI Terms)

-- Also, the practice of establishing specials channels for handling sensitive intelligence information.

The channels are limited to individuals with a specific need for such information and who are therefore

given special security clearances in order to have access to it. (Senate Report 94-755, Book I - Glossary,

26 Apr 1976)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, the process of strictly limiting the number of people who are aware of a given intelligence

operation…. Only personnel with an absolute “need to know” should be admitted into the compartment.

(James M. Olson, Fair Play: The Moral Dilemmas of Spying, 2006)

The primary purpose of compartmentation is security, to protect extremely sensitive information

from compromise.

_________________________

An intelligence service that is careless about compartmentation pays the price.

-- James M. Olson, Former Chief of CIA Counterintelligence

_________________________

Effective compartmentation is fundamental to all secret activity….

-- Richard Helms, Former Director CIA (1966-1973)

(see Richard Helms with William Hood, A Look Over My Shoulder, 2003, pp.184-185)

_________________________

[It’s]…essential to practice strict compartmentation in counterintelligence investigations.

-- Colonel Stuart A. Herrington, US Army (Ret)

(see Traitors Among Us: Inside the Spy Catcher’s World,1999, pp.272-273)

Compartmented Intelligence. National intelligence placed in a DNI-approved control system to ensure

handling by specifically identified and access approved individuals. (IC Standard 700-1, 4 Apr 2008)

-- Also, national intelligence information under a control system and only available to designated

individuals. (National Intelligence: A Consumer’s Guide - 2009).

Compartmented intelligence became institutionalized during World War II [SIGINT, e.g., ULTRA,

MAGIC, etc.]…. Compartmentalizing information is the way they restrict what is known.

-- William E. Burrows, Deep Black (1986)

____________________

In the secret operations canon it is axiomatic that the probability of leaks escalates exponentially

each time a classified document is exposed to another person…. Effective compartmentation is

fundamental to all secret activity.

-- Richard Helms (Former DCI), A Look Over My Shoulder (2003)

Complaint-type Investigation. A counterintelligence investigation in which sabotage, espionage, treason,

sedition, subversive activity, or disaffection is suspected. (JP 1-02)

Complex Catastrophe. Any natural or man-made incident, including cyberspace attack, power grid

failure, and terrorism, which results in cascading failures of multiple, interdependent, critical, life-

sustaining infrastructure sectors and causes extraordinary levels of mass casualties, damage or

disruption severely affecting the population, environment, economy, public health, national morale,

response efforts, and/or government functions. (Deputy Secretary of Defense Memorandum, 19 February

2013 cited in JP 3-28, Defense Support of Civil Authorities, 31 Jul 2013) Also see catastrophic event.

Compromise. A communication or physical transfer of classified information to an unauthorized recipient.

(DoDD 5200.1, DoD Information Security Program, 13 Dec 1996)

-- Also, an unauthorized disclosure of classified information. (DoDM 5200.01-Vol 1, DoD Information

Security, 24 Feb 2012 and DoD 5220.22-M, NISPOM, 28 Feb 2006)

-- Also, the known or suspected exposure of clandestine personnel, installations, or other assets or of

classified information or material, to an unauthorized person. (JP 1-02 and JP 2-01.2, CI & HUMINT in

Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

-- Also, the disclosure or release of classified information to unauthorized person(s). (IC Standard

700-1, 4 Apr 2008

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, type of incident where information is disclosed to unauthorized individuals or a violation of the

security policy of a system in which unauthorized intentional or unintentional disclosure, modification,

destruction, or loss of an object may have occurred. (CNSSI No. 4009, National Information Assurance

Glossary, 26 April 2010)

-- Also, a known or suspected exposure of clandestine personnel, installations, or other assets, or of

classified information or material, to an unauthorized person. (Senate Report 94-755, Book I - Glossary,

26 Apr 1976)

Compromised. A term applied to classified matter, knowledge of which has, in whole or in part, passed to

an unauthorized person or persons, or which has been subject to risk of such passing. (JP 1-02 and

JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

-- Also, when an operation, asset, or agent is uncovered and cannot remain secret. (CI Centre

Glossary)

Compromising Emanations. Unintentional emissions that could disclose information being transmitted,

received, or handled by any information-processing equipment. (ICS Glossary) Also see TEMPEST;

TEMPEST Test.

-- Also, unintentional signals that, if intercepted and analyzed, would disclose the information

transmitted, received, handled or otherwise processed by information system equipment. (CNSSI No.

4009, National Information Assurance Glossary, 26 April 2010; also NSTISSI 7002)

Computer Forensics. The practice of gathering, retaining, and analyzing computer-related data for

investigative purposes in a manner that maintains the integrity of the data. (CNSSI No. 4009, National

Information Assurance Glossary, 26 April 2010)

-- Also, the scientific, systematic inspection and analysis of digital media and its contents to gather

information on the facts and circumstances which may connect an incident to a threat to national security

or other computer use that is contrary to security of information systems or may indicative of espionage.

The objectives are to perform a structured investigation, maintain the proper chain of evidence,

reconstruct the activities of a computer user, and preserve the integrity of the data. (AR 381-20, Army

CI Program, 25 May 2010)

Computer Intrusion. Within DoD: None - term removed from JP 1-02 per JP 3-13, Cyberspace

Operations, 5 Feb 2013.

Previously defined in JP 1-02 as: an incident of unauthorized access to data or an automated

information system.

Computer Intrusion Detection. Within DoD: None - term removed from JP 1-02 per JP 3-13, Cyberspace

Operations, 5 Feb 2013.

Previously defined in JP 1-02 as: the process of identifying that a computer intrusion has been

attempted, is occurring, or has occurred.

Computer Network. The constituent element of an enclave responsible for connecting computing

environments by providing short-haul data transport capabilities, such as local or campus area networks,

or long-haul data transport capabilities, such as operational, metropolitan, or wide area and backbone

networks. (DoDI S-5240.23, CI Activities in Cyberspace, 13 Dec 2010 with change 1 dated 16 Oct 2013)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Computer Network Attack (CNA). Operations to manipulate, disrupt, deny, degrade, or destroy

information resident in computers and computer networks, or the computers and networks themselves.

(DCID 7/3, Information Operations and IC Related Activities (U), 1 Jul 1999, updated 5 Jun 2003)

Within DoD: None - term removed from JP 1-02 per JP 3-13, 27 Nov 2012.

Defined in the previous edition of JP 3-13, Information Operations, dated 13 Feb 2006, as:

Actions taken through the use of computer networks to disrupt, deny, degrade, or destroy

information resident in computers and computer networks, or the computers and networks

themselves.

Computer Network Defense (CND). Efforts to defend against the computer network operations of others,

especially that directed against U.S. and allied computers and networks. (DCID 7/3, Information

Operations and IC Related Activities (U), 1 Jul 1999, updated 5 Jun 2003)

Within DoD: None - term removed from JP 1-02 per JP 3-13, 27 Nov 2012.

Previously defined as: Actions taken through the use of computer networks to protect, monitor,

analyze, detect and respond to unauthorized activity within Department of Defense information

systems and computer networks.

Computer Network Exploitation (CNE). Intelligence collection and enabling operations to gather data

from target or adversary automated information systems or networks. (DCID 7/3, Information Operations

and IC Related Activities (U), 1 Jul 1999, updated 5 Jun 2003)

Within DoD: None - term removed from JP 1-02 per JP 3-13, 27 Nov 2012).

Previously defined as: Enabling operations and intelligence collection capabilities conducted

through the use of computer networks to gather data from target or adversary automated

information systems or networks.

Computer Network Operations (CNO). Within DoD: None - term removed from JP 1-02 per JP 3-13,

27 Nov 2012.

Previously defined as: comprised of computer network attack, computer network defense, and

related computer network exploitation enabling operations.

Computer Security (COMUSEC). The protection resulting from all measures to deny unauthorized

access and exploitation of friendly computer systems. (JP 1-02 and JP 6-0, Joint Communications, 10

Jun 2010) Also see Information Security (INFOSEC); Cybersecurity.

Computer Trespasser. A person who accesses a protected computer without authorization and thus has

no reasonable expectation of privacy in any communication transmitted to, through, or from the protected

computer; see 18 USC 2510 (21)(a). (AR 381-20, Army CI Program, 25 May 2010)

Computer Virus. A software program, script, or macro that has been designed to infect, destroy, modify,

or cause other problems with a computer or software program. (US Army TRADOC DCSINT Handbook

1.02, 15 Aug 2007)

-- Also, a computer program that can copy itself and infect a computer without permission or

knowledge of the user. (Wikipedia; accessed 2 Oct 2007)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Concealed Monitoring. Targeting by electronic, optical, or mechanical devices a particular person or a

group of persons without their consent in a surreptitious and continuous manner. Monitoring is

surreptitious when it is targeted in a manner designed to keep the subject of the monitoring unaware of it.

Monitoring is continuous if it is conducted without interruption for a substantial period of time. (DoD

5240.1-R, Procedures Governing the Activities of DoD Intelligence Components that Affect US Persons,

Dec 1982)

Concealed monitoring includes, but is not limited to the use of microphones, video cameras,

beepers, beacons, transponders, and GPS locators.

Within DoD, if there is a reasonable expectation of privacy, a Procedure 6 is required IAW DoD

5240.1-R. Procedures Governing the Activities of DoD Intelligence Components that Affect United

States Persons,

Concealment. The act of remaining hidden. (DSS Glossary)

Concealment Device (CD). A container designed to hide materials. (HDI Lexicon, April 2008)

-- Also, innocuous object designed or adapted as a container for secreting any selected material or

equipment. Also called containers. (AFOSI Manual 71-142, OFCO, 9 Jun 2000)

-- Also, any one of a variety of innocuous devices used to secretly store and transport materials

relating to an operation. (CI Centre Glossary)

-- Also, an object modified or fabricated to contain either a device or intelligence materials for the

purpose of covert storage, transport, placement within a target, or dead-dropping. (Spycraft)

Concept of Intelligence Operations. Within the Department of Defense, a verbal or graphic statement, in

broad outline, of an intelligence directorate’s assumptions or intent in regard to intelligence support of an

operation or series of operations. (JP 2.0, Joint Intelligence, 22 Oct 2013)

Concept of Operations (CONOPS). A verbal or graphic statement that clearly and concisely expresses

what the joint force commander intends to accomplish and how it will be done using available resources.

(JP 5-0, Joint Operation Planning, 11 Aug 2011)

Concept Plan (CONPLAN). In the context of joint operation planning level 3 planning detail, an operation

plan in an abbreviated format that may require considerable expansion or alteration to convert it into a

complete operation plan or operation order. (JP 1-02 and JP 5-0, Joint Operation Planning, 11 Aug 2011)

Conduits. Within military deception, conduits are information or intelligence gateways to the deception

target. Examples of conduits include: foreign intelligence and security services, intelligence collection

platforms, open-source intelligence, news media—foreign and domestic. (JP 3-13.4, Military Deception,

26 Jan 2012) See military deception.

Confidential. Security classification that shall be applied to information, the unauthorized disclosure of

which reasonably could be expected to cause damage to the national security that the original

classification authority is able to identify or describe. (EO 13526, Classified National Security Information,

31 Dec 2009) Also see security classification.

Confidential Source. Any individual or organization that provides information to the U.S. Government on

matters pertaining to national security and expects, in return, that the information or relationship, or both,

will be held in confidence. This definition is not to be confused with “intelligence source” as used in the

Human Intelligence Community. (IC Standard 700-1, 4 Apr 2008)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, any individual or organization that has provided, or that may reasonably be expected to

provide, information to the United States on matters pertaining to the national security with the

expectation that the information or relationship, or both, are to be held in confidence. (EO 13526,

Classified National Security Information, 31 Dec 2009)

-- Also [within AFOSI], any individual whose identity is being protected, with whom AFOSI establishes

a formal managed relationship, and whose AFOSI directed activities result in the gathering of information

or testimonial or physical evidence. This does not include those individuals who provide information as a

result of their official duties or one time witness to an incident or crime. (AFOSI Manual 71-118, Vol I,

Confidential Source Management, 3 Oct 2002)

Confusion Agent. An individual dispatched by his sponsor to confound the intelligence or

counterintelligence apparatus of another country rather than to collect and transmit information. (Senate

Report 94-755, Book I - Glossary, 26 Apr 1976)

-- Within DoD: None - term removed from JP 1-02 (rescinded 11 Mar 2011).

Previously defined in JP 1-02 as: an individual who is dispatched by the sponsor for the primary

purpose of confounding the intelligence or counterintelligence apparatus of another country rather

than for the purpose of collecting and transmitting information.

Congressional Intelligence Committees. The Senate Select Committee on Intelligence (SSCI) and the

House Permanent Select Committee on Intelligence (HPSCI). Also see SSCI; HPSCI.

The 1980 Intelligence Oversight Act charged the SSCI and HPSCI with authorizing the programs

of US intelligence agencies and overseeing their activities.

-- SSCI website at <http://intelligence.senate.gov/> and HPSCI at <http://intelligence.house.gov/>

Consensual Monitoring. Monitoring of communications for which a court order or warrant is not legally

required because of the consent of a party to the communication. (Attorney General’s Guidelines for

Domestic FBI Operations, 29 Sep 2008)

Consolidated Adjudications Facility (CAF). The DoD CAF, under the direction of the Washington

Headquarters Services (WHS)—a DoD Field Activity—grants, denies, or revokes eligibility for access to

classified information and eligibility for occupancy of sensitive positions, and supports the use of

automated and consolidated adjudicative processes to the maximum extent practicable in accordance

with DoDD 5220.6 (Defense Industrial Personnel Security Clearance Review Program) and DoD

Regulation 5200.2-R (Personnel Security Program).

DoD established the DoD CAF to consolidate resources and standardize adjudicative processes.

On May 3, 2012, the Deputy SECDEF directed a complete consolidation of the functions,

resources, and assets of the Army Central Clearance Facility, Department of the Navy CAF, Air

Force CAF, Joint Staff CAF, Washington Headquarters (WHS) CAF, Defense Industrial Security

Clearance Office (DISCO), and the Defense Office of Hearings and Appeals (DOHA) into a single

organization under the authority, direction and control of the Director of Administration and

Management. The DoD CAF is located on Fort Meade, MD.

Constraint. In the context of joint operation planning, a requirement placed on the command by a higher

command that dictates an action, thus restricting freedom of action. (JP 5-0, Joint Operation Planning,

11 Aug 2011)

Contact Report (CR). A report of an operational event; a format providing the officer the ability to

document routine aspects of operational activities not otherwise covered by other intelligence or

operational reporting. (National HUMINT Glossary)

-- Also, a report used during the conduct of source operations to document the circumstances of, and

establish a historical report of the operation. (Army FM 2.22-2, Counterintelligence, Oct 2009)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Contamination. Type of incident involving the introduction of data of one security classification or security

category into data of a lower security classification or different security category. (CNSSI No. 4009,

National Information Assurance Glossary, 26 April 2010)

Continental United States (CONUS). United States territory, including the adjacent territorial waters,

located within North America between Canada and Mexico. (JP 1, Doctrine for the Armed Forces of the

United States, 25 Mar 2013)

Contingency. A situation requiring military operations in response to natural disasters, terrorists,

subversives, or as otherwise directed by appropriate authority to protect US interests. (JP 5-0, Joint

Operation Planning, 11 Aug 2011)

Contingency Planning Guidance (CPG). Secretary of Defense written guidance, approved by the

President, for the Chairman of the Joint Chiefs of Staff, which focuses the guidance given in the national

security strategy and Defense Planning Guidance, and is the principal source document for the Joint

Strategic Capabilities Plan. (JP 1, Doctrine for the Armed Forces of the United States, 25 Mar 2013)

Contingency Operation. A military operation that is either designated by the Secretary of Defense as a

contingency operation or becomes a contingency operation as a matter of law (Title 10, USC §101[a][13]

and JP1, Doctrine for the Armed Forces of the United States, 25 Mar 2013)

Continuity of Government (COG). A coordinated effort within the Federal Government's executive branch

to ensure that National Essential Functions continue to be performed during a Catastrophic Emergency.

(NSPD 51, National Continuity Program, 9 May 2007)

-- Also, a coordinated effort within the Executive Branch that ensures the continuation of minimum

essential functions in any emergency situation, including catastrophic emergencies that impair or threaten

day-to-day operations of departments/agencies within the branch. COG activities involve ensuring the

continuity of minimum essential functions utilizing infrastructures outside the Washington Metropolitan

Area (WMA) and must be capable of implementation with and without warning. (NIP - FY 2009

Congressional Budget Justification Book, redacted version)*

* Copy available at: <http://www.fas.org/irp/dni/cbjb-2009.pdf > (accessed 24 Jan 2013.

Continuous Evaluation. Means reviewing the background of an individual who has been determined to be

eligible for access to classified information (including additional or new checks of commercial databases,

Government databases, and other information lawfully available to security officials) at any time during

the period of eligibility to determine whether that individual continues to meet the requirements for

eligibility for access to classified information. (EO 13467, 2 Jul 2008 & DoDI 5200.02, DoD Personnel

Sceurity Program, 21 Mar 2014)

All personnel in national security positions shall be subject to continuous evaluation.

-- DoDI 5200.02, DoD Personnel Security Program, 21 Mar 2014 (encl 3, para 6)

Control.

[As used in intelligence human source operations], the capacity of a case officer (and his

service) to generate, alter, or halt agent behavior by using or indicating his capacity to use physical or

psychological means of leverage. (Source: John P. Dimmer, Jr., “Observations on the Double Agent,”

Studies in Intelligence, vol. 6, no. 1 (Winter 1962), pp 57-72. Declassified, originally classified SECRET)

-- Also, [in intelligence usage,] physical or psychological pressures exerted with the intent to assure

that an agent or group will respond as directed. (JP 1-02)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, physical or psychological pressure exerted on an agent to ensure that he or she responds to

directions from an intelligence agency or service. (Spy Book)

“A case officer does not control an agent the way he controls an automobile [or] the way a

policeman controls an informer. The intelligence officer who thinks of control in absolutes of

black and white does his operations a disservice; the areas of gray predominate.”

-- John P. Dimmer, Jr., CIA Operations Officer (1962)

Control of Compromising Emanations (aka TEMPEST). TEMPEST Countermeasures are designed to

prevent exploitation of compromising emanations by containing them within the equipment or IS

[inspectable space] of the facility processing classified information. (AR 381-14, Technical

Counterintelligence, 30 Sep 2002)

Controlled Information.

1) Information conveyed to an adversary in a deception operation to evoke

desired appreciations; or 2) Information and indicators deliberately conveyed or denied to foreign targets

to evoke invalid official estimates that result in foreign official actions advantageous to US interests and

objectives. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Ops, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

Controlled Source. In counterintelligence use, a person employed by or under the control of an

intelligence activity and responding to intelligence tasking.

(JP 1-02 and JP 2-01.2, CI & HUMINT in Joint

Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011) Also see source; control; controlled source

operation.

Controlled Source Operation (CSO). A type of offensive counterintelligence operation (OFCO); see DoDI

S-5240.09, OFCO, 29 Oct 2008 (under revision).

Controlled Technical Services (CTS). The controlled use of technology to enhance counterintelligence

and human intelligence activities. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Ops, 16 Mar 2011

w/ chg 1 dated 26 Aug 2011)

CTS include asset communications, validation tools, tailored form factors, and technology or tools

used with sources or CI and HUMINT officers to enhance their collection efforts. CTS are a

support function of CI and HIMINT and are not independent operations.

-- JP 2.01.2, CI & HUMINT in Joint Operations, 11 Mar 2011 w/ chg 1 (p. II-15)

Controlled Unclassified Information (CUI). Unclassified information that does not meet the standards for

National Security Classification under Executive Order 12958 but is (1) pertinent to the national interests

of the United States or to the important interests of entities outside the Federal Government, and (2)

under law or policy requires protection from unauthorized disclosure, special handling safeguards, or

prescribed limits on exchange or dissemination. (White House Memo, subj: Designation and Sharing of

Controlled Unclassified Information, dated 7 May 2008)

routinely generate, use, store, and share information that, while not

All federal agencies

nevertheless requires some level

appropriate for “classification” under EO 12958 or other authority,

of protection from unauthorized access and release. Currently this information is identified by over

100 unique markings and handling regimes, such as “Law Enforcement Sensitive,” “FOUO,” etc.

An Interagency Task Force reviewed the CUI framework and recommended that the definition of

CUI should be simplified to: All unclassified information for which, pursuant to statute, regulation,

or departmental or agency policy, there is a compelling requirement for safeguarding and/or

dissemination controls.

See Report and Recommendations of the Presidential Task Force on Controlled Unclassified

Information, 25 August 2009, at <http://www.dhs.gov/xlibrary/assets/cui_task_force_rpt.pdf>

Cooperative Contact. An asset validation term referring to an individual who wittingly responds to tasking

in certain areas, but is unwilling to enter into a controlled clandestine relationship. (National HUMINT

Glossary)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cooperative Detainee. A detainee who has established a pattern of answering all questions truthfully and

unconditionally and, in fact, answers all questions truthfully and unconditionally. A detainee is not

cooperative if the detainee refuses to answer, avoids answering, or falsely answers questions, or if the

detainee is intentionally deceptive. A detainee who fluctuates between cooperation and resistance is not

cooperative. (DoDD 3115.09, DoD Intelligence Interrogations, Detainee Debriefings, and Tactical

Questioning, 11 Oct 2012 w/ chg 1 dated 15 Nov 2013)

Co-Opted Worker or Co-Optee. A national of a country, but not an officer or employee of that country’s

intelligence service, who assists that service on a temporary or opportunity basis. (ICS Glossary & CI

Community Lexicon)

Coordination. The process of sharing information regarding planned activity, affording potentially affected

parties the opportunity to comment, prior to undertaking action. The process of coordination does not

infer seeking authorization for action. (DoDD S-5200.37, Management and Execution of Defense

HUMINT (U), 9 Feb 2009)

-- Also, the process of sharing operational information and deconflicting activities prior to undertaking

a proposed action. Coordination does not require approval or disapproval of the proposed action. (DoDD

S-3325.09, Oversight, Management, and Execution of Defense Clandestine Source Operations (U), 9 Jan

2013 w/ chg 1, dated 13 Jun 2013)

DoD Counterintelligence

Coordination…

SECDEF shall conduct counterintelligence activities in support of

Department of Defense components and coordinate activities…

-- Dir FBI shall coordinate the clandestine collection of foreign intelligence

collected through human sources or through human-enabled means and

counterintelligence activities inside the United States.

-- Dir CIA shall coordinate the clandestine collection of foreign intelligence

collected through human sources or through human-enabled means and

counterintelligence activities outside the United States.

-- EO 12333, U.S. Intelligence Activities

DoD/FBI MOU

DCID 5/1 &

(Apr 1979)

DoD/CIA MOA

under revision

Annex 3

UNCLASSIFIED

113

EO 12333 directs that the Director FBI coordinates CI activities inside the U.S. and that Director

CIA coordinates CI activities outside the U.S. For coordination of DoD CI activities see:

-- DoD/FBI MOU: Memorandum of Understanding between the FBI and DoD Governing

Information Sharing, Operation Coordination, and Investigative Responsibilities, 2 Aug 2011

+ Annex A - Counterterrorism Information Sharing, 14 Mar 2012

+ Annex B - Counterintelligence Investigative Information Sharing, 9 Dec 2011

+ Annex C - To be Published -- Coordinating Counterintelligence Activities

+ Annex TBD - To be Published -- Joint Terrorism Task Force (JTTF)

Note: The DoD/FBI MOU (Aug 2011), along with Annexes A, B, and future annexes covering

Counterintelligence and Counterterrorism Jurisdiction and Operational Activities, when approved, supersede

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

the MOA Between the Attorney General and the Secretary of Defense, “Agreement Governing the Conduct of

Defense Department Counterintelligence Activities in Conjunction with the Federal Bureau of Investigation

(U), dated 5 April 1979 and the 1996 supplement thereto, “MOU Regarding Coordination of

Counterintelligence Matters.”

The DoD/FBI MOU (2011) defines Operational Coordination as: “The solicitation of inputs prior

to undertaking a proposed action, with the understanding that no such action will be taken until

any identified objections have been resolved.”

-- DoD/CIA MOA: Annex 3 to the Memorandum of Agreement Between the Central Intelligence

Agency and the Department of Defense, “MOA Between CIA and DoD Regarding CI Activities

Abroad (U),” 6 Dec 2007, classified SECRET//NOFORN

Note: Annex 3 streamlines the coordination process by assigning primary responsibility for deconfliction to

DoD CI field elements and the local Chief of Station/Chief of Base and defines “coordination” as the process

of sharing operational information and deconflicting activities prior to undertaking a proposed action. (USD/I

Memo, subj: Procedures for Coordination of Counterintelligence Activities Outside the United States, 4 Jan

2008).

For coordination regarding HUMINT activities see ICD 304, Human Intelligence, 6 Mar 2008

Coordinating Authority. The commander or individual who has the authority to require consultation

between the specific functions or activities involving forces of two or more Services, joint force

components, or forces of the same Service or agencies, but does not have the authority to compel

agreement. (JP 1, Doctrine for the Armed Forces of the United States, 25 Mar 2013)

Counter Surveillance. Measures or actions taken when under verified or suspected surveillance.

(DoDI S-5240.15, FPRG, 20 Oct 2010) Also see countersurveillance; surveillance; surveillance detection.

Counter Threat Finance (CTF). Efforts to stop money that funds terrorism, proliferation, narcotics

networks, espionage, WMD networks, trafficking in persons, weapons trafficking, precursor chemical

smuggling, and other activities that generate revenue through illicit trafficking networks. (A Guide to

Counter Threat Finance Intelligence by Marilyn B. Peterson, 2009) Also see threat finance.

Commander, U.S. Special Operations Command is the DoD CTF lead component for

synchronizing DoD CTF activities.

For DoD policy see DoDD 5205.14, DoD Counter Threat Finance Policy, 19 Aug 2010

(w/ chg 1 dated 16 Nov 2012).

-- CTF Activities and Capabilities [within DoD]. DoD activities and capabilities, apart from those

included under DoD CTFI [Counter Threat Intelligence], to deny, disrupt, destroy, or defeat finance

systems and networks that negatively affect U.S. interests in compliance with all existing authorities and

procedures. This includes those activities and capabilities undertaken with other Government agencies

and/or partner nations. DoD CTF counters financing used to engage in terrorist activities and illicit

networks that traffic narcotics, WMDs, improvised explosive devices, other weapons, persons, precursor

chemicals, and related activities that support an adversary’s ability to negatively affect U.S. interests.

(DoDD 5205.14, DoD Counter Threat Finance Policy, 19 Aug 2010)

-- CTF Intelligence (CTFI) [within DoD]. DoD intelligence actions, including those undertaken with

other USG agencies and/or coalition partners, that involve the collection, processing, integration,

evaluation, analysis, interpretation, production, and dissemination of intelligence products in support of

DoD CTF activities and capabilities. (DoDD 5205.14, DoD Counter Threat Finance Policy, 19 Aug 2010)

Counterdeception. Efforts to negate, neutralize, diminish the effects of, or gain advantage from a foreign

deception operation. Counterdeception does not include the intelligence function of identifying foreign

deception operations. (JP 1-02 and JP 3-13.4, Military Deception, 13 Jul 2006) Also see deception;

military deception.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, the detection of deception. (Textbook of Political-Military Counterdeception: Basic Principles &

Methods, August 2007)

In principle, it should always be possible to unmask a deception.

-- R.V. Jones, Intelligence and Deception (1981)

____________________________

Ideal counterdeception reveals the truth behind the lie, the face beneath the mask, the reality

under the camouflage.

-- Barton Whaley, Textbook of Political-Military Counterdeception: Basic Principles & Methods (2007)

Counterespionage (CE). That aspect of counterintelligence designed to detect, destroy, neutralize,

exploit, or prevent espionage activities through identification, penetration, manipulation, deception, and

repression of individuals, groups, or organizations conducting or suspected of conducting espionage

activities. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated

26 Aug 2011) Also see counterintelligence.

-- Also, actions undertaken to investigate specific allegations or circumstances and to acquire

information concerning a person or persons involved in the violation of US espionage laws. (National

HUMINT Glossary)

-- Also, those aggressive, comprehensive, and coordinated CI defensive and offensive endeavors

worldwide designed to detect, identify, assess, and counter, neutralize, penetrate, or exploit the foreign

intelligence threat to the Department of Defense (AR 381-20, Army CI Program, 25 May 2010)

-- Also, the act of conducting counterintelligence operations that involve the penetration of an

opposing intelligence service. (Encyclopedia of the CIA, 2003)

Counterespionage is often touted as the aristocratic sector of secret operations.

-- Harry Rositzke, CIA’s Secret Operations (1977)

__________________

Counterespionage… is a widely misunderstood branch of secret operations…. CE is an offensive

operation, a means of obtaining intelligence about the opposition by using—or, more usually,

attempting to use—the opposition’s operations. CE is a form of secret intelligence operation, but it

is a form so esoteric, so complex and important as to stand by itself.

-- Christopher Felix (James McCargar), A Short Course in the Secret War, 4^th Edition (2001)

__________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterespionage (CE) is the offensive, or aggressive, side of counterintelligence. It involves the

identification of a specific adversary and a knowledge of the specific operation he is conducting.

Counterespionage personnel must then attempt to counter these operations by infiltrating the

hostile service (called penetration) and through various forms of manipulation. Ideally, the thrust of

the hostile operation is turned back against the enemy.

-- Senate Report # 94-755 (aka Church Committee Report), Book I, 26 April 1976, p. 166

___________________

Counterespionage is like putting a virus into the bloodstream of the enemy.

-- Robin W. Winks, Cloak and Glown: Scholars in the Secret War (1987), p. 422

Counterfeit Material. An item that is an unauthorized copy or substitute that has been identified, marked,

or altered by a source other than the item’s legally authorized source and has been misrepresented to be

an authorized item of the legally authorized source. (DoDI 4140.67, DoD Counterfeit Prevention Policy,

26 Apr 2013) Also see suspect counterfeit.

For general background information see Senate Armed Services Committee Report 112-167,

Inquiry into Counterfeit Electronic Parts in the Department of Defense Supply Chain, 21 May 2012.

Copy at: http://www.armed-services.senate.gov/imo/media/doc/Counterfeit-Electronic-Parts.pdf

Counterguerrilla Operations. Operations and activities conducted by armed forces, paramilitary forces, or

nonmilitary agencies against guerrillas. (JP 1-02 and JP 3-24, Counterinsurgency, 22 Nov 2013)

Counterinsurgency (COIN). Comprehensive civilian and military efforts designed to simultaneously defeat

and contain insurgency and address its root causes. (JP 3-24, Counterinsurgency, 22 Nov 2013)

...the success of a counterinsurgency depends less on defeating the terrorist, guerrilla, or military

tactics of the insurgents than on uncovering and undermining the secret network and neutralizing

its violent tactics.

…The pivotal elements of counterinsurgency are intelligence and

counterintelligence.

-- Roy Godson, Dirty Tricks or Trump Cards: US Covert Action and Counterintelligence (1995), p. 165

Counterintelligence (CI). Information gathered and activities conducted to identify, deceive, exploit,

disrupt, or protect against espionage, other intelligence activities, sabotage, or assassinations conducted

for or on behalf of foreign powers, organizations or persons, or their agents, or international terrorist

organizations or activities. (Executive Order 12333, as amended 30 July 2008 and JP 2-01.2, CI &

HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011) Also see counterespionage.

Counterintelligence… the core mission simply stated --

Combating Adversarial Intelligence Threats

-- COL Mark L. Reagan (USA Ret)

For DoD counterintelligence policy, see DoD Directive O-5240.02, Counterintelligence

-- Also, information gathered, and activities conducted, to protect against espionage, other

intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign

governments or elements thereof, foreign organizations, or foreign persons, or international

terrorist activities. (50 USC §401a)

Counterintelligence: [noun] intelligence activities concerned with identifying and

countering the threat to security posed by hostile intelligence organizations or by

individuals engaged in espionage or sabotage or subversion or terrorism.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

UNCLASSIFIED

Identify

Deceive

Foreign Clandestine & Covert Threats

Espionage

Exploit

Other Intelligence Activities

Sabotage

Knowledge & Action

Disrupt

Assassinations

information gathered

…conducted for or on behalf of foreign powers,

and activities conducted…

organizations, or persons, or their agents,

Protect

or international terrorist organizations or activities.

-- Executive Order 12333, U.S. Intelligence Activities, as amended July 2008d

Mark L Reagan - 1 May 2012

UNCLASSIFIED

CI “embraces all activities, human and technical, whether at home or abroad, that are

undertaken to identify, assess, neutralize and exploit foreign intelligence threats…

counterintelligence is inherently a strategic, national security instrument.”

-- Hon. Michelle Van Cleave, NCIX, 18 Nov 2004

-- Also, intelligence activity, with its resultant product, devoted to destroying the effectiveness of

inimical foreign intelligence activities and undertaken to protect the security of the nation and its

personnel, information, and installations against espionage, sabotage, and subversion. Includes the

process of procuring, developing, recording, and disseminating information concerning hostile clandestine

activity and of penetrating, manipulating, or repressing individuals, groups, or organizations conducting

such activity. (National Security Council Intelligence Directive [NSCID] No. 5, 17 Feb 1972)

-- Also, encompasses actions taken to detect and counteract foreign intelligence activity that

adversely affects U.S. national security interest. (WMD Report, 31 Mar 2005)

-- Also, counterintelligence involves all those defensive and offensive activities conducted at home

and abroad to protect against traditional and emerging foreign intelligence and international terrorist

threats to the national security and to the national defense. (DHE-M 3301.002, Defense HUMINT

Enterprise Manual, Vol II: Collection Operations, 23 Nov 2010)

-- Also, counters or neutralizes foreign intelligence and security services (FISS) and international

terrorist organizations (ITO) intelligence collection efforts. It does this through collection, CI

investigations, operations, analysis, production, and functional and technical services. CI includes all

actions taken to detect, identify, track, exploit, and neutralize the multidiscipline intelligence activities

of friends, competitors, opponents, adversaries, and enemies. It is the key intelligence community

contributor to the protection of U.S. interests and equities. CI helps identify EEFIs [essential elements

of friendly information] by identifying vulnerabilities to threat collection and actions taken to counter

collection and operations against U.S. forces. (Army FM 2-0, Intelligence, 23 Mar 2010)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, the total action taken… by which information is gathered and activities are conducted to

protect that agency against espionage, theft of materials, sabotage, assignations, or other intelligence

activities conducted by, or on behalf of, hostile foreign governments or other “threatening” foreign

organizations (terrorist groups, rogue military units, etc.). (Encyclopedia of the CIA, 2003)

-- Also, CI is a discipline and mindset that identifies, analyzes and neutralizes the efforts of others

who seek to interfere with our [CIA’s] ability to collect and analyze intelligence. (CIA/CIC, circa Mar 2010)

Counterintelligence’s core mission can be simply stated as combating adversarial intelligence

threats. It is the business of identifying and combating foreign intelligence threats through

knowledge and action -- knowledge of and action in countering global adversarial intelligence

threats posed by a variety of intelligence entities directed by foreign states, as well as non-state

actors, such as transnational terrorist groups.

CI is an integral component of U.S. Intelligence—historically and doctrinally, as well as by statute,

executive order and policy. CI is an “intelligence activity” in accordance with the National Security

Act of 1947 and EO 12333, which both specifically define “intelligence” as including

counterintelligence and foreign intelligence. CI is intelligence activity focused on undermining the

effectiveness of -- as well as exploiting -- adversary intelligence activities directed against US

national security interests. Counterintelligence is one word in the United States -- it is not counter

intelligence (two words) or counter-intelligence (hyphenated).

CI is often confused with the foreign intelligence (FI) collection discipline referred to as human

intelligence or HUMINT. Although CI and HUMINT are both intelligence activities that operate in

the human domain -- they are distinctly different…different missions, different authorities,

each focused on different content, as well as outcomes.

The need for CI knowledge and action is much different from the need for FI collection. FI

collection values the information above all, whereas CI insists on acting on that information--

a totally different operational dynamic.

________________________

FI [foreign intelligence] is the task of producing and analyzing otherwise unobtainable intelligence

(i.e., “stealing secrets); CI focuses on preventing others from stealing secrets….

-- Andre Le Gallo, “Covert Action: A Vital Option in U.S. National Security Policy, International

Journal of Intelligence and Counterintelligence, Vol 18 No 2 (Summer 2005), p. 354

________________________

[Foreign] intelligence is, in essence, the gathering and analysis of secret information about other

nations. Its opposite twin, security, is the protection of one’s own secrets. Counterintelligence

seeks to protect both of the elements from foreign intelligence activities.

-- American Counterintelligence and Security for the 21st Century, The Institute of World Politics

_________________________

Knowledge and Action…

CI “is a strategic instrument available to states to protect themselves and advance their interests

in the struggle for power, wealth, and influence. …But the end product, the mission of

counterintelligence, is action—action to protect against foreigners and action to manipulate

foreigners in the service of national goals.”

-- Roy Godson, Dirty Tricks or Trump Cards: US Covert Action and Counterintelligence (1995)

_________________________

The primary mission of counterintelligence is to identify, neutralize, and exploit the intelligence or

secret infrastructure of others. It is by its very nature both a defensive and offensive tool. …

Offensively, counterintelligence helps to advance strategy and policy through knowledge about

adversary intelligence and exploit an adversary’s vulnerabilities to weaken or manipulate them to

advantage. … But only counterintelligence… has the mission and the capabilities to understand,

defend against, and exploit an adversary’s secret intelligence.

-- Roy Godson, Dirty Tricks or Trump Cards: US Covert Action and Counterintelligence, with new

introduction by the author (paperback 2001), p. xxviii

_________________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

CI wages “nothing less than a secret war against antagonist intelligence services.”

-- U.S. Senate Report 94-755, Book I, 26 April 1976, p. 163

-- Also, CI encompasses information collections, analysis, investigations and operations conducted

to identify and neutralize espionage and foreign intelligence activities, the intelligence-related activities

of terrorists, and adversary efforts to degrade, manipulate or covertly influence U.S. intelligence, political

processes, policy or public opinion. (NIPF [U], Jul 2006)

CI works closely with intelligence, security, infrastructure protections and law enforcement to

ensure an integrated approach to the protection of U.S. forces, our intelligence and national assets,

U.S. research, development and technology, and the U.S. economy.

CI is composed of both offensive and defensive elements. Offensive CI includes the penetration

and deception of adversary groups. Defensive CI involves protecting vital U.S. national security

related information from being obtained or manipulated by an adversary’s intelligence

organizations, activities and operations. This two-pronged approach forms a comprehensive CI

strategy that is informed by collection results and feeds more effective CI operations.

Counterintelligence is a universal constant that should be factored in whenever U.S. intelligence or

national security capabilities are deployed or when we are targeted by our adversaries. ‘Every’

U.S. intelligence capability and requirement needs to be protected and ‘every’ intelligence threat

deployed against us should be countered by effective offensive and defensive CI.

-- NIPF - Intelligence Topic Definitions and Information Needs (U), July 2006

-- Also, CI may also be thought of as knowledge needed for the protection and preservation of the

military, economic, and productive strength of the United States, including the security of the Government

in domestic and foreign affairs against or from espionage, sabotage, and all other similar clandestine

activities designed to weaken or destroy the United States. (Report of the Commission on Government

Security - 1957, as cited in Church Committee Report, 26 April 1976, p. 163, footnote 1)

Counterintelligence (CI) is a special form of intelligence activity, separate and distinct

from other disciplines. Its purpose is to discover hostile foreign intelligence operations

and destroy their effectiveness. This objective involves the protection of the United

State Government against infiltration by foreign agents, as well as the control and

manipulation of adversary intelligence operations. An effort is made to both discern

and decive [sic] the plans and intentions of enemy intelligence services.

Defined more formally, counterintelligence is an intelligence activity dedicated to

undermining the effectiveness of hostile intelligence services.

-- Senate Report 94-755 (aka Church Committee Report), 26 April 1976 (p. 163)

Counterintelligence - Senate Report 94-755

Counterintelligence: Activities conducted to destroy the effectiveness of foreign intelligence

operations and to protect information against espionage, individuals against subversion, and

installations against sabotage. The term also refers to information developed by or used in

counterintelligence operations. See counterespionage, countersabotage, and countersubversion

[below].

Counterespionage: Those aspects of counterintelligence concerned with aggressive operations against

another intelligence service to reduce its effectiveness, or to detect and neutralize foreign espionage. This

is done by identification, penetration, manipulation, deception, and repression of individuals, groups, or

organizations conducting or suspected of conducting espionage activities in order to destroy. Neutralize,

exploit, or prevent such espionage activities.

Countersabotage: That aspect of counterintelligence designed to detect, destroy, neutralize, or prevent

sabotage activities through identification, penetration, manipulation, deception, and repression of

individuals, groups, or organizations conducting or suspected of conducting sabotage activities.

Countersubversion: That part of counterintelligence designed to destroy the effectiveness of subversive

activities through the detection, identification, exploitation, penetration, manipulation, deception, and

repression of individuals, groups, or organizations conducting or capable of conducting such activities.

-- Senate Report 94-755 (aka Church Committee Report), Book I - Glossary, 26 April 1976, p. 620.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterintelligence Activities.

[An alternate term for] one or more of the five functions of

counterintelligence: operations, investigations, collection, analysis & production, and functional services.

(DoDD O-5240.02, Counterintelligence, 20 Dec 2007; JP 1-02; and JP 2-01.2, CI & HUMINT in Joint

Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011) Also see counterintelligence functions.

Counterintelligence Activities in Cyberspace. CI activities in cyberspace include those forensics

examinations of DoD affiliated information systems and other approved virtual or on-line activities to

identify, disrupt, neutralize, penetrate, or exploit FIEs [Foreign Intelligence Entities]. DoD CI activities in

cyberspace do not include Offensive Computer Operations as defined in NSPD-38 or the collection and

processing of technical and intelligence information derived from foreign communications by other than

an intended recipient. (DoDI S-5240.23, CI Activities in Cyberspace (U), 13 Dec 2010 with chg 1)

For additional information see --

1) JP 2-01.2, Counterintelligence and Human Intelligence in Joint Operations (U), 16 Mar 2011

w/ chg 1 dated 26 Aug 2011 (para 3f, p. III-17, “CI Activities in Cyberspace”).

2) The DoD Strategy for Counterintelligence in Cyberspace (28 Aug 2009).

3) The United States Government-Wide Cyber Counterintelligence Plan - 2008 (classified).

Cyberspace is a Venue

Counterintelligence Analysis. The methodical process of examining and evaluating information to

determine the nature, function, interrelationships, personalities, and intent regarding the intelligence

capabilities of foreign powers, international terrorists, and other entities. (DoDD O-5240.02,

Counterintelligence, 20 Dec 2007 with change 1 dated 20 Dec 2010) Also see counterintelligence

production.

UNCLASSIFIED

CI Function: CI Analysis & Production…

Assimilating, evaluating, interpreting, and disseminating

Analysis & Production

information of CI relevancy - a critical enabler providing

insights into clandestine & covert threats

Astute analysis is [a] critical enabler… Strategic analysis allows DoD CI to understand

today’s risk environment. …[it] allows the Department to learn and use an adversary’s

pressure points to influence its actions.

-- DoD Counterintelligence Strategy - FY 2004

“It is not enough, of course, simply to collect information.

Thoughtful analysis is vital to sound decisionmaking.”

-- President Ronald Reagan (4 Dec 1981)

“Analysis - Collecting information is one thing.

Making sense of it and using it to frustrate and exploit foreign services is another.”

-- Roy Godson, Dirty Tricks or Trump Cards: US Covert Action and Counterintelligence (1995), p. 81

Counterintelligence Analysis - the Queen of the Counterintelligence Chessboard

Intelligence Community analytical tradecraft standards established in ICD 203, Analytical

Standards, serve to guide the writing of intelligence analysis and apply to counterintelligence

analysis.

_________________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

“Effective counterintelligence analysis is a tall order. Good macro-analysis is not synonymous with

journalism, or narrative description, or even investigations. Macro-counterintelligence analysis is

meant to be explanatory, systematic, empirical, cumulative, reliable, comprehensive, integrated,

and policy relevant. Analysis should discover and connect the seemingly disconnected, illuminate

hidden relationships, identify unseen linkages, reveal patterns of activity and behavior heretofore

unobserved. Good counterintelligence analysis should provide reliable knowledge and authoritative

judgments to policymakers and operators. The product of counterintelligence and security analysis

is understanding and explanation, and if possible, to answer the questions how and why.”

-- Kenneth E, deGraffenreid, Countering Hostile Intelligence Activities as a Strategic Threat (1989)

CI analysis drives collections, enhances CI investigative activity,

shapes operations, enables mission execution, and informs decision makers

- Also, the process of examining and evaluating information to determine the nature, function,

interrelationships, personalities, and intent regarding the intelligence capabilities of state and non-state

actors and other entities and activities of CI interest. (JP 2.01.2, CI & HUMINT in Joint Operations,

11 Mar 2011)

-- Also, a step in the process of producing timely, accurate, and relevant assessments regarding the

actual and potential foreign intelligence and international terrorist threat to Department of Defense in

which the collected information is subjected to review to identify significant facts for subsequent

interpretation. (AR 381-20, Army CI Program, 25 May 2010)

DoD CI Analysis

High Level View…

CI ANALYSIS: The methodical process of examining

EO 12333

and evaluating information to determine the nature,

PDD 24 & PDD 75

function, interrelationships, personalities, and intent

ICDs 200, 203, 204, 205, 206 & 208

regarding the intelligence capabilities of foreign

DoDD O-5240.02, CI

Process

powers, international terrorists, and other entities.

DoDI 5240.18, CI Analysis

Policy

-- DoDD O-5240.02, DoD Counterintelligence (20 Dec 2007)

Decision

Makers

Strategy

National Security Strategy

National Intelligence Strategy

Nat’l Strategy Cbt Terrorism

Data

Event

National & DoD CI Strategies

NTIPA

• Timely

• Tailored

• Digestible

Requirements

• Clear

Clients

Formal…

Ad hoc Taskings / RFIs

Right information, in the right context,

e.g., Standing CI Collection Requirements

to the right user, at the right time…

enhancing national security

Data

Acquire & Ingest

Organize & Fuse

• CI Collection

• CI Investigations

• CI Operations

COP

• CI Functional Svcs

Analytical Process

Common Operating Picture

• Assimilate Information

• Analyze/Synthesize Info

(understand the meaning)

Create CI Knowledge

• Collaborate

Clear, digestible explanation with evidence

Supports 4 Core

• Apply Judgment

-- Assemble hypotheses

CI Mission Areas

-- Identify reasonable alternatives

• CI Support to Force Protection

-- Test against available evidence

• CI Support to RDA

-- Explore implications

• CI Support to DCIP

-- Structure argumentation

• Countering Espionage

-- Seek add’tl evidence to: confirm / reinforce / eliminate

-- Evaluate & Interpret

Mark L Reagan ~ 5 Jan 2004

UNCLASSIFIED

Revised / Updated 1 Dec 2011

See “Analysis - Synthesis Modeling Process” for next level drill down

Counterintelligence Analysis - the Queen of the Counterintelligence Chessboard

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Analysis - Collecting information is one thing.

Making sense of it and using it to frustrate and exploit foreign services is another.

-- Roy Godson, Dirty Tricks or Trump Cards: US Covert Action and Counterintelligence (1995), p. 81

CI Analysis… look at the details and see the passion

I can't possibly overstate the importance of good research. Everyone goes through life dropping

crumbs. If you can recognize the crumbs, you can trace a path all the way back from your death

certificate to the dinner and a movie that resulted in you in the first place. But research is an art, not

a science, because anyone who knows what they're doing can find the crumbs, the wheres, whats,

and whos. The art is in the whys: the ability to read between the crumbs, not to mix metaphors. For

every event, there is a cause and effect. For every crime, a motive. And for every motive, a

passion. The art of research is the ability to look at the details, and see the passion.

-- Daryl Zero, The Zero Effect (1998)

___________________________________

Analysis… often raises more questions than it answers. …remember of the basic principle: All

action, whether human or physical, disturbs the environment is some way. Find that disturbance

and you have a key to the action.

For analysis to play its proper CI role it must be able to survey all of the intelligence data available

to one’s own government, and it must be able to somehow direct the rest of CI.

-- Angelo Codevilla, Informing Statecraft: Intelligence for a New Century (1992), pp. 330-331

___________________________________

For a “snap shot” of CI analysis see Irvin D. Sugg, Jr., Basic Counterintelligence Analysis in a

Nutshell: Quick Reference Guide, Joint Counterintelligence Training Academy (JCITA), n.d.

Copy available at: <http://www.ntis.gov/search/product.aspx?ABBR=PB2010105593>

Counterintelligence Analysis and Production Council (CIAPC). The principal forum for coordinating CI

analysis and production requirements, discussing CI analysis and production priorities within the

enterprise, and discussing other IC issues. (DoDI 5240.18, CI Analysis & Production, 17 Nov 2009 with

change 1 dated 15 Oct 2013)

CIAPC Membership: The Director, Defense CI & HUMINT Center (DCHC), appoints the Chair.

Core membership includes the DCHC analysis and production enterprise manager and the

managers of the Defense CI Component analysis and production elements. The Chair may expand

membership, to include other full-time or permanent part-time Federal employees.

Counterintelligence Analysis and Production Element. The element within a Defense CI Component that

performs CI analysis in any form; produces a CI analytical product in any of the categories of CI analysis;

or responds to requests for CI analysis from an internal organization and/or from organizations external to

the Defense CI Component. (DoDI 5240.18, CI Analysis & Production, 17 Nov 2009)

Counterintelligence Analysis Centers. See ACIC, ICON, MTAC for DoD CI Analysis Centers. .

Counterintelligence Analysis Report. A document produced by a CI analysis and production element

stating the results of analysis regarding a relevant CI topic, event, situation, or development, and

containing the characteristics outlined in [DoDI 5240.18] Appendix 2 to Enclosure 3. (DoDI 5240.18, CI

Analysis & Production, 17 Nov 2009)

Counterintelligence Analytical Product. Any document that contains the work of, is supported by,

collaborated on, or produced by a CI analyst at any echelon within a Defense CI Component. It may

or may not include CI production. (DoDI 5240.18, CI Analysis & Production, 17 Nov 2009)

Objectives of CI analytical products are to: 1) Outline, describe, or illustrate the threat posed by an

Foreign Intelligence Entity (FIE) to installations, personnel, assets, operations, or resources; 2)

Identify opportunities to conduct offensive CI operations (OFCO) targeting a FIE; and 3) Identify CI

investigative opportunities.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

CI analytical products seek to satisfy a core CI production requirement to identify people,

organizations, locations, activities, and resources associated with a FIE or a target of a FIE.

Within DoD, CI analytical products are categorized based on the purpose of the product, analytical

effort, the production timeline, and other distinguishing characteristics. The primary categories of

CI analytical products are: 1) Assessment, 2) Analysis Report, 3) Threat Advisory, and 4)

Functional Support. Associated analytical products with CI collections, investigations and

operations are summarized below.

-- Analytical products associated with CI collections are:

Collection Support Brief. Provides near-comprehensive background detail on a collection issue to

guide and enhance collection efforts. (DoDI 5240.18, 17 Nov 2009)

Collection Source Evaluation. An evaluation of a source to determine if the information provided is

valuable and credible and to ascertain the reliability and veracity of the source. (DoDI 5240.18,

17 Nov 2009)

Collection Emphasis. Supplements a standing collection requirement and identifies areas of

emphasis or information gaps to the CI collector. (DoDI 5240.18, 17 Nov 2009)

Source-Directed Requirement. Established by a CI analysts based on knowledge of a source’s

access and placement to necessary information. (DoDI 5240.18, 17 Nov 2009)

IIR Evaluation. An analyst’s evaluation of how well an IIR satisfied the intelligence requirement for

which it was collected. (DoDI 5240.18, 17 Nov 2009)

-- Analytical products associated with CI investigations are:

Investigative Analysis Report. An evaluation of all available information obtained during a CI inquiry

to determine if an investigation is warranted; an evaluation of an on-going CI investigation to develop

leads, identify trends, patterns, or anomalies in furtherance of the investigative effort; or produced at

the conclusion of a CI investigation to identify previously unknown methods of operation, describe

lessons learned, and to support damage assessments when initiated. (DoDI 5240.18, 17 Nov 2009)

Investigative Source Evaluation. An evaluation of a source to determine if the information provided is

valuable and credible, and to ascertain the reliability and veracity of the source. (DoDI 5240.18, 17

Nov 2009)

Investigative Support Package. An evaluation of all available information pertaining to an unknown

subject CI inquiry or investigation in an effort to identify a person, place, or thing of CI interest based

on analysis of the information. (DoDI 5240.18, 17 Nov 2009)

-- Analytical products associated with CI operations are:

Operational Analysis Report. An evaluation of information from a variety of sources to determine if

favorable conditions are present for initiation of a CI operation and the report may offer suggestions

as to the type of asset and/or the access and placement required to meet the foreign essential

elements of information requirements. (DoDI 5240.18, 17 Nov 2009)

Operational Asset Evaluation. Evaluates an asset’s reliability and veracity in a CI operation.

(DoDI 5240.18, 17 Nov 2009)

Operational Support Package. Comprehensive analysis of all available intelligence on a target of

interest to a Defense CI Component or determined to be of interest to DoD CI. It details the

significance of the target, relates it to strategic objectives, identifies desired effects, and suggests

methods of engagement to achieve desired results. (DoDI 5240.18, 17 Nov 2009)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterintelligence Assessment. A document produced by a CI analysis and production element stating

the in-depth and comprehensive results of analysis regarding a relevant CI topic, event, situation, or

development, and contains the characteristics outlined in [DoDI 5140.18] Appendix 2 to Enclosure 3.

(DoDI 5140.18, CI Analysis & Production, 17 Nov 2009)

-- Also, an analysis of the actual or potential foreign intelligence and international terrorist threat to

DoD, with the objective of protecting personnel, plans, information. Research and technology, critical

infrastructure, and other national security interests. (AR 381-20, Army CI Program, 25 May 2010)

-- Also, a DoD Component’s comprehensive analysis or study of a relevant CI topic, event,

situation, issue, or development. When conducted in support of an RDA program with CPI

[Critical Program Information], the assessment describes the threat a foreign entity (person,

representative, corporation, government, military, commercial, etc.) represents to the CPI/system

assessed. (DoDI 5200.39, CPI Protection within DoD, 16 Jul 2008, w/ change 1 dated 28 Dec

2010)

The CI assessment is multidisciplinary as it includes an analysis of the diverse foreign

collection modalities available, the relative effectiveness of each, and capability of the foreign entity

to collect information about research efforts, the technology, and/or system under development.

The assessment may include the impact to the DoD if the technology is compromised and be

complimentary to, integrated with, or independent of the TTRA provided by the Defense

Intelligence Community.

-- DoDI 5200.39, CPI Protection within DoD, 16 Jul 2008, w/ chg 1 dated 28 Dec 2010

Counterintelligence Awareness. An individual’s level of comprehension as to the FIE [foreign intelligence

entity] threat, methods, indicators, and reporting requirements. (DoDD 5240.06, CIAR, 17 May 2011 with

change 1 dated 30 May 2013)

-- Also, a state of being aware of the sensitivity of classified information one possesses, collaterally

aware of the many modes of operation of hostile intelligence persons and others whose interests are

inimical to the United States while being able to recognize attempts to compromise one’s information, and

the actions one should take, when one suspects he has been approached, to impart the necessary facts

to trained counterintelligence personnel. (DoD 5220.22.22-M-Sup 1, NISPOM Supplement, Feb 1995)

Counterintelligence Awareness Products. A DoD Component’s analysis of a CI topic, event, situation,

issue, or development. These products differ from an assessment in that they are often time sensitive, are

published as needed or annually, and normally do not require extensive research to produce. Products of

this nature ensure a consistent flow of appropriately classified or categorized threat information is

available to the community to increase awareness and action as appropriate. The Defense Security

Service “Technology Collection Trends in Defense Industry” and the Office of the National

Counterintelligence Executive “Annual Report to Congress on Foreign Economic Espionage” are

examples of products meeting this objective. (DoDI 5200.39, CPI Protection within DoD, 16 Jul 2008, w/

chg 1 dated 28 Dec 2010)

Counterintelligence Campaign (CI Campaign). See DoD Counterintelligence Campaign.

Counterintelligence Collection. The systematic acquisition of intelligence information to answer CI

collection requirements. (DoDI S-5140.17, CI Collection Activities, 14 Mar 2014) Also see

Counterintelligence Collection Activities; Military Counterintelligence Collection.

See “Counterintelligence Collection Methods” addressed in Appendix C, Joint Publication 2-01.2,

Counterintelligence and Human Intelligence in Joint Operations (U), 16 Mar 2011 w/ chg 1 dated

26 Aug 2011.

Director DIA is the Defense CI Collection Manager.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, the systematic acquisition of information (through investigations, operations, or liaison)

concerning espionage, sabotage, terrorism, other intelligence activities or assassinations conducted by or

on behalf of foreign governments or elements thereof, foreign organizations, or foreign persons that are

directed against or threaten Department of Defense interests. (JP 1-02 and JP 2-01.2, CI & HUMINT in

Joint Operations (U),16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

UNCLASSIFIED

CI Function: CI Collection…

Obtaining information about foreign intelligence entities, other

CI Collection

clandestine & covert threats, as well as international terrorists

groups/networks

Counterintelligence Collection: The systematic acquisition of

intelligence information to answer CI collection requirements.

-- DoDI S-5140.17, Counterintelligence Collection (U), 12 Jan 2009

CI Collection activities are designed to collect specific information or develop

leads concerning adversary intelligence collection requirements, capabilities,

efforts, operations, structure, personalities, and methods of operations

CI Collection can result from ongoing CI investigations or operations or serve

to initiate CI investigations and/or operations

Types of CI Collection within DoD include:

• Military Counterintelligence Collection (MCC)

• CI Interviews & Debriefings…

including Debriefing of Enemy POWs, Displaced Persons & Refugees

• Liaison

• Open Source & Media Exploitation

• CI Collection in the Cyberspace Domain

CI Collection feeds analysis… which in turn informs decision makers, drives additional

collections, enhances investigative activity, shapes operations, and enables mission execution

See DoDI S-5240.17, (U) CI Collection Activities, 14 Mar 2014 for DoD policy and additional

information.

Counterintelligence Collection Activities (CCA): CI collection activities to include military CI collection, CI

questioning of EPWs and detainees, CI debriefings, liaison, open source and media exploitation, and CI

collection in cyberspace. (DoDI S-5140.17, CI Collection Activities, 14 Mar 2014) Also see

Counterintelligence Collection; Military Counterintelligence Collection.

Counterintelligence Collection in Cyberspace. The use of cyber means as the primary tradecraft

methodology to engage in targeting and collecting cyber based FIE [Foreign Intelligence Entity] activities.

CI Collection in cyberspace may include the use of authorized non-attributable Internet connections,

development and use of national cyber personas, use of authorized obfuscation techniques, as well as

appropriate digital tradecraft and cover. (DoDI S-5240.23, CI Activities in Cyberspace (U), 13 Dec 2010

with change 1 dated 16 Oct 2013)

Counterintelligence Collection Operations. Intelligence collection operations that use human sources and

CI resources to answer validated CI requirements. CI collection operations are deliberate, planned

activities primarily using human sources to satisfy one or more validated CI information requirements.

(DoD CI Collection Integrated Working Group Handbook 1-02, 8 Aug 2006)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterintelligence Controlled Source Operation (CI CSO). A type of offensive counterintelligence

operation (OFCO); see DoDI S-5240.09, OFCO, 29 Oct 2008 for detailed information.

Counterintelligence Coordinating Authority (CICA). A designated CI representative in country, the CICA

coordinates, deconflicts, and/or synchronizes all joint CI issues in the country with the Service CI

elements assigned to or operating within that country, and with the US embassy or consulate. (JP 2-01.2,

CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011) Also see Command

Counterintelligence Coordinating Authority (CCICA).

Counterintelligence Cyber Investigation. An investigation using techniques that identify and interdict the

misuse of DoD information systems by a trusted insider or an external intruder. These investigations may

involve computer intrusions, exceeding authorized network access, denial of service attacks, or the

introduction of a virus or a malicious code. (Previously defined in DoDI 5240.19, CI Support to the

Defense Critical Infrastructure Program, 27 Aug 2007 with change 1 dated 28 Dec 2010)

Counterintelligence Effects-Based Operations (CI EBO). As applied to counterintelligence, effects-based

operations is a process for obtaining a desired strategic outcome of effect on adversary intelligence

activities through the synergistic, multiplicative, and cumulative application of the full range of CI

capabilities at the tactical, operational and strategic levels, to include leveraging non-CI capabilities.

Successful CI effects-based operations rest on an explicit linking of CI actions to desired strategic

outcomes. CI effects-based operations proactively shape the battlespace in our war against adversary

intelligence activities and terrorist networks through the robust execution of full-spectrum CI capabilities

across the entire spectrum of conflict in an orchestrated and synchronized manner to achieve national,

departmental, and combatant commander objectives. (COL Mark L. Reagan, USA Ret)

Counterintelligence Enhancement Act of 2002. The act facilitates enhancement of US counterintelligence

activities by: (1) enabling the counterintelligence community of the US Government to fulfill better its

mission of identifying, assessing, prioritizing, and countering the intelligence threats to the United States;

(2) ensuring that the counterintelligence community of the US Government acts in an efficient and

effective manner; and (3) providing for the integration of all the US CI activities. The act also established

the National Counterintelligence Executive (NCIX), the National CI Policy Board and the Office of the

National CI Executive (ONCIX) which replaced the National Counterintelligence Center (NACIC).

(§§ 901-904 PL 107-306)

The act is available at <http://www.ncix.gov/publications/law/index.html>

Counterintelligence Equity. Facts or circumstances connecting an incident, event, or person to an actual

or potential intelligence or terrorist threat to Army or DoD personnel, programs, plans, operations,

installations, systems, technology, or security. (AR 381-20, Army CI Program, 25 May 2010)

Counterintelligence Flags. Indicators that should alert a source handler to suspicious action that may

bring the source’s bona fides into question. (DoDI S-3325.07, Guidance for the Conduct of DoD Human

Source Validation (U), 22 Jun 2009.)

“CI Flags” are different from reportable CI indicators and behaviors as addressed in DoD Directive

5240.06,CI Awareness and Reporting (CAIR, 17 May 2011 w/ chg 1 dated 30 May 2013; see

potential espionage indicators.

Counterintelligence Force Protection Detachment. See Force Protection Detachment (FPD).

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterintelligence Force Protection Source Operations (CFSO). Overt source collection activities of an

expedient nature intended to identify threats to the command in support of the commander’s force

protection mission. (Marine Corps Doctrinal Publication 2-6 [previously 2-14], Counterintelligence, 5 Sep

2000, p. 2-3)

Counterintelligence Functions. The five functions of counterintelligence: operations, investigations,

collection, analysis & production, and functional services. (JP 1-02) Also see CI Activities.

CI functions are interrelated, mutually supporting, and can be derived from one another.

Functions vs. Missions: “Functions differ from CI missions in that missions focus on end results to

be accomplished, rather than on the means for accomplishment. “

-- Mission Area Analysis of DoD Counterintelligence, Institute for Defense Analyses, May 1999, p.7

CI functions are useful terms of reference to describe “what is done”

CI missions focus on the “end result” to be accomplished

CI Functions

Catching traitors who spy for foreign intelligence, or assist

Investigations

international terrorists, or commit other national security crimes

Wide range of actions to hinder, frustrate, and exploit foreign

Operations

intelligence efforts and other foreign clandestine & covert

activities damaging to US national security

Obtaining information about foreign intelligence entities, other

Collection

clandestine & covert threats, as well as international terrorists

groups/networks

Assimilating, evaluating, interpreting, and disseminating

Analysis & Production

information of CI relevancy - a critical enabler providing

insights into clandestine & covert threats

CI activities that support other intelligence or operational

activities, including specialized defensive CI services such as

CI Functional Services

TSCM, polygraph/credibility assessment services, behavioral

science support, cyber services (digital forensics, etc.)

Mark L Reagan - 13 Mar 2006

UNCLASSIFIED

Counterintelligence Functional Services (CIFS). CI activities that support other intelligence or DoD

operations by providing specialized defensive CI services to identify and counter the intelligence

capabilities and activities of terrorists, foreign powers, and other entities directed against US national

security. (DoDD O-5240.02, Counterintelligence, 20 Dec 2007 with change 1 dated 30 Dec 2010)

-- Also, activities engaged in by personnel trained in CI and conducted to detect espionage, sabotage,

terrorism, or related intelligence activities of an FIE directed against the DoD, and that enable one or

more of the CI functions (investigations, collection, operations, or analysis and production).

(DoDI O-5240.24, CI Activities Supporting RDA, 8 Jun 2011 with change 1 dated 15 Oct 2013)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, CI activities that support other intelligence or DoD operational activities, providing specialized

defensive CI services to identify and counter terrorism, espionage, sabotage, and related activities of

Foreign Intelligence Entities. (JP 2.01.2, CI & HUMINT in Joint Operations, 11 Mar 2011)

For DoD Policy see DoD Instruction, Counterintelligence Functional Services (CIFS), 27 Aug 2012.

For more in-depth information regarding CI functional services see Department of Defense, CI

Functional Services Integrated Working Group Handbook, Doctrine, Tactics, Techniques, and

Procedures for Counterintelligence Functional Services, 19 Feb 2009. This handbook further

defines CI functional services as: those activities that are not unique to other CI functions and that

support other CI functions and missions; specialized services, which are not inherently CI but

support the CI mission and functions.

Within DoD, CI functional services consist of basic CI activities (including espionage detection and

CI support to military operations) and specialized services (e.g., polygraph/credibility assessments,

TSCM, behavioral science support, cyber services).

Counterintelligence Functional Support Plan (CI FSP). Director Defense CI and HUMINT Center is

responsible for preparation of CI FSPs as part of the Intelligence Planning process (CJCSM 3314.01).

Format for CI FSPS is provided at enclosure E to CJCSM 3314.01, Intelligence Planning, 28 Feb 2008.

Counterintelligence Inquiry. An examination of the facts surrounding an incident of potential CI interest,

to determine if a CI investigation is necessary. (DoDD 5240.02, CI, 20 Dec 2007 with change 1 dated 30

Dec 2010) Also see counterintelligence investigation.

For information regarding CI inquiries within DoD see: 1) DoDI O-5240.21, CI Inquires, 14 May

2009, which provides DoD policy and outlines the procedures for initiating and conducting CI

Inquires; and 2) DoD, CI Functional Services Integrated Working Group Handbook, Doctrine,

Tactics, Techniques, and Procedures for Counterintelligence Functional Services (U), 19 Feb 2009.

According to the DoD handbook on CI functional services, “[w]ithin DoD a CI inquiry does not

require “investigative authority” as it is not a CI investigation.” A CI inquiry is designed to gather

information, identify and/or verify the credibility of potential sources and subjects(s) of CI interest,

and to recommend appropriate action if the inquiry does not resolve the matter. The goal is to

establish or refute a reasonable belief that a particular person is acting for or on behalf of, or an

event is related to, a foreign power engaged is spying, or committing espionage, sabotage, or

other national security crimes (e.g., treason), or international terrorist activities. Establishment

of reasonable belief provides the basis for opening a CI investigation. Once a reasonable belief is

established the matter must be referred to the appropriate Military Department CI organization

and/or the FBI [see Section 811 referral]. Refer to the definition of reasonable belief.

The DoD handbook stresses that “[w]ithin DoD, only Military Department CI organizations have CI

investigative authority and may, accordingly, use the intrusive techniques provided for in

Procedures 5 through 13 of DoD 5240.1-R…. It is absolutely vital that CI personnel obtain

guidance from their own organization’s legal counsel as to what specific investigative techniques

and activities are allowable in their organization and approval from their organization’s leadership

to employ those techniques in the course of CI activity.”

A CI Inquiry is not a CI investigation, but it can provide the basis for a CI investigation.

Counterintelligence Insider Threat (CI InT). A person who uses their authorized access to DoD facilities,

systems, equipment, information or infrastructure to damage, disrupt operations, compromise DoD

information or commit espionage on behalf of an FIE [Foreign Intelligence Entity]. (DoDD 5240.06, CIAR,

17 May 2011 with change 1 dated 30 May 2013)

-- Also, a person, known or suspected, who uses their authorized access to DoD facilities, personnel,

systems, equipment, information, or infrastructure to damage and disrupt operations, compromise DoD

information, or commit espionage on behalf of an FIE [foreign intelligence entity]. (DoDI 5240.26,

Countering Espionage, International Terrorism, and Counterintelligence Insider Threat, 4 May 2012 with

change 1 dated 15 Oct 2013) Also see insider, insider threat.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

CI is one critical component in countering “insider threats,” the other components are security,

information assurance (IA), law enforcement, and antiterrorism/force protection.

CI Insider Threat Program Elements:

-- CI Analysis of Information Technology Auditing & Monitoring

-- CI Insider Threat Awareness & Training

-- Foreign Travel and Contact Reporting and Analysis

-- Polygraph & Credibility Assessment

-- Personnel Security, Evaluation, Analysis, and Reporting

-- Security Incident Reporting & Evaluation

-- Proactive CI Initiatives

For additional information see DoDI 5240.26, Countering Espionage, International Terrorism, and

Counterintelligence Insider Threat, 4 May 2012

________________________

Insider threat detection should be a comprehensive US Government (USG) effort dedicated to

countering potential threats and mitigating damage that could result from unauthorized disclosure

of information, espionage, terrorism, and other national security crimes.

-- U.S. Government Threat Detection Guide - 2011

Counterintelligence Investigation. Formal investigative activities undertaken to determine whether a

particular person is acting for or on behalf of, or an event is related to, a foreign power engaged in spying

or committing espionage, sabotage, treason, sedition, subversion, assassinations, or international

terrorist activities, and to determine actions required to neutralize such acts. (DoDI 5240.04, CI

Investigations, 4 Feb 2009 with change 1 dated 15 Oct 2013) Also see counterintelligence inquiry,

investigation.

UNCLASSIFIED

CI Function: CI Investigations…

Investigating national security threats… includes catching

Investigations

traitors who spy for foreign intelligence, or assist international

terrorists, or commit other national security crimes

▪ Espionage ▪ Spying

▪ Treason

▪ Sedition

▪ Subversion

▪ Aiding the Enemy by providing intelligence to the enemy

National Security Crimes

▪ International Terrorist Activities or material support to

& related activities

▪ Unreported contact with foreign intelligence entities or ITOs

▪ Unauthorized disclosure of classified information/material

FBI

DoD

Army

Assessments

CI Inquiry

Limited CI Assessments

Preliminary Investigation

Preliminary CI Investigation

CI Investigation

Full Investigation

Full Field CI Investigation

-- FBI Domestic Investigations &

-- DoDI O-5240.21, CI Inquires,

-- AR 381-20, Army CI Program (U),

Operations Guide, 15 Oct 2011

14 May 2009

25 May 2010

-- DoDI 5240.04, CI Investigations,

2 Feb 2009

By far the hardest part of any CI case is to realize that the case exists—

that some person, some thing, has the enemy’s hidden hand in it.

-- Angelo Codevilla, Informing Statecraft: Intelligence for a New Century (1992), p. 326

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

CI investigations are undertaken to determine whether a particular person is acting for or on

behalf of a foreign power or international terrorist organization or whether an event is related to

foreign intelligence or international terrorism.

CI investigations focus on resolving allegations of known or suspected acts that may constitute

national security crimes under U.S. law or Uniform Code of Military Justice.

The agencies responsible for the investigation and ultimate referral for prosecution of violations

of US espionage law (primarily Sections 792-798, Chap 37 of Title 18) are the FBI and the CI

components of the military services that participate in the DoD Foreign CI Program (FCIP).

DoD Policy: The Secretaries of the Military Departments exercise authority, direction, and

control over CI investigations and attendant matters for their respective personnel.

-- Para 5.10.3, DoDD O-5240.02, Counterintelligence, 20 Dec 2007 w/ chg 1 dated 30 Dec 2010

CI investigations are conducted following appropriate legal standards and in a manner which will

not jeopardize the potential for prosecution.

Within DoD, DIA’s Office of Counterintelligence (DXC) exercises administrative and management

oversight of all DoD national security investigations. All significant CI activities must be reported

promptly to the DXC IAW DoDD O-5240.02 (see encl 4 for significant CI reporting criteria).

-- Also, inquiries and other activities undertaken to determine whether a particular person is acting

for or on behalf of, or an event is related to, a foreign power for espionage, treason, spying, sedition,

subversion, sabotage, assassinations, international terrorist activities, and actions to neutralize such acts.

(DoDD O-5240.02, Counterintelligence, 20 Dec 2007 with change 1 dated 30 Dec 2010)

-- Also, includes inquiries and other activities undertaken to determine whether a particular United

States person is acting for, or on behalf of, a foreign power for the purposes of conducting espionage and

other intelligence activities, sabotage, assassinations, treason, international terrorist activities, and

actions to neutralize such acts. (DoD 5240.1-R, Procedures Governing the Activities of DoD Intelligence

Components that Affect United States Persons, 7 Dec 1982)

-- Also, an official, systematic search for facts to determine whether a person(s) is engaged in

activities that may be injurious to U.S. national security or advantageous to a foreign power. (JP 1-02 and

JP 2.01.2, CI & HUMINT in Joint Operations,11 Mar 2011 w/ chg 1, dated 26 Aug 2011)

-- Also, the systematic collection of information regarding a person or group which is, or may be,

engaged in espionage or other clandestine intelligence activity, sabotage, or international terrorist

activities conducted for, or on behalf of, foreign powers, organizations, or persons. (CI Community

Lexicon)

The first priority for all CI investigative situations is to assess for possible exploitation.

-- Army FM 2-22.2, Counterintelligence, October 2009

CI investigations focus on resolving allegations of known or suspected acts that may constitute

national security crimes under U.S. law or Uniform Code of Military Justice (UCMJ). Investigative

actions must preserve the potential for legal action and when appropriate exploit threatening

intelligence collection directed against DoD. In simple terms, CI investigations seek to identify

spies and put them out of business. CI investigations are about discovering the facts and

conveying them to decision makers, while maintaining a full range of options, including

apprehension, prosecution, expulsion, as well as exploitation.

__________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

“The ultimate objective of… [DoD] CI investigations… is to detect, identify, exploit and neutralize the

intelligence collection threat posed by foreign intelligence and security services and foreign

terrorist groups. […] The most significant objectives of CI investigations are to minimize or prevent

the loss of sensitive and classified defense information to foreign governments, and to prevent,

preempt, or disrupt foreign terrorist attacks against… DoD interests”

-- 902d MI Group Investigations Handbook, Jun 2012, p.19

___________________

“CI investigation is an art form carried out by experts. It is not science, and throwing money and

unqualified personnel or helpers at such s problem does not guarantee or even improve the

chances of success. In many cases, quite the opposite results is achieved—analytical chaos with

no resolution.”

-- Sandra Grimes and Jeanne Vertefeuille, Circle of Treason: A CIA Account of Traitor Aldrich Ames and

the Men He Betrayed, 2012, p. 189

___________________

Credentialed CI Special Agents use specialized investigative techniques and methodologies to

gather intelligence (facts/evidence) about known and/or suspected acts that may constitute

National Security crimes, e.g., espionage, treason, spying, etc. All investigative activities are

conducted within guidelines established in applicable departmental policy/directives, Attorney

General Guidelines, and U.S. federal statutes.

DoD CI investigations are conducted in a manner to “preserve” the potential for prosecution of all

culpable parties identified. Although all national security investigations are conducted in a manner

to preserve the potential for prosecution, this purpose is secondary to the CI mission of detecting,

identifying, fully determining the extent of, and neutralizing/disrupting national security threats to

the DoD and U.S. national security.

CI investigative results also contribute to the identification and elimination of security vulnerabilities;

identification of current foreign intelligence tradecraft, agent handlers/operatives and their support

networks; assessment of damage to DoD and National Security; and improvement of the overall

DoD security posture, as well as assisting decision makers in risk management decisions.

DoD CI investigations are conducted in accordance with DoDI 5240.04, CI Investigations. The

DoD agencies responsible for CI investigations and the ultimate referral for prosecution of

violations of US espionage law (primarily §§ 792-798, Chap 37, Title 18 USC) are the CI

components of the military departments, i.e., NCIS, AFOSI, and Army CI.

See Stuart A. Herrington, Traitors among Us: Inside the Spy Catcher's World (1999), for an

excellent unclassified overview of two CI investigations concerning Clyde Conrad and James Hall.

Other interesting reads on CI investigative cases include -

-- Scott W. Carmichael, True Believer: Inside the Investigation and Capture of Ana Montes,

Cuba’s Master Spy (2007)

-- Sandra Grimes and Jeanne Vertefeuille, Circle of Treason: A CIA Account of Traitor Aldrich

Ames and the Men He Betrayed (2012).

Spy catching… the surgery of counterintelligence

The thankless and exhausting task of tracking down

a traitor always seems much easier in retrospect than in prospect.

The clues always seem so obvious—but only after the hunt has caught its prey.

-- Markus Wolf, Former Director HVA, East German Intelligence Service (1958-1987)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterintelligence Investigative Source Operation. See Investigative Source Operation (ISO).

Counterintelligence Mission. Exploit and defeat adversarial intelligence activities directed against US

interests; protect the integrity of the US intelligence system; provide incisive, actionable intelligence to

decision makers at all levels; protect vital national assets from adversarial intelligence activities; and

neutralize and exploit adversarial intelligence activities targeting the armed forces. (ONCIX website:

<http://www.ncix.gov/about/mission.html>)

Counterintelligence Missions. DoD CI responsibilities to support force protection; research, development,

and acquisition; defense critical infrastructure; and countering espionage. (DoDD 5240.16, DoD CI

Functional Services, 27 Aug 2012 with change 1 dated 15 Oct 2013)

CI Missions vs. CI Functions

“Functions differ from CI missions in that missions focus on end results to be accomplished, rather

than on the means for accomplishment.“

-- Mission Area Analysis of DoD Counterintelligence, Institute for Defense Analyses, May 1999, p.7

Missions focus on the “end result” to be accomplished

Functions are useful terms of reference to describe “what is done”

DoD Counterintelligence Missions

+ Countering Espionage

+ Counterintelligence Support to Force Protection (FP)

+ Counterintelligence Support to Research, Development, and Acquisition (RDA)

+ Counterintelligence Support to Defense Critical Infrastructure (DCI)

________________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Note: The Army identified four primary CI mission areas in FM 2-22.2 as:

+ Counterespionage

+ CI Support to Force Protection

+ CI Support to Research, Development, and Acquisition

+ Cyber CI

See Army FM 2-22.2, Counterintelligence, Oct 2009 and ADRP 2-0, Intelligence, Aug 2012

Counterintelligence Mission Manager. The National Counterintelligence Executive (NCIX) serves as

the Mission Manager for Counterintelligence IAW Intelligence Community Directive (ICD) 900. Also

see mission managers.

Counterintelligence Mission Tasking Authority (CI MTA). The authority to task a Military Service CI

organizations’ headquarters or a Defense Agency’s organic CI element to execute a specific CI mission

or conduct a CI function within that organization’s CI charter. (DoDD O-5240.02, CI, 20 Dec 2007)

Director, Defense CI & HUMINT Center, exercises CI MTA to ensure the effective integration and

synchronization of the DoD CI community (para 5.2.3, DoDD O-5240.02).

Counterintelligence Operational Concept/Proposal. The document used to propose an offensive

counterintelligence operation (OFCO) which serves as the basis for the planning, review, and approval

process. (AR 381-20, Army CI Program, 25 May 2010)

Counterintelligence Operational Leads (CIOLs). Interagency CI referrals from CIA operations; generally

produced and disseminated by the Counterespionage Group (CEG), Counterintelligence Center (CIC) at

CIA headquarters. (902d MI Group Investigative Handbook, Jun 2012 2007, p.62)

Counterintelligence Operational Tasking Authority (CIOTA). The levying of CI requirements specific to

joint military activities and operations. Counterintelligence operational tasking authority is exercised

through supporting components. (JP 1-02)

Term previously in DoDI 5240.10, dated 14 May 2004 and JP 2-01.2, dated 13 Jun 2006.

Counterintelligence Operations. Proactive activities designed to identify, exploit, neutralize, or deter

foreign intelligence collection and terrorist activities directed against the United States. (JP 1-02 and

JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011) Also see

Offensive Counterintelligence Operation (OFCO); recruitment-in-place (RIP); penetration; penetration

operation.

-- Also, operations/efforts intended to negate, confuse, deceive, subvert, monitor, or control the

clandestine collection operations of foreign governments or agencies. (CI Community Lexicon)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

UNCLASSIFIED

CI Function: CI Operations…

Wide range of actions to hinder, frustrate, and exploit foreign

Operations

intelligence efforts and other foreign clandestine & covert

activities damaging to US national security

Counterintelligence operations consist of obtaining and analyzing

information on the adversary and then using it against him in

accordance with the requirements of the situation and in light of

our knowledge of his practices and psychological outlook.

An ideal counterintelligence system anticipates the enemy’s move, notionally

satisfies his needs, and indeed operates a notional intelligence service for him.

-- Eric W. Timm in “Countersabotage—A Counterintelligence Function, CIA Studies in Intelligence, V7: 2 (Spring 1963), pg. 67

Counterintelligence Operations—one of five CI functions—are conducted to:

-- manipulate, disrupt, neutralize and or destroy the effectiveness of foreign intelligence activities;

-- recruit or induce defection of foreign intelligence officers and personnel;

-- collect threat information on foreign intelligence operations, modus operandi, intelligence

requirements, targeting, objectives, personalities, communications, capabilities, limitations,

and vulnerabilities;

-- provide information and operations databases to support decision makers;

-- provide CI support to clandestine human intelligence operations;

-- identify past, ongoing or planned espionage;

-- support force protection, operations other than war and peacekeeping;

-- acquire foreign intelligence espionage equipment for analysis and

countermeasures development;

-- develop operational data, threat data and espionage leads for future CI operations,

investigations, and projects and develop the potential of these leads to enhance

DoD security overall; and

-- support specific [Service], Chairman Joint Chiefs of Staff, DoD and national plans.

Source: JP 1-02 and SEVNAVINST 3850.2C, Department of Navy Counterintelligence, 20 Jul 2005

Counterintelligence Production. The process of analyzing all-source information concerning espionage or

other multidiscipline intelligence collection threats, sabotage, terrorism, and other related threats to US

military commanders, the DoD, and the US Intelligence Community and developing it into a final product

that is disseminated. Counterintelligence production is used in formulating security policy, plans, and

operations. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26

Aug 2011)

-- Also, the creation of finished intelligence products incorporating CI analysis in to known or

anticipated CI concerns. (DoDD 5240.02, CI, 20 Dec 2007 with change 1 dated 30 Dec 2010)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, the creation of finished intelligence products incorporating CI analysis in response to known

or anticipated customer CI concerns. (JP 2.01.2, CI & HUMINT in Joint Operations, 11 Mar 2011)

-- Also, the conversion of analyzed CI information into intelligence products in support of known or

anticipated user requirements. (DIA Instruction 5240.002, DIA CI Activities, 15 Jun 2005)

Counterintelligence Programs. Capabilities and activities established within an organization for the

purposes of identifying, deceiving, exploiting, disrupting, or protecting against espionage, other

intelligence activities, sabotage, or assassinations conducted for or on behalf of FIEs [Foreign Intelligence

Entities]. (ICD 750, Counterintelligence Programs, 5 Jul 2013)

Counterintelligence Recruitment Lead (CIRL). An individual being assessed for possible use in a

counterintelligence operation, investigation, or project as a controlled source. (AR 381-47, Offensive

Counterintelligence Operations, 17 Mar 2006)

Counterintelligence-scope Polygraph (CSP). A screening polygraph examination that uses relevant

questions limited to prescribed CI issues. (DoDI 5210.91, PCA Procedures, 12 Aug 2010 with change 1

dated 15 Oct 2013)

Counterintelligence Screening. A systematic process for obtaining information of CI interest from a

specific person or target audience. (FM 2-22.2, Counterintelligence, Oct 2009)

CI screening normally is non-confrontational - it is NOT an interrogation. See Chapter 4,

CI Collection Program of FM 2-22.2, Counterintelligence, Oct 2009 (page 4-5 through 4-7).

CI screening should not use any of the “interrogation methods” defined in FM 2-22.3, Human

Intelligence Collector Operations.

Counterintelligence Special Agent. Within DoD, US Government personnel (military and civilian

employees) who have successfully completed an approved Counterintelligence Special Agent course of

instruction, who are authorized to be issued CI Badge and Credentials (B&Cs), and who are assigned to

conduct CI investigations and/or operations. .

Within the US Army: military personnel holding the military occupational specialty (MOS) 35L,

351L, or 35E as a primary or additional specialty, and selective civilian employees in the GS-0132

career field; see AR 381-20, Army CI Program (U).

Counterintelligence Special Operations Concept (CISOC). The document used to propose a defensive

counterintelligence operation, special investigative activity. Or counterintelligence source operation which

serves as the basis for the planning, review, and approval process. (AR 381-20, Army CI Program, 25

May 2010)

Counterintelligence Staff Officer (CISO). This term replaced by “Command CI Coordinating Authority” or

CCICA; see DoDI 5240.10, CI in the Combatant Commands and Other DoD Components, 5 Oct 2011.

Counterintelligence Support. Conducting counterintelligence activities to protect against espionage and

other foreign intelligence activities, sabotage, international terrorist activities, or assassinations conducted

for or on behalf of foreign powers, organizations, or persons. (JP 1-02 and JP 2-01.2, CI & HUMINT in

Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011) Also see counterintelligence.

-- Also, the application of knowledge regarding the foreign intelligence and international terrorist

threat to assist commanders, program managers, and agency heads to identify the insider threat and to

protect information or technology vital to the national defense, including the force, technology, critical

infrastructure, and information systems. (AR 381-20, Army CI Program, 25 May 2010)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterintelligence Support Plan (CISP). A formal and living plan describing activities conducted by a

Defense CI Component in support of a DoD RDA [Research, Development and Acquisition] program or

activity with CPI [critical program information], at DoD-affiliated RDT&E facilities, and at essential CDCs

[cleared defense contractor] where CPI resides. (DoDI O-5240.24, CI Activities Supporting RDA, 8 Jun

2011 with change 1 dated 15 Oct 2013)

-- Also, a formal plan that outlines and describes the CI support to be provided to research and

development facilities, RDA [Research, Development and Acquisition] programs with CPI [critical program

information], and CPI resident at cleared Defense contractor facilities. CISPs are coordinated with and

approved by the RDA Director, Program Executive Office, or Program Manager, as appropriate, and are

an appendix to the PPP. (DoDI 5200.39, CPI Protection within DoD, 16 Jul 2008, with change 1 dated 28

Dec 2010)

Defense CI Components use a CISP to integrate CI activities into RDA, manage, and document

non-investigative or non-operational activities conducted. See Appendix 2 to Encl 3 of DoD

Instruction O-5240.24, CI Activities Supporting RDA, 8 June 2001 (pp. 22-23) for specifics to

include elements of a CISP.

_________________________

Note: A CISP takes precedence over a DCIP CI Coverage Plan at supported locations where a

CISP is required in accordance with DoD Instruction 5240.24, Counterintelligence Activities

Supporting RDA.

Counterintelligence Support to HUMINT. [CI activities which] prevents the detection, neutralization or

manipulation of strategic U.S. DoD HUMINT collection activities by foreign intelligence or security

servives. (DIA Instruction 5240.002, DIA Counterintelligence Activities, 15 Jun 2005)

For additional information see Appendix D, Counterintelligence Support to Human Intelligence (U),

JP 2-01.2, CI & HUMINT in Joint Operations (U), 16 Mar 2011 with chg 1 dated 26 Aug 2011

Counterintelligence Targets. CI targets include personalities, organizations, and installations

(PO&I) of intelligence or CI interest, which must be seized, exploited, neutralized or protected. Also see

Black List, Gray List, White List. (USMC, MCWP 2-6 [previously 2-14], Counterintelligence, 5 Sep 2000)

Counterintelligence Technical Services (CITS). Encompasses Technical Surveillance Countermeasures

(TSCM) and Technical Support to Counterintelligence (TSCI). TSCM is used to detect the presence of

technical surveillance devices and hazards and to identify technical security vulnerabilities that put the

surveyed facility at risk. TSCI provides technical surveillance and countersurveillance in support of CI

activities. Also see Technical Surveillance Countermeasures.

Counterintelligence Threat (CI Threat). The capability and intent of one entity to detect and counteract

another’s intelligence activities - the objective is to undermine the effectiveness of opposing intelligence

activities.

To date, the term “CI Threat” remains undefined officially by DoD or IC policy. CI threat is often

misused when actually referring to the “intelligence collection threat.”

The “CI Threat” includes all activities undertaken by an adversary to identify, disrupt, manipulate,

exploit, and/or destroy the effectiveness of friendly intelligence operations/activities. Specifically,

CI threats are actions one country/entity directs against another’s intelligence operations and other

clandestine/covert activities. Hence the CI threat to US intelligence is the capability and intent of

any entity to detect and counteract U.S. intelligence activities -- separate and distinct from

intelligence threats.

“CI threats” are not analogous to the threats of interest to counterintelligence.

From the US perspective -- the CI threat is foreign counterintelligence or security services efforts to

counter -- detect, disrupt, neutralize, and exploit -- US intelligence activities or other US

clandestine/covert activities.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Counterintelligence Training. Institutional training in knowledge, skills, abilities, and core competencies

unique to CI missions and functions. (DoDI 3305.11, DoD CI Training, 19 Mar 2007)

-- Also, instructions and applied exercises offered through various media and methods for the

acquisition, retention, and enhancement of skills, knowledge, and abilities required to counter or

neutralize: intelligence collection efforts; other intelligence activities; sabotage; and terrorist activities and

assassination efforts on behalf of foreign powers. (DoDI 3305.12, Intelligence and Counterintelligence

Training of Non-US Persons, 25 Oct 2007 w/ chg 2 dated 15 Oct 2013)

Counterproliferation (CP). Those actions (e.g., detect and monitor, prepare to conduct counter-

proliferation operations, offensive operations, weapons of mass destruction, active defense, and passive

defense) taken to defeat the threat and/or use of weapons of mass destruction against the United States,

our military forces, friends, and allies. (JP 1-02 and JP 3-40, Combating WMD, 10 Jun 2009)

-- Also, the activity by United States government intended to prevent the proliferation of nuclear,

chemical and biological capabilities to other nations. (HPSCI Report, 27 Jul 2006)

Countermeasure. Anything that effectively negates or mitigates an adversary’s ability to exploit

vulnerabilities. (DoD 5205.02-M, DoD OPSEC Program Manual, 3 Nov 2008)

-- Also, action, device, procedure, technique, or other measure that reduces or eliminates one or

more vulnerabilities. (DoD Insider Threat IPT Final Report, 24 Apr 2000)

-- Also, [in TEMPEST usage] action, device, procedure, technique, or other measure that reduces the

vulnerability of any equipment that electronically processes information (NSTISSI 7002, TEMPEST

Glossary, 17 Mar 1995).

Countermeasures. That form of military science that, by the employment of devices and/or techniques,

has as its objective the impairment of the operational effectiveness of enemy activity. (JP 1-02)

-- Also, defensive security programs and activities which seek to protect against both foreign

intelligence collection efforts and unauthorized access to, or disclosure of, protected facilities, information,

and material. (AR 380-20, Army CI Program, 25 May 2010)

-- Also, the employment of devices and/or techniques that has as its objective the impairment of the

operational effectiveness of an adversary’s activity. Countermeasures may include anything that

effectively negates an adversary’s ability to exploit vulnerabilities. (DSS Glossary)

-- Also, the employment of devices or techniques that impair the operational effectiveness of enemy

activity. Countermeasures may include anything that effectively negates an adversary's ability to exploit

vulnerabilities. (Draft DoDI 5200.39, CPI Identification and Protection within RDA Programs)

-- Also, [in polygraph and credibility assessment usage] those strategies employed by examinees to

affect PCA testing by the intentional application of physical, mental, pharmacological, or behavioral

tactics. (DoDI 5210.21, PCA Procedures, 12 Aug 2010 w/ chg 1 dated 15 Oct 2013)

Counterproliferation. Those actions taken to defeat the threat and/or use of weapons of mass destruction

against the United States, our forces, friends, allies, and partners. (JP 1-02 and JP 3-40, Combating

WMD, 10 Jun 2009)

Countersurveillance. All measures, active or passive, taken to counteract hostile surveillance. (JP 1-02

and JP 3-07.2, Antiterrorism, 24 Nov 2010) Also see counter surveillance; surveillance detection.

-- Also,…security techniques designed to detect, prevent, or deceive hostile observation of friendly

operations or activities. (CI Community Lexicon)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, the total action taken to detect and frustrate hostile surveillance. (Encyclopedia of the CIA,

2003)

-- Also, [Counter Surveillance]. Measures or actions taken when under verified or suspected

surveillance. (DoDI S-5240.15, FPRG, 20 Oct 2010 with change 1 dated 16 Oct 2013)

-- Also, the process of detecting and mitigating hostile surveillance (Stratfor - Global Intelligence)

An effective CS [countersurveillance] program depends on knowing two "secrets": first, hostile

surveillance is vulnerable to detection because those performing it are not always as sophisticated

in their tradecraft as commonly perceived; and second, hostile surveillance can be manipulated and

the operatives forced into making errors that will reveal their presence.

…CS can be performed by a person who is aware of his or her surroundings and who is watching

for people who violate the principles of TEDD.* At a more advanced level, the single person can

use surveillance detection routes (SDRs) to draw out surveillance.

* The U.S. government uses the acronym TEDD to illustrate the principles one can use to identify

surveillance. So, a person who sees someone repeatedly over Time, in different Environments and

over Distance, or one who displays poor Demeanor can assume he or she is under surveillance.

Surveillants who exhibit poor demeanor, meaning they act unnaturally, can look blatantly

suspicious, though they also can be lurkers -- those who have no reason for being where they are

or for doing what they are doing. Sometimes they exhibit almost imperceptible behaviors that the

target senses more than observes. Other giveaways include moving when the target moves,

communicating when the target moves, avoiding eye contact with the target, making sudden turns

or stops, or even using hand signals to communicate with other members of a surveillance team.

-- Fred Burton, “The Secrets of Countersurveillance,” Security Weekly, Stratfor, 6 Jun 20007;

article on line at: <http://www.stratfor.com/secrets_countersurveillance>

Counterterrorism (CT). Actions taken directly against terrorist networks and indirectly to influence and

render global and regional environments inhospitable to terrorist networks. (JP 1-02 and JP 3-26,

Counterterrorism, 13 Nov 2009) Also see antiterrorism; terrorism; combating terrorism.

-- Also, the practices, tactics, techniques, and strategies adopted to prevent or respond to terrorist

threats or acts, both real and suspected. (ODNI, U.S. National Intelligence - An Overview 2011)

Also see National Strategy for Counterterrorism, June 2011 at

< http://www.whitehouse.gov/sites/default/files/counterterrorism_strategy.pdf >

Country Clearance. Clearance for official U.S. Government representative travel to a foreign country

granted through the cognizant U.S. Embassy or U.S. Mission. (DoDD 4500.54E, DoD Foreign Clearance

Program, 28 Dec 2009)

Country Team. The senior, in-country, US coordinating and supervising body, headed by the chief of the

US diplomatic mission, and composed of the senior member of each represented US department or

agency, as desired by the chief of the US diplomatic mission. (JP 1-02 and JP 3-07.4, Joint Counterdrug

Operations, 13 Jun 2007)

Courier. Person who carries an item or information from one person or place to another. The courier

may or may not be aware of the nature of the item or information being transported. (AFOSI Manual

71-142, OFCO, 9 Jun 2000)

-- Also, a messenger responsible for the secure physical transmission and delivery of documents

and materials. (Senate Report 94-755, Book I - Glossary, 26 Apr 1976)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cover. A protective guise used by a person, organization, or installation to conceal true affiliation with

clandestine or other sensitive activities. (DoDD S-5105.61, DoD Cover and Cover Support Activities (U),

6 May 2010) Also see cover for action; cover for status.

-- Also, the concealment of true identity, purpose, or organizational affiliation with assertions of false

information as part of, or in support of, official duties to carry out authorized activities and lawful

operations. (DoDI S-5105.63, Implementation of DoD Cover and Cover Support Activities, 20 Jun 2013)

-- Also In intelligence usage, those measures necessary to give protection to a person, plan,

operation, formation, or installation from enemy intelligence effort and leakage of information. (JP 1-02

and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)

-- Also, actions to conceal actual friendly intentions, capabilities, operations, and other activities by

providing a plausible yet erroneous explanation of the observable. (Defense HUMINT Enterprise Manual

3301.002, Vol II Collection Operations, 23 Nov 2010)

-- Also, a verifiable and documented protective guise used by a person, organization, or installation to

conceal true identity or affiliation. (HDI Lexicon, April 2008)

-- Also, a protective guise used by a person, organization, or installation to prevent identification with

clandestine activities and to conceal the true affiliation of personnel and the true sponsorship of their

activities. (Senate Report 94-755, Book I - Glossary, 26 Apr 1976)

-- Also, protective action taken to mask or conceal an operation or activity from an adversary. (DSS

Glossary)

-- Also, a protective guise used by an individual, organization, or installation to prevent identification

with intelligence activities. To hide, conceal, obscure, or otherwise protect the exact identity of an

individual, unit, or activity. Supported with or without documentation and backstopping depending on the

sensitivity and scope of the operation. Cover can be anything that masks the true nature of an activity.

(CI Community Lexicon)

DoD cover may be used to protect the Department of Defense, its intelligence sources and

methods, and its clandestine tactics, techniques, and procedures from exposure to the enemy and

overt association with sensitive activities. The fact that DoD uses cover to protect its activities is

unclassified.

For DoD policy see DoDD S-5105.61, DoD Cover and Cover Support Activities (U), 6 May 2010.

Cover shields secret activities from the opposition

Good cover …reaches into the mind of the opponent, thinks as he would think, and then creates

a combination of fact and fancy, of actual arrangements and contrived impressions, which the

opposing mind is prepared to believe…. Cover takes an infinite variety of forms.

The best cover is that which contains the least notional and the maximum possible legitimate

material…. Perfect cover is an ideal, rarely achieved in practice.

-- Christopher Felix (James McCargar), A Short Course in the Secret War, 4^th Edition (2001)

_______________________

Special Cover Measures…

There are many valid reasons for the special cover measures used by some military and

intelligence organizations, such as potentially life-threatening, high-risk, covert operations and

intelligence and counterintelligence investigations or operations.

-- Joint Security Commission, Redefining Security: A Report to the Secretary of Defense and the Director

Central Intelligence, 28 Feb 1994, p.19

Cover for Action. A logical reason for doing the specific action involved. (CI Community Lexicon)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, a verifiable and documented protective guise used to disguise the true intent of an individual,

organization, or activity and to provide a credible explanation as to participation in a particular activity.

(Defense HUMINT Enterprise Manual 3301.002, Vol II Collection Operations, 23 Nov 2010) Also see

cover for status.

Cover for Action. This cover, combined with the use of appropriate clandestine tradecraft

techniques (e.g. alias, disguise, darkness, surveillance detection routes to and from meetings, etc.)

is what provides cover and security for clandestine meetings.

-- F.W. Rustmann, Jr., “Debunking the CIA Case Officer Myth,” Association of Former Intelligence Officers

(AFIO) Newsletter (Fall 2003), <http://ctcintl.com/Debunk.htm>; accessed 7 Mar 2011

Cover for Status. A logical and backstopped reason for being in an area or processing a particular item at

a particular time. (CI Community Lexicon) Also see cover for action.

-- Also, a verifiable and documented protective guise used to legitimize an individual’s, organization’s,

or activity’s extended presence in a particular area. (Defense HUMINT Enterprise Manual 3301.002,

Vol II, Collection Operations, 23 Nov 2010)

Cover for Status. This is the cover that permits [a case officer] to live and work in a particular

country. If the case officer is under official cover, this means he must blend into the environment

of an embassy or other official US installation abroad.

-- F.W. Rustmann, Jr., “Debunking the CIA Case Officer Myth,” Association of Former Intelligence Officers

(AFIO) Newsletter (Fall 2003), <http://ctcintl.com/Debunk.htm>; accessed 7 Mar 2011

Cover Legend. A contrived scenario or story designed to explain an organizational or personal

background and past or present activities, in terms intended to protect or conceal involvement in a

clandestine or otherwise sensitive activity. It incorporates as much truth as possible. It must be plausible.

(DoDI S-5105.63, Implementation of DoD Cover and Cover Support Activities, 20 Jun 2013)

-- Also, a contrived scenario, designed to explain an organizational or personal background and past

or present activities, in terms intended to protect and/or conceal involvement in a clandestine or otherwise

sensitive activity. It incorporates as much truth as possible. (Defense HUMINT Enterprise Manual

3301.002, Vol II Collection Operations, 23 Nov 2010) Also see cover story.

Cover Mechanism. Any documentary, oral, technical, fiscal, logistical, or other means provided to

backstop a cover. (DoDI S-5105.63, Implementation of DoD Cover and Cover Support Activities, 20 Jun

2013)

Cover Stop. A stop made while under surveillance that provides an ostensibly innocent reason for a trip.

(CI Centre Glossary and Spy Dust)

Cover Story. Coherent and plausible account of background, residence, employment, activities, access,

etc., furnished to an individual to substantiate whatever claims are necessary to successfully carry out an

operation. The difference between a cover story and a legend is that a legend is furnished to an illegal or

agent by FIS. (AFOSI Manual 71-142, OFCO, 9 Jun 2000) Also see cover legend.

-- Also, the background legend you have developed to explain who you are and why you are where

you are. (A Spy’s Journey)

The cover story is most frequently used to explain the visible evidences of a clandestine operation

or to provide an explanation when an operations encounters difficulties.

…cover stories in general: they should not be too precise or too detailed, and they should not be

forthcoming too quickly or all at once. …To be too precise in a cover story qualitatively increases

the chances of repudiation of the story; to be too detailed increases those chances quantitatively.

-- Christopher Felix (aka James McCargar), A Short Course in the Secret War, 4^th Edition (2001)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cover Support Activities. All measures taken to develop, coordinate, approve, activate, operate, and

terminate cover. (DoDD S-5105.61, DoD Cover and Cover Support Activities (U), 6 May 2010)

Cover Within Cover. A credible confession to an act that is less serious than espionage and will explain

all actions under suspicion by foreign intelligence services. (Words of Intelligence, 2^nd Edition, 2011)

Covering Agent. [As used within US Army] a CI Agent who provides dedicated full or part time

counterintelligence support, education, and liaison to an organization, agency, or research, development,

and acquisition program. (AR 381-20, Army CI Program, 25 May 2010)

Covert. A method of conducting operations that hides the true intent, affiliation or relationship of its

participants. Differs from clandestine in that covert conceals the identity of the sponsor, whereas

clandestine conceals the identity of the operation. (National HUMINT Glossary) See clandestine; covert

action; covert operation.

Covert, from the Latin cooperire, “to cover,'' means ''concealed, hidden, under cover, not avowed.''

Covert and clandestine are not synonymous!

Covert Action. Activity or activities of the United States Government to influence political, economic, or

military conditions abroad, where it is intended that the role of the United States Government will not be

apparent or acknowledged publicly. Covert action does not include activities the primary purpose of

which is to acquire intelligence, traditional counterintelligence activities [emphasis added], traditional

activities to improve or maintain the operational security of United States Government programs, or

administrative activities. (Section 503e, National Security Act of 1947 [50 USC §413b]) Also see covert;

covert operation; finding; special activities.

Covert action should not be confused with missionary work.

-- Henry Kissinger

as cited in James M. Olson, Fair Play: The Moral Dilemmas of Spying (2006), p. 33

…the overt foreign activities of the US Government

must be supplemented by covert operations

NSC Directive 10/2 (dated 18 Jun 1948)

as cited in Warner, CIA Under Truman (1994)

_________________________

Covert actions are designed to avoid revealing the role of the United States in their planning or

execution. EO 12333 (as amended 30 Jul 2008) directs that no agency except CIA (or the Armed

Forces of the United States in time of war declared by Congress or during any period covered by a

report from the President to the Congress consistent with the War Powers Resolution, Public Law

93-148) may conduct any covert action activity unless the President determines that another

agency is more likely to achieve a particular objective.

EO 12333 limits covert action, i.e., “no covert action may be conducted which is intended to

influence US political processes, public opinion, policies, or media. “ (EO 12333, para 2.13)

Covert action by DoD must be directed by the President, subsequently approved by the Secretary

of Defense, and executed in accordance with applicable law.

_________________________

Evolution of Covert Action

[I]n December 1947, the National Security Council issued a series of classified directives specifying

and expanding the CIA’s covert mission. The first of these directives, NSC-4-A, authorized the

Director of Central Intelligence (DCI) to conduct covert psychological operations consistent with

United States policy and in coordination with the Departments of State and Defense. A later

directive, NSC 10/2, authorized the CIA to conduct covert political and paramilitary operations. […]

The United States should ,maintain the option of reacting in the future to a grave, unforeseen threat

to United States national security through covert means.

-- Church Committee - 1976 (Senate Report 94-755, Book I, 26 April 1976)

_________________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Covert action must be consistent with and supportive of national policy and must be placed

appropriately within a national security policy framework. Covert action must never be used as a

substitute for policy.

-- National Security Decision Directive 159, 18 Jan 1985 (originally Top Secret-Sensitive, declassified)

________________________

Covert actions are… legally distinct from clandestine missions: ‘clandestine’ refers to the tactical

secrecy of the operation itself, ‘covert’ refers to the secrecy of the sponsor

covert action can

include a wide range of activity, from propaganda and disinformation to political influence

operations, economic destabilization, and paramilitary operations. Historically, the Central

Intelligence Agency (CIA) has been the main agent of US covert action….

-- Jennifer D. Kinne, “Covert Action and the Pentagon,” Intelligence and National Security, Vol. 22 No. 1,

February 2007, pp. 57-58

________________________

Covert action, or to use the British term, special political action, is the attempt by a government or

group to influence events in another state or territory without revealing its own involvement.

…Covert action is really an American term-of-art that came into use after World War II.

-- Roy Godson, Dirty Tricks or Trump Cards: US Covert Action and Counterintelligence (1995), p. 2

________________________

Typically, covert actions are carried out by the CIA with such assistance as may be necessary by

other elements of the intelligence Community as directed by the President. U.S. law requires that

all covert actions be approved prior to their execution by the President in a written ‘finding’ and that

notification be provided to the two intelligence committees in Congress. Covert actions may involve

political, economic, propaganda, or paramilitary activities.

-- WMD Report, 31 Mar 2005

________________________

Covert action is often called the “dirty tricks” side of spying. It consists of sabotage, subversion,

paramilitary operations, political action, psychological; operations, and black propaganda. It is not

always pretty. Covert action has historically been a relatively small part of the CIA’s overall activity,

but it is certainly the aspect of U.S. spying that has been the most controversial.

-- James M. Olson, Fair Play: The Moral Dilemmas of Spying (2006)

________________________

The three basic types of covert action are perception management (historically known as

propaganda), political action (influencing the actions of a foreign leader or government), and

paramilitary operations (support to insurgents).

-- Duane R. Clarridge, A Spy For All Season: My Life in the CIA (1997), p. 410

________________________

Covert action is not intelligence. Rather, CA is the most sensitive technique for implanting national

security policy. Operating in the space between diplomacy and military force, covert actions are the

“third way” of accomplishing a nation’s goals.

-- Dr. James E. Steiner (retired CIA), “Restoring the Red Line Between Intelligence and Policy on Cover

Action,” International Journal of Intelligence and Counterintelligence, Vol 19 No 1 (Spring 2006), p. 157

________________________

Covert action can serve as a more subtle and surgical tool

than forms of acknowledge employment of U.S. power and influence.

-- WMD Report (31 Mar 2005), p. 33

Security is indispensable to the successful conduct of covert action.

…[A]ccess to information on US covert action policies shall be restricted

to the absolute minimum number of persons possible.

-- President Ronald Reagan, NSSD 159 (18 Jan 1985)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Covert Channel. An unauthorized communication path that manipulates a communications medium in

an unexpected, unconventional, or unforeseen way in order to transmit information without detection by

anyone other than the entities operating the covert channel. (CNSSI No. 4009, National Information

Assurance Glossary, 26 April 2010)

Covert Channel Analysis. Determination of the extent to which the security policy model and subsequent

lower-level program descriptions may allow unauthorized access to information. (CNSSI No. 4009,

National Information Assurance Glossary, 26 April 2010)

Covert Communication (COVCOM). Clandestine, hidden communication that protects both the

information being shared and the relationship between the sending and receiving parties. (National

HUMINT Glossary)

-- Also, any technique or device used to relay data clandestinely from case officer to agent or agent to

case officer. (Spycraft)

-- Also, an agent’s spy gear for communicating with his case officer. ( A Spy’s Journey)

Covert Operation. An operation that is so planned and executed as to conceal the identity of or permit

plausible denial by the sponsor. (JP 1-02 and JP 3-05, Special Operations, 18 Apr 2011) Also see covert;

covert action, clandestine operation.

Covert refers to the secrecy of the sponsor

Clandestine operations are sometimes incorrectly referred to as “covert operations.” Although both

are secret and sensitive activities, the terms are not interchangeable. See clandestine operation.

_______________________

“Avowal of a covert operation, however implicit, is a hostile act, and it is wise never to indulge in

hostile acts unless one is able and prepared to back them up.”

-- Christopher Felix (aka James McCargar), A Short Course in the Secret War, 4^th Edition (2001)

________________________

A 1948 National Security Council Intelligence Directive defined covert operations as actions by the

U.S. against foreign states ''which are so planned and executed that any U.S. Government

responsibility for them is not evident to unauthorized persons and that if uncovered the U.S.

Government can plausibly disclaim any responsibility for them.''

________________________

"Covert action is the term that describes our efforts to influence the course of events in a foreign

country without our role being known….[it] has always been assigned to the CIA to perform, by

means of unattributable propaganda, sub rosa political action, or secret paramilitary support."

-- Stansfield Turner, Former Director Central Intelligence Agency

CPI. See Critical Program Information.

Credentials [Counterintelligence]. An official document or set of documents presenting evidence of the

identity, authority, and status of the bearer and for use in conducting authorized CI activities. (DoDI

5240.25, Counterintelligence Badge and Credentials, 30 Mar 2011 with change 1 dated 15 Oct 2013)

Also see badge; special agent.

-- Also, official documents which identify the bearer as a representative of a specific agency or

department of the U.S. Government.

Credible Information. Information disclosed or obtained by a criminal investigator that, considering its

source and nature and all the circumstances, is believable enough that a trained criminal investigator can

state the information is true. (DoDI 5505.7, Titling & Indexing Subjects of Criminal Investigations in DoD,

27 Jan 2012)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, information disclosed to or obtained by an investigator that, considering the source and nature

of the information and the totality of the circumstances, is sufficiently believable to indicate that criminal

activity has occurred and would cause a reasonable investigator under similar circumstances to pursue

further the facts of the case to determine whether a criminal act occurred or may have occurred.

(AR 195-2, Criminal Investigation Activities, 15 May 2009)

Credibility Assessment. The multi-disciplinary field of existing, as well as potential, techniques and

procedures to assess truthfulness that relies on physiological reactions and behavioral measures to test

the agreement between an individual’s memories and statements. (DoDD 5210.48, Polygraph and

Credibility Assessment Program, 25 Jan 2007 with change 2 dated 15 Nov 2013)

Criminal Intelligence (CRIMINT). Law enforcement information derived from the analysis of information

collected through investigations, forensics, crime scene and evidentiary processes to establish intent,

history, capability, vulnerability, and modus operandi of threat and criminal elements. (DoDI 2000.16, DoD

Antiterrorism Standards, 2 Oct 2006)

-- Also, a category of police intelligence derived from the collection, analysis, and interpretation of all

available information concerning known and potential criminal threats and vulnerabilities of supported

organizations. (ATTP 3-39.20, Police Intelligence Operations, Jul 2010)

-- Also, information compiled, analyzed, and/or disseminated in an effort to anticipate, prevent, or

monitor criminal activity. (National Criminal Intelligence Sharing Plan, Oct 2003)

For DoD Policy see DoDI 5525.18, Law Enforcement Criminal Intelligence in DoD (Note: does not

apply to counterintelligence personnel).

CRIMINT gathering is a fundamental and essential element in the all-encompassing duties of all

DoD Law Enforcement Agencies. CRIMINT can aid in crime prevention, threat disruption, offender

pursuit and apprehension, and evidence capture necessary for conviction.

Criminal Investigation. Investigation into alleged or apparent violations of law undertaken for purposes

which include the collection of evidence in support of potential criminal prosecution. (DoDI 5505.7, Titling

& Indexing Subjects of Criminal Investigations in DoD, 27 Jan 2012)

-- Also, the process of searching, collecting, preparing, identifying, and presenting evidence to prove

the truth or falsity of an issue of law. (US Army, FM 3-19.13, Law Enforcement Investigations, Jan 2005)

Criminal investigation is both an art and a science.

In science, the absolute truth is often achieved. Experience has shown that in criminal

investigations a less decisive hypothesis may sometimes be all that is possible to achieve.

A criminal investigation is the process of searching, collecting, preparing, identifying, and

presenting evidence to prove the truth or falsity of an issue of law.

Objectives of Criminal Investigations:

- 1) Determine if a crime was committed;

- 2) Collect information and evidence legally to identify who was responsible;

- 3) Apprehend the person responsible;

- 4) Recover stolen property;

- 5) Present the best possible case to the prosecutor; and

- 6) Provide clear, concise testimony.

-- US Army, FM 3-19.13, Law Enforcement Investigations, Jan 2005

_____________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

A criminal investigation is normally initiated when objective facts and circumstances reasonably

indicate a crime has been, is being or will be committed. A criminal investigation is normally limited

to: who committed the act; secure evidence to establish the elements of the offense; and support

prosecution.

Also see Crime Scene Investigation: A Guide for Law Enforcement, Sep 3013; available on line at

<http://www.nist.gov/oles/csiguide.cfm>

Criminal Investigative Information. Information compiled in the course of a criminal investigation.

(AR 195-2, Criminal Investigation Activities, 15 May 2009)

Criminal Investigation Task Force (CITF). The DoD CITF is a strategic-level organization with a mission to

develop and fuse police intelligence with MI [military intelligence] for the purpose of building criminal

cases against terrorist criminals that have attacked U.S. interests. (ATTP 3-39.20, Police Intelligence

Operations, Jul 2010)

The CITF conducts complicated criminal investigations targeting terrorists and complex criminal

organizations. These cases typically cross international borders and involve criminals captured as

a result of military operations, requiring coordination with international police and intelligence

agencies. The CITF combines USACIDC special agents (and criminal investigators from other

Services), police and intelligence analysts, and attorneys into teams. These teams synchronize

and fuse information and intelligence from all available sources to conduct criminal investigations

that enable criminal prosecution in U.S. or host nation legal systems.

-- ATTP 3-39.20 (FM 3-19.50), Police Intelligence Operations, July 2010

Criminal Offense. Any criminal act or omission as defined and prohibited by the Uniform Code of Military

Justice, the United States Code, State and local codes, foreign law, or international law or treaty. As used

herein, this term does not include military offenses as defined below. In the case of juveniles, this term

refers to those acts which, if committed by an adult, would be subject to criminal sanctions. (AR 195-2,

Criminal Investigation Activities, 15 May 2009)

Crisis. An incident or situation involving a threat to the United States, its citizens, military forces,

possessions, or vital interests that develops rapidly and creates a condition of such diplomatic, economic,

or military importance that commitment of US military forces and resources is contemplated in order to

achieve national objectives. (JP 1-02 and JP 3-0, Joint Operations, 11 Aug 2011)

Crisis Action Planning (CAP). The Adaptive Planning and Execution System process involving the time-

sensitive development of joint operation plans and operation orders for the deployment, employment, and

sustainment of assigned and allocated forces and resources in response to an imminent crisis. (JP 5-0,

Joint Operation Planning, 11 Aug 2011)

Crisis Management (CrM). Measures, normally executed under federal law, to identify, acquire, and plan

the use of resources needed to anticipate, prevent, and/or resolve a threat or an act of terrorism. (JP 1-02

and JP 3-28, Defense Support of Civil Authorities, 31 Jul 2013)

CRITIC. Critical information messages sent over the CRITICOMM System that must be delivered to the

President within 10 minutes upon recognition. (DoDD 5100.20, NSA, 26 Jan 2010)

Critical Asset. A specific entity that is of such extraordinary importance that its incapacitation or

destruction would have a very serious, debilitating effect on the ability of a nation to continue to function

effectively. (JP 1-02 and JP 3-07.2, Antiterrorism, 24 Nov 2010)

-- Also, Defense Critical Asset: an asset of such extraordinary importance to DoD operations in

peace, crisis, and war that its incapacitation or destruction would have a very serious, debilitating effect

on the ability of the Department of Defense to fulfill its mission. (DoDI 2000.16, DoD Antiterrorism

Standards, 2 Oct 2006)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, any asset (person, group, relationship, instrument, installation, process or supply at the

disposition of an organization for use in an operational or support role) whose loss or compromise would

have a negative impact on the capability of a department or agency to carry out its mission; or may have

a negative impact the ability of another U.S. Government department or agency to conduct its mission; or

could result in substantial economic loss; or which may have a negative impact on the national security

of the U.S. (ICD 750, Counterintelligence Programs, 5 Jul 2013)

Critical Information (also called CRITIC). Specific facts about friendly intentions, capabilities, and

activities needed by adversaries for them to plan and act effectively so as to guarantee failure or

unacceptable consequences for friendly mission accomplishment.(JP 2-0, Joint Intelligence, 22 Oct 2013)

-- Also, decisions, intentions, or actions of foreign governments, organizations, or individuals that

could imminently and materially jeopardize vital U.S. policy, economic, informational, or military interests

to such an extent that the immediate attention of the President and the National Security Council may be

required. (DoDD 5100.20, NSA, 26 Jan 2010)

Critical Infrastructure. Systems and assets, whether physical or virtual, so vital to the United States that

the incapacity or destruction of such systems and assets would have a deliberating impact on the

security, national economic security, national public health and safety, or any combination of those

matters. (Critical Infrastructures Protection Act of 2002 and USA Patriot Act §1016)

-- Physical or virtual systems and assets that if compromised by a physical or cyberspace incident

negatively impact the national security, economic stability, public confidence, health, or safety of the

United States. (DoD Strategy for Operating in Cyberspace, May 2011)

-- Also, [within DoD] infrastructure deemed essential to DoD operations or the functioning of a critical

asset.

Nation's critical infrastructure and key resources, as set forth in the 2006 National Infrastructure

Protection Plan (NIPP) includes the assets, systems, and networks, whether physical or virtual, so

vital to the United States that their incapacitation or destruction would have a debilitating effect on

security, national economic security, public health or safety, or any combination thereof. Key

resources are publicly or privately controlled resources essential to the minimal operations of the

economy and government.

-- Cited in the National Strategy for Homeland Security

_______________________

Failure of critical assets degrades or disrupts operations; cascading failures of critical

infrastructure assets within and across infrastructures may lead to mission failure

-- DoD Critical Infrastructure Protection Strategy, April 2003

__________________________

Copy of the 2009 National Infrastructure Protection Plan (NIPP) at:

<http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf>

Critical Infrastructure and Key Resources (CI/KR). The infrastructure and assets vital to a nation’s

security, governance, public health and safety, economy, and public confidence. (JP 3-27, Homeland

Defense, 29 Jul 2013)

Critical Infrastructure Protection (CIP). Actions taken to prevent, remediate, or mitigate the risks resulting

from vulnerabilities of critical infrastructure assets. (JP 1-02 and JP 3-28, Defense Support of Civil

Authorities, 31 Jul 2013) Also see Defense Critical Infrastructure.

PDD-63 set as a national goal the ability to protect the nation’s critical infrastructure from

intentional attacks (both physical and cyber). Also see PPD-21, Critical Infrastructure Security and

Resilience, 12 Feb 2013. PPD-21 identifies 16 critical infrastructure sectors; DoD is the sector-

specific agency for the Defense Industrial Base (DIB).

For DoD policy see DoDD 3020.40, DoD Policy and Responsibilities for Critical Infrastructure.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Critical Intelligence. Intelligence that is crucial and requires the immediate attention of the

commander. (JP 2-0, Joint Intelligence, 22 Oct 2013)

Critical National Asset (CNA). Any information, policies, plans, technologies, or capabilities that, if

acquired (stolen), modified, or manipulated by an adversary, would seriously threaten US national or

economic security. (NIP - FY 2009 Congressional Budget Justification Book, redacted version)*

* Copy available at: <http://www.fas.org/irp/dni/cbjb-2009.pdf > (accessed 24 Jan 2013).

Critical Program Information (CPI). Elements or components of an RDA [research, development &

acquisition] program that, if compromised, could cause significant degradation in mission effectiveness;

shorten the expected combat-effective life of the system; reduce technological advantage; significantly

alter program direction; or enable an adversary to defeat, counter, copy, or reverse engineer the

technology or capability. (DoDI 5200.39, CPI Protection within DoD, 16 Jul 2008 w/ change 1 dated 28

Dec 2010)

Note: DoDI 5200.39 is under revision, proposed revised definition for CPI: U.S. capability

elements that contribute to the warfigthers’ technical advantage throughout the life cycle, which if

compromised or subject to unauthorized disclosure, decrease the advantage. U.S. capability

elements may include, but are not limited to, technologies and algorithms residing on the system,

its training equipment, or maintenance support equipment.

____________________

It is DoD policy (IAW DoDI 5200.39) to provide uncompromised and secure military systems to the

warfighter by performing comprehensive protection of CPI through the integrated and synchronized

application of Counterintelligence, Intelligence, Security, systems engineering, and other defensive

counter-measures to mitigate risk.

Failure to apply consistent protection of CPI may result in the loss of confidentiality, integrity, or

availability of CPI, resulting in the impairment of the warfighter’s capability and DoD’s technological

superiority.

CPI includes: information about applications, capabilities, processes, and end-items; elements or

components critical to a military system or network mission effectiveness; and technology that

would reduce the US technological advantage if it came under foreign control.

CPI information shall be identified early in the research, technology development and acquisition

processes, but no later than when a DoD Agency or military component demonstrates an

application for the technology in an operational setting, in support of a transition agreement with a

pre-systems acquisition or acquisition program, or in exceptional cases, at the discretion of the

laboratory/technical director.

Critical Technology. Technology or technologies essential to the design, development, production,

operation, application, or maintenance of an article or service which makes or could make a significant

contribution to the military potential of any country, including the United States. This includes, but is not

limited to, design and manufacturing know-how, technical data, keystone equipment, and inspection and

test equipment. (DoDI 2040.02, International Transfers of Technology, Articles and Services, 10 Jul 2008)

Also see dual-use, technology.

DoD Policy - Critical Technology

Dual-use and defense-related technology shall be treated as valuable national security resources,

to be protected and transferred only in pursuit of national security and foreign policy objectives.

Those objectives include ensuring that: critical U.S. military technological advantages are

preserved; transfers which could prove detrimental to U.S. security interests are controlled and

limited; proliferation of weapons of mass destruction and their means of delivery are prevented;

and diversion of defense-related goods to terrorists is prevented.

See DoDI 2040.02, International Transfers of Technology, Articles and Services, 10 Jul 2008.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Critical Thinking. A deliberate meta-cognitive (thinking about thinking) and cognitive (thinking) act

whereby a person reflects on the quality of the reasoning process simultaneously while reasoning to

a conclusion. The thinker has two equally important goals: coming to a solution and improving the way

she or he reasons. (David T. Moore, Critical Thinking and Intelligence Analysis)

-- Also, intellectual discipline of rigorously weighing evidence and assumptions, and assessing

multiple hypotheses resulting in accurate, persuasive, and policy-relevant conclusions. (DIA, 2012-2017

Defense Intelligence Agency Strategy)

Critical Thinking and Intelligence Analysis, National Defense Intelligence College occasional paper

no. 14, March 2007.

Copy available at <http://www.au.af.mil/au/awc/awcgate/dia/ndic_moore_crit_analysis_hires.pdf >

Also see The Foundation for Critical Thinking, www.criticialthinking.org , The Thinker’s Guide to

Analytical Thinking, 2007.

Criticality.

[In critical infrastructure usage] a metric used to describe the consequence

of loss of an asset, based on the effect the incapacitation or destruction of the asset would have

on DoD operations and the ability of the Department of Defense to fulfill its missions. (DoDI 3020.45,

DCIP Management, 21 Apr 2008)

Cross-cuing. The use of one intelligence source to initiate the collection against a particular target with

another intelligence collector. Also see cueing.

CI and HUMINT provide unique opportunities for enabling and cross-cuing other intelligence

disciplines or capabilities. CI and HUMINT sources can enable other intelligence collection

disciplines or provide time sensitive “tip off” information to cue other collection capabilities.

-- JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011, para 3b (p. V-2)

Cryptanalysis. The steps and operations performed in converting encrypted messages into plain text

without initial knowledge of the key employed in the encryption. (JP 1-02)

Cryptography. The art and science concerning the principles, means, and methods for rendering plain

information unintelligible and for restoring encrypted information to intelligible form. (DoDD 5100.20, NSA,

26 Jan 2010)

Cryptology. The science that deals with hidden, disguised, or encrypted communications. It includes

communications security and communications intelligence. (JP 1-02)

-- Also, the branch of knowledge that treats the principles of cryptography and cryptanalytics; and the

activities involved in producing signals intelligence (SIGINT) and maintaining communications security

(COMSEC). (DoDD 5100.20, NSA, 26 Jan 2010)

Cryptonym. Code name; crypt or crypto for short, always capitalized. …prefixes to code names are used

to identify the nature of the clandestine source, [e.g., GT and CK] prefixes were both "diagraph" identifiers

for the Soviet and East European program….. The diagraph is used in front of the cryptonym of the

source as a more formal way of referring to the subject, not unlike putting "Mr." in front of "Smallwood."

(Spy Dust)

-- Also, a false name used in official correspondence to hide the identity of the agent, officer, or

operation. (A Spy’s Journey)

Cueing. The use of one or more sensor systems to provide data that directs collection by other systems.

(term previously defined in FM 2-0, Intelligence, May 2004) Also see cross-cuing.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cultivation. A deliberate and calculated association with a person for the purpose of recruitment,

obtaining information, or gaining control. (AFOSI Instruction 71-101, 6 Jun 2000)

-- Also, apparently casual but actually deliberate and calculated effort to gain control of an individual,

induce him to furnish information, and agree to recruitment. Cultivation can extend over a considerable

periods of time. (FBI FCI Terms)

Cultural Intelligence. Knowledge resulting from all-source analysis of cultural factors, which assists in

anticipating the actions of people or groups of people. (National Intelligence: Consumer’s Guide - 2009).

Current Intelligence. Within DoD: None - term removed from JP 1-02 per JP 2-0 Joint Intelligence, 22

Oct 2013.

Previously defined as: one of two categories of descriptive intelligence that is concerned with

describing the existing situation.

Custodial Interview. Interview conducted of a subject following formal arrest or detention. Subjects are

made fully aware of their deprivation of freedom or their “in custody” status. (Army FM 2.22-2, CI, Oct

2009).

Cutout. An intermediary or device used to obviate direct contact between members of a clandestine

organization. (JP 1-02)

-- Also, an intermediary used to obviate direct linkage between either the origin or destination of an

intelligence operation or action. (Defense HUMINT Enterprise Manual 3301.002, Vol II Collection

Operations, 23 Nov 2010)

-- Also, an individual whose services are used to prevent contact and recognition between specific

members of an intelligence service with the purpose of providing compartmentation and security. (AFOSI

Manual 71-142, OFCO, 9 Jun 2000)

-- Also, a mechanism or person that acts as a compartment between the members of an operation

but which allows them to pass material or messages securely. (CI Centre Glossary)

Cyber. 1) Any process, program, or protocol relating to the use of the Internet or an intranet, automatic

data processing or transmission, or telecommunication via the Internet or an intranet; and 2) any matter

relating to, or involving the use of, computers or computer networks. (Cybersecurity Act of 2009)

Cyber Attack. An attack, via cyberspace, targeting an enterprise’s use of cyberspace for the purpose of

disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or

destroying the integrity of the data or stealing controlled information. (CNSSI No. 4009, National

Information Assurance Glossary, 26 April 2010) Also see cyber espionage, cyber threat.

Disruptive and destructive cyber attacks are becoming a part of conflict between states, within

states, and among nonstate actors. The borderless nature of cyberspace means anyone, anywhere

in the world, can use cyber to affect someone else. … The rise of cyber is the most striking

development in the post-9/11 national security landscape.

-- General Martin E. Dempsey (USA), Chairman of the Joint Chiefs of Staff, June 2013

(Quoted in Army Magazine, August 2013, p. 8)

______________________

Cyber attack is a non-kinetic offensive operation intended to create physical effects or to

manipulate, disrupt, or delete data. It might range from a denial-of-service operation that

temporarily prevents access to a website, to an attack on a power turbine that causes physical

damage and an outage lasting for days.

-- DNI, Worldwide Threat Assessment of the US Intelligence Community, SSCI, 12 Mar 2013

______________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Existential Cyber Attack is defined as an attack that is capable of causing sufficient wide scale

damage for the government potentially to lose control of the country, including loss or damage to

significant portions of military and critical infrastructure: power generation, communications, fuel

and transportation, emergency services, financial services, etc.

-- Defense Science Board, Task Force Report: Resilient Military Systems and the Advanced Cyber

Threat, Jan 2013; copy at: <http://www.acq.osd.mil/dsb/reports/ResilientMilitarySystems.CyberThreat.pdf>

____________________________

Also see P.W. Singer and Allan Friedman, Cybersecurity and Cyberwar: What Everyone Needs To

Know (2014)

-- Also, Cyberattack: deliberate disruption of a computer system or network and functions delivered or

supported by it. (National Research Council - 2009)

Cyberattacks

Cyber Crime

Cyber

Espionage

Non-Kinetic

Cyberwar

Hacktivism

Non-Kinetic

Kinetic

Effect

Adapted from: Eric Rosenbach and Robert Belk, “U͘S͘ Cybersecurity: The Current Threat and Future Challenges,” Nicholas Burns

and Jonathon Price, Editors., Securing Cyberspace: A New Domain for National Security, 2012, Figure 1, p. 44

Cyber attacks are growing in frequency, scale, complexity and destructiveness.

Cyber attacks are a way of life… since 2006, cyber incidents against the USG increased 782% (GPO).

Cyber Counterintelligence. Counterintelligence, by any means, where a significant target or tool of the

adversarial activity is a computer, computer network, embedded processor or controller, or the

information thereon. (The United States Government-Wide Cyber Counterintelligence Plan - 2009 (U))

Also see counterintelligence activities in cyberspace; cyberspace.

* Note: Within DoD the term “cyber counterintelligence “ to be withdrawn from JP 1-02;

see Counterintelligence Activities in Cyberspace.

Cyberspace is a venue.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cyber Effect: The manipulation, disruption, denial, degradation, or destruction of computers, information

or communications systems, networks, physical or virtual infrastructure controlled by computers or

information systems, or information resident thereon. (PDD-20, US Cyber Operations Policy (U), 16 Oct

2012)

Cyber Electromagnetic Activities (CEMA). Activities leveraged to seize, retain, and exploit an advantage

over adversaries and enemies in both cyberspace and the electromagnetic spectrum, while

simultaneously denying and degrading adversary and enemy use of the same and protecting the mission

command system. (Army FM 3-13, Inform and Influence Activities, Jan 2013)

CEMA consist of cyberspace operations (CO), electronic warfare (EW), and spectrum

management operations (SMO).

See Army FM 3-38, Cyber Electromagnetic Activities, 12 Feb 2014.

Cyber Espionage. Refers to intrusions into networks to access sensitive diplomatic, military, or economic

information. (DNI, Worldwide Threat Assessment of the US Intelligence Community, SSCI, 12 Mar 2013)

Also see cyber attack, cyber threat.

-- Also, the act or practice of obtaining secrets without the permission of the holder of the information

(personal, sensitive, proprietary or of classified nature), from individuals, competitors, rivals, groups,

governments and enemies for personal, economic, political or military advantage using illegal exploitation

methods on internet, networks or individual computers… (Wikipedia at

<http://en.wikipedia.org/wiki/Cyber_espionage>; accessed 5 Jan 2010)

“Counterintelligence…is now a concern for every organization that lives on electronic

networks and has secrets to keep. Information is liquid and liquid leaks.”

-- Joel Brenner (former NCIX), America the Vulnerable,: Inside the New Threat Matrix of Digital Espionage,

Crime, and Warfare, 2011, p. 64.

Cyber Exploitation: Penetration of an adversary's computer system or network to seize information

(National Research Council, 2009)

Essentially an intelligence-gathering activity, e.g., Ghostnet, Operation Aurora. Technically,

exploits and attack can be similar, i.e., utilize same access vector and manipulate same

vulnerability.

“Distinction between intelligence collection and damage to systems is a few key strokes”

-- Richard A. Clarke, Author of Cyber War

Cyber Incident. Any attempted or successful access to, exfiltration of, manipulation of, or impairment to

the integrity, confidentiality, security, or availability of data, an application, or an information system,

without lawful authority. (NSPD-54 / HSPD-23)

Cyber Intrusion Damage Assessment. A managed, coordinated, and standardized process conducted to

determine the impact on future defense programs, defense scientific and research projects, or defense

warfighting capabilities resulting from an intrusion into a DIB unclassified computer system or network.

(DoDD 5505.13E, DoD Executive Agent for the DoD Cyber Crime Center [DC3], 1 Mar 2010)

Cyber Persona. An identity used in cyberspace to obtain information or influence others, while

dissociating the actor’s true identity or affiliation. (DoDI S-5240.23, CI Activities in Cyberspace, 13 Dec10

with change 1 dated 16 Oct 2013)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cyber Power. The ability to use cyberspace to create advantages and influence events in other

operational environments and across the instruments of power. (Daniel T. Kuehl, “From Cyberspace to

Cyberpower: Defining the Problem,” in Franklin D. Kramer, Stuart Starr, and Larry K. Wentz, eds.,

Cyberpower and National Security, Washington, D.C.: National Defense University, 2009)

Cyber power can be used to produce preferred outcomes within cyberspace or it can be use cyber

instruments to produce preferred outcomes in other domains outside cyberspace.

See "Cyber Power" by Joseph S. Nye, Harvard Kennedy School, May 2010; available online at:

Cyber Security (or Cybersecurity). Measures taken to protect a computer network, system, or electronic

information storage against unauthorized access or attempted access. (DoDI 5205.13, Defense Industrial

Base Cyber Security/Information Assurance Activities, 29 Jan 2010 w/ chg 1 dated 21 Sep 2012) Also

see computer security; information security (INFOSEC).

-- Also, includes preventing damage to, unauthorized use of, or exploitation of electronic information

and communications systems and the information contained therein to ensure confidentiality, integrity,

and availability; also includes restoring electronic information and communications systems in the event

of a terrorist attack or natural disaster. (DoDD 3020.40, DoD Policy and Responsibilities for Critical

Infrastructure, 14 Jan 2010 w/ chg 2 dated 21 Sep 2012)

- Also, the ability to protect, defend, and maintain availability, confidentiality, authentication, and

integrity of networks, systems, and the data resident therein. (DoD Strategy for Operating in Cyberspace,

May 2011)

-- Also, the ability to protect or defend the use of cyberspace from cyber attacks. (CNSSI No. 4009,

National Information Assurance Glossary, 26 April 2010)

Cybersecurity threats represent one of the most serious

national security, public safety, and economic challenges we face as a nation.

-- National Security Strategy - 2010

“Cybersecurity vulnerabilities challenge governments, businesses, and individuals worldwide.

Attacks have been initiated by individuals, as well as countries. Targets have included government

networks, military defenses, companies, or political organizations, depending upon whether the

attacker was seeking military intelligence, conducting diplomatic or industrial espionage, or

intimidating political activists. In addition, national borders mean little or nothing to cyberattackers,

and attributing an attack to a specific location can be difficult, which also makes a response

problematic.”

-- CRS Report, Cybersecurity: Authoritative Reports and Resources, 25 Oct 2013

Copy available at: <http://www.fas.org/sgp/crs/misc/R42507.pdf>

______________________

“As long as nations rely on computer networks as a foundation for military and economic power

and as long as such computer networks are accessible to the outside, they are at risk.”

-- Rand Report, “Cyberdeterrence and Cyberwar,” by Martin C. Libicki (2009)

______________________

“America is being ‘invaded,’ every hour of every day, by hostile forces using computers…from minor

annoyances by young computer hackers to those from sophisticated nations and could cost

American lives…the irony is that this new threat stems from the technical sophistication that helps

make the US military the strongest in the world.”

-- John Randle, Voice of America, Future War in Cyberspace

______________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

U.S. military networks “are constantly under attack. They are probed thousands of times a day.

They are scanned millions of times a day. And the frequency and sophistication of attacks are

increasing exponentially.”

“The power to disrupt and destroy, once the sole province of nations, now also rests with small

groups and individuals, from terrorist groups to organized crime, from hacker activists to teenage

hackers, from industrial spies to foreign intelligence services.”

-- William Lynn, Deputy Secretary of Defense

(as quoted in “In Cyber War, Most of U.S. Must Defend Itself,” by William Matthews, DefenseNews, 1 Feb 2010, p. 29)

______________________

“Forcing Cybersecurity into a simplified unitary framework limits our choices and underestimates

the complexity of the most novel and serious disruptive threat to our national security since the

onset of the nuclear age sixty years ago.”

-- Michael Chertoff, Former US Secretary of Homeland Security & John M. McConnell, Former DNI

As quoted in Securing Cyberspace: A new Domain for National Security, 2012, p. 192

______________________

Cyber security within the military is daunting - “The Department operates over 15,000 networks

and 7 million computing devices across hundreds of installations in dozens of countries around

the globe."

-- Zachary J. Lemnios, Assistant Secretary of Defense for Research and Engineering, 20 March 2012

Testimony before the Senate Armed Services Committee hearing on Emerging Threats and Capabilities

______________________

“In the cyber realm, new exploits can render defenses that seemed effective obsolete in a matter of

seconds. Given the speed with which cyber capabilities can be created and the relatively low cost

for entry, the potential for possibly far-reaching technological surprise is very high.”

-- Dr. James S. Perry, Director of Information Systems Analysis Center at Sandia National Laboratories,

20 March 2012. Testimony before the Senate Armed Services Committee hearing on Emerging Threats

and Capabilities

______________________

“Repeated cyber intrusions into critical infrastructure demonstrate the need for improved

Cybersecurity. The cyber threat to critical infrastructure continues to grow and represents one of

the most serious national security challenges we must confront.”

-- EO 13636, Improving Critical Infrastructure Cybersecurity, 12 Feb 2013

______________________

See the “The Comprehensive National Cybersecurity Initiative” at:

<http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative>

Also see Committee on National Security Systems, National Information Assurance (IA) Glossary,

April 2010, <http://www.cnss.gov/Assets/pdf/cnssi_4009.pdf>

Also see P.W. Singer and Allan Friedman, Cybersecurity and Cyberwar: What Everyone Needs To

Know (2014)

Cyberattacks are possible only because systems have flaws.

Cyber Threat. The cyber threat is characterized in terms of three classes of increasing sophistication: 1)

those practitioners who rely on others to develop the malicious code, 2) those who can develop their own

tools to exploit publically known vulnerabilities as well as discovering new vulnerabilities, and 3) those

who have significant resources and can dedicate them to creating vulnerabilities in systems. (Defense

Science Board, Task Force Report: Resilient Military Systems and the Advanced Cyber Threat, Jan 2013)

Also see cyber attack, cyber espionage, cyber threat investigation.

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cyber Threat

Serious & increasing…

Insiders…

Terrorists

Traitors

Disgruntled Employees

Foreign Corporations

Nation States…

Industrial Spies

Research Institutes

Foreign Intel Entities

Hackers…

Criminals…

Novice / Recreational

Drug Cartels

Activists

Organized-Crime

Cyber Extortionists

In cyberspace, attackers can be anywhere at the speed of light…

Cyber spying & attacks against U.S. exponentially increasing every year

Over 120 nations have some form of computer attack capability¹

Distinction between intel collection and damage to systems is a few key strokes²

Cyber incidents reported by federal agencies increased 782% since 2006³

Unauthorized scans & probes of DoD networks… over 3 million every day⁴

True origins & ultimate purpose of intrusions…

Criminal, Hacker, Terrorist, or Foreign Intelligence - initially who can tell?

Mark L Reagan - 26 June 2003

¹ Government Accounting Office (GAO)

³According to GAO (FCW.com, 18 Jul 2013)

UNCLASSIFIED

Updated 20 July 2013

²Richard A. Clarke, author of Cyber War

⁴“Whacking Hackers,” Newsweek, 15 Oct 2007, p. 10

Cyber Threat

“In the United States, we define cyber threats in terms of cyber attacks and cyber espionage. A

cyber attack is a non-kinetic offensive operation intended to create physical effects or to

manipulate, disrupt, or delete data. It might range from a denial-of-service operation that

temporarily prevents access to a website, to an attack on a power turbine that causes physical

damage and an outage lasting for days. Cyber espionage refers to intrusions into networks to

access sensitive diplomatic, military, or economic information.”

-- James R. Clapper, DNI, Statement for the Record, Worldwide Threat Assessment of the US Intelligence

Community, Senate Committee on Armed Services, 18 April 2013

___________________________

The cyber threat the United States faces is increasing in severity and is accessible to a wide range

of enemies. “Most of what we see today is exploitation -- that's theft, stealing secrets, either

commercial or military… we know the tools exist to destroy things, to destroy physical property, to

destroy networks, to destroy data, maybe even take human lives.”

-- Deputy Defense Secretary William J. Lynn III in a television interview on PBS 14 July 2011

___________________________

The FBI has noted three primary categories of cyber threat actors:

“[1] organized crime groups that are primarily threatening the financial services sector,

and they are expanding the scope of their attacks;

[2] state sponsors—foreign governments that are interested in pilfering data, including

intellectual property and research and development data from major manufacturers,

government agencies, and defense contractors; and

[3] increasingly there are terrorist groups who want to impact this country the same way

They did on 9/11 by flying planes into buildings. They are seeking to use the network

to challenge the United States by looking at critical infrastructure to disrupt or harm the

viability of our way of life.”

-- FBI, The Cyber Threat: Part 1: On the Front Lines With Shawn Henry, 27 March 2012,

http://www.fbi.gov/news/stories/2012/march/shawn-henry_032712/shawn-henry_032712

___________________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Foreign intelligence and security services have penetrated numerous computer networks of US

Government, business, academic, and private sector entities. Most detected activity has targeted

unclassified networks connected to the Internet, but foreign cyber actors are also targeting

classified networks.

-- DNI, Worldwide Threat Assessment of the US Intelligence Community, SSCI, 12 March 2013, p. 2

__________________________

[C]omputer network ‘exploitation’ and ‘disruption’ activities such as denial-of-service attacks will

continue. …the likelihood of a ‘destructive’ attack that deletes information or renders systems

inoperable will increase as malware and attack tradecraft proliferate.

-- DNI, Worldwide Threat Assessment of the US Intelligence Community, SSCI, 29 January 2014, p. 1

Cyber Threat Investigation. Any actions taken within the United States, consistent with applicable law

and presidential guidance, to determine the identify, location, intent, motivation, capabilities, alliances,

funding, or methodologies of one or more cyber threat groups or individuals. (NSPD-54 / HSPD-23)

-- Also, actions taken, consistent with applicable law and Presidential guidance, to determine the

identify, location, intent, motivation, capabilities, alliances, funding, or methodologies of one or more FIEs

[Foreign Intelligence Entities], that has attempted to penetrate or has, in fact, penetrated a DoD, IC, or

DIB [defense industrial base] information system. (DoDI S-5240.23, CI Activities in Cyberspace (U),

13 Dec 2010 with change 1 dated 16 Oct 2013)

Attribution is a major problem in the cyber realm

“Who: Attribution… blurry lines between various types of malicious activity in cyberspace may

make it difficult for investigators to attribute an incident to a specific individual or organization.

Criminal attribution is a key delineating factor between cybercrime and other cyber threats. When

investigating a given threat, law enforcement is challenged with tracing the action to its source and

determining whether the actor is a criminal or whether the actor may be a terrorist or state actor

posing a potentially greater national security threat.”

-- CRS Report R42547, Cybercrime: Conceptual Issues for Congress & U.S. Law Enforcement, 23 May 2012

_______________________

"The damage caused by malicious activity in cyberspace is enormous and unrelenting. Every year,

cyber attacks inflict vast damage on our Nation's consumers, businesses, and government

agencies. This constant cyber assault has resulted in the theft of millions of Americans' identities;

exfiltration of billions of dollars of intellectual property; loss of countless American jobs; vulnerability

of critical infrastructure to sabotage; and intrusions into sensitive government networks."

-- Senator Sheldon Whitehouse, 14 April 2011

_______________________

James Clapper, Director of National Intelligence, noted that “[t]wo of our greatest strategic

challenges regarding cyber threats are: (1) the difficulty of providing timely, actionable warning

of cyber threats and incidents, such as identifying past or present security breaches, definitively

attributing them [emphasis added], and accurately distinguishing between cyber espionage

intrusions and potentially disruptive cyber attacks; and (2) the highly complex vulnerabilities

associated with the IT supply chain for US networks.”

-- Office of the Director of National Intelligence, Unclassified Statement for the Record on the

Worldwide Threat Assessment of the US Intelligence Community for the Senate Select Committee

on Intelligence, 31 Jan 2012, p. 8.

_______________________

Attribution in cyber is always going to be difficult.

Missiles come with a return address, cyber attacks do not.

-- William Lynn, US Deputy Secrete of Defense

Interview Defense News, 18 July 2011

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cyber Threats. Natural or man-made incidents (intentional or unintentional) that would be detrimental

to the cyber domain, or which are dependent on or operate through cyberspace/cyber domain. (Cyber

Threats to National Security, Symposium Five, 2011) Also see cyber threat.

In the United States, we define cyber threats in terms of cyber attacks and cyber espionage.

-- Hon. James R. Clapper, DNI, Statement for the Record Worldwide Threat assessment of the US

Intelligence Community, Senate Committee on Armed Services,18 Apr 2013

Cyber Threat

Increasing d

Worldwide Internet Users:

44M in 1995… 1B in 2005… 2B in 2010… 3B by end 2014

“…an increasing number of adversaries are developing new

options for exerting leverage over the United States through

cyberspace… Creating damage as well as conducting

espionage against the U.S. Cyberspace provides

clear avenues and the prospect of anonymity.”

-- National Intelligence Council (June 2003)

Criminals, terrorists, and foreign governments are exploiting

the anonymity and global reach of the Internet to -

 Attack the U.S. information infrastructure

Perform reconnaissance for physical attack

 Conduct hostile information operations

Steal money, identities, and secrets

 Potentially undermine the U.S. economy

Source: “Cybersecurity for the Homeland” (Dec 2004), Report of the Activities and Findings by the Chairman and Ranking Member Subcommittee

on Cybersecurity, Science, and Research & Development, US House of Representatives Select Committee on Homeland Security, pages 3 & 10

Prepared by Mark L Reagan - 3 Jan 2006

UNCLASSIFIED

Update 9 Jun 2014

Cyber-Terrorism. A criminal act perpetrated by the use of computers and telecommunications

capabilities, resulting in violence, destruction and/or disruption of services, where the intended purpose is

to create fear by causing confusion and uncertainty within a given population, with the goal of influencing

a government or population to conform to a particular political, social or ideological agenda. (FBI)

-- Also, cyberterrorism: the unlawful attacks and threats of attack against computers, networks, and

the information stored therein when done to intimidate or coerce a government or its people to further

political or social objectives. Actors who engage in these kinds of activities are commonly referred to as

cyber terrorists. (Cyber Threats to National Security, Symposium Five, 2011)

Cybercrime. Crime involving use of a computer system or network.

Typically involves data theft (e.g., credit cards, etc.) or transmission (e.g., child porn).

______________________

”Cybercriminals also threaten US economic interests. They are selling tools, via a growing black

market, that might enable access to critical infrastructure systems or get into the hands of state and

nonstate actors. In addition, a handful of commercial companies sell computer intrusion kits on the

open market. These hardware and software packages can give governments and cybercriminals

the capability to steal, manipulate, or delete information on targeted systems. Even more

companies develop and sell professional-quality technologies to support cyber operations—often

branding these tools as lawful-intercept or defensive security research products. Foreign

governments already use some of these tools to target US systems.”

-- Hon. James R. Clapper, DNI, Statement for the Record, Worldwide Threat Assessment of the US

Intelligence Community, Senate Committee on Armed Services, 18 April 2013

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Cyberexploitation. Penetration of an adversary's computer system or network to seize information.

(National Research Council - 2009)

Essentially an intelligence-gathering activity, e.g., Ghostnet, Operation Aurora.

Cyberspace. A global domain within the information environment consisting of the independent networks

of information technology infrastructures and resident data, including the Internet, telecommunications

networks, computer systems, and embedded processors and controllers. (JP 1-02 and JP 3-12,

Cyberspace Operations, 5 Feb 2012) Also see cyberspace domain.

-- Also, the interdependent network of information technology infrastructures that includes the

Internet, telecommunications networks, computers, information or communications systems, networks,

and embedded possessors and controllers. (PPD-20, U.S. Cyber Operations Policy (U), 16 Oct 2012)

-- Also, the interdependent network of information technology infrastructures, and includes the

Internet, telecommunications networks, computer systems, and embedded possessors and controllers

in critical industries. (NSPD-54 / HSPD-23, 8 Jan 2008)

-- Also, the range of information and resources available through computer networks - especially the

Internet. (ODNI Cyberspace Initiative)

-- Also, a global domain within the information environment consisting of the independent network of

information technology infrastructures, including the Internet, telecommunications networks, computer

systems, and embedded processors and controllers. (CNSSI No. 4009, National Information Assurance

Glossary, 26 April 2010)

-- Adapted from RAND Graphic

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

In cyberspace, the war has begun…

Cyberspace is a decentralized domain characterized by increasing global connectivity, ubiquity,

and mobility, where power can be wielded remotely, instantaneously, inexpensively, and

anonymously. This environment presents enormous challenges and unprecedented opportunities…

Cyberspace is a domain that requires man-made technology to enter and exploit. Effects of

cyberspace operations can occur simultaneously in many places and they can be precise, broad,

enduring and transitory.

Challenges -- Our national security is inextricably linked to the cyberspace domain, where conflict

is not limited by geography or time. Cyberspace crosses geographic and jurisdictional boundaries.

The expanding use of cyberspace places United States’ interests at greater risk from cyber threats

and vulnerabilities. Cyber actors can operate globally, within our own borders, and within the

borders of our allies and adversaries. The complexity and amount of activity in this evolving domain

make it difficult to detect, interdict, and attribute malicious activities.

Threats to cyberspace pose one of the most serious economic and national security challenges

of the 21^st Century for the United States and our allies. On the flip side -- cyberspace offers DoD

unprecedented opportunities to shape and control the battlespace to achieve national objectives.

_________________________

Cyberspace will become a main front in both irregular and traditional conflicts. Enemies in

cyberspace will include both states and non-states and will range from the unsophisticated amateur

to highly trained professional hackers. Through cyberspace, enemies will target industry, academia,

government, as well as the military in the air, land, maritime, and space domains. In much the

same way that airpower transformed the battlefield of World War II, cyberspace has fractured the

physical barriers that shield a nation from attacks on its commerce and communication. Indeed,

adversaries have already taken advantage of computer networks and the power of information

technology not only to plan and execute savage acts of terrorism, but also to influence directly the

perceptions and will of the U.S. Government and the American population.

-- The Joint Operating Environment 2010, US Joint Forces Command

__________________________

“[I]n cyberspace some malicious actors consider that no boundaries

exist between military and civilian targets.”

-- Congressional Research Service, Report RL32114 (29 Jan 2008)

__________________________

“…the United States will respond to hostile acts in cyberspace,

as we would to any other threat to our country.”

-- International Strategy for Cyberspace, May 2011

__________________________

"Cyberspace is contested every day, every hour, every minute, every second.

[The internet] lowers the bar for entry to the espionage game, both for

states and for criminal actors. The threat is complex and not easily

addressed by just building the security walls higher and higher."

-- Iain Lobban, Chief GCHQ, 13 October 2010

__________________________

"The myth persists that the United States hasn’t been invaded since 1812.

I’d like to inform you otherwise. And that is the fact that invasion

through cyberspace is now a daily occurrence.”

-- Frank Ciffullo, Center for Strategic & International Studies

__________________________

“The cyber threat is serious, with potential consequences similar

in some ways to the nuclear threat of the Cold War”

-- Defense Science Board, Jan 2013

__________________________

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

For additional information see:

-- DoD website at: <http://www.defense.gov/home/features/2011/0411_cyberstrategy/>

-- International Strategy for Cyberspace, May 2011

-- DoD Strategy for Operating in Cyberspace (U), May 2011 (classified version)

-- DoD Strategy for Operating in Cyberspace, July 2011 (unclassified version)

Copy available at <http://www.defense.gov/home/features/2011/0411_

cyberstrategy/docs/DoD_Strategy_for_Operating_in_Cyberspace_July_2011.pdf>

-- ONCIX, Foreign Spies Stealing US Economic Secrets in Cyberspace: Report to Congress

on Foreign Economic Collection and Industrial Espionage, 2009-2011, October 2011

-- DSS, Targeting US Technologies: A Trend Analysis of Reporting from Defense Industry -

2012

-- Defense Science Board, Task Force Report: Resilient Military Systems and the Advanced

Cyber Threat, Jan 2013

Copy at: <http://www.acq.osd.mil/dsb/reports/ResilientMilitarySystems.CyberThreat.pdf>

Cyberspace Domain. A domain characterized by the use of electronics and electromagnetic spectrum

to store, modify, and exchange data via networked systems and associated physical infrastructures.

(Previously defined in DoDI S-5240.17, CI Collection, 12 Jan 2009)

Cyberspace Operations. The employment of cyber capabilities where the primary purpose is to achieve

military objectives in or through cyberspace. (JP 1-02; and JP 3-0, Joint Operations, 11 Aug 2011)

Cybervetting. Checking blogs, social media sites, and other Internet-based sources to identify issues of

security concern applicable to people holding or seeking positions of trust. (PERSEREC; accessed 9 Jan

2013)

PERSEREC’s initial effort regarding cybervetting entailed working with the national security and

law enforcement communities to identify the primary legal, privacy, policy, and procedural

considerations that should be taken into account when establishing a cybervetting program. Pilot

projects are planned to test the efficacy of cybervetting. In addition, a series of CyberPsychology

studies are exploring how certain types of activities in cyber environments, such as Second Life,

can spill over into negative affects [sic] on workplace reliability, judgment, and other areas of

personnel security concern.

-- PERSEREC at <http://www.dhra.mil/perserec/currentinitiatives.html#Cyber> (accessed 9 Jan 2013)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

D ==========================================

Damage. A loss of friendly effectiveness due to adversary action. Synonymous with harm. (DSS

Glossary)

Damage Assessment. [In intelligence usage,] a determination of the effect of a compromise of classified

information on national security. (JP 1-02 and JP 3-60, Joint Targeting, 13 Apr 2007)

-- Also, the analysis of the impact on national security of a disclosure of classified information to an

unauthorized person. (IC Standard 700-1, 4 Apr 2008)

-- Also, systematic analysis that determines the impact of a compromise of classified information on

the national security of the United States. (CI Community Lexicon)

-- Also, systematic, comprehensive examination of an intentional and/or inadvertent compromise of

classified or sensitive information. (ONCIX, Damage Assessment Guide (U), 21 Mar 2008)

See ONCIX’s Damage Assessment Guide - October 2009 (U) for a standardized framework and

outline of the processes and procedures involved in national-level damage assessment activity.

Damage to the National Security. Harm to the national defense or foreign relations of the United States

from unauthorized disclosure of information, taking into consideration such aspects of the information as

the sensitivity, value, utility, and provenance of that information. (EO 13526, Classified National Security

Information, 29 Dec 2009)

Danger Signals. Prearranged signals or marks on walls, posts, etc., [used] as a communication system

between agents or [case] officers to indicate that the opposition or active enemy is nearby, has been

tipped off, or has the area under surveillance. (TOP SECRET: The Dictionary of Espionage and

Intelligence, 2005)

Dangle. A person controlled by one intelligence service who is made to appear as a lucrative and

exploitable target to an opposing intelligence service. (HDI Lexicon, April 2008) Also see dangle

operation; double agent; penetration; provocation.

-- Also, an asset placed within the professional or personal view of a FIS [Foreign Intelligence

Service] officer or agent with the intention of observing the actions of and possibly being recruited by the

FIS. (AFOSI Manual 71-142, OFCO, 9 Jun 2000)

-- Also, counterespionage terminology for the process of presenting an individual to a foreign

intelligence service in a manner as to encourage his recruitment as an agent; as “to dangle” or a dangle

operation. (CIA in D&D Lexicon, 1 May 2002)

-- Also, an individual who deliberately appears available for recruitment. (Encyclopedia of Espionage,

Spies, and Secret Operations, 3^rd Edition, 2012)

If you wait for the enemy to come to you, you may not know when he does.

…If the fish do not swim into your net, you have to give them a lure, a provocation, something that

looks like a juicy worm but that has a hook in it.

-- William R. Johnson, Thwarting Enemies at Home and Abroad (2009)

________________________

…dangles were a doubled-edged sword, whose specter overshadowed every decision to recruit

agents we believed to be real. …Fear of them caused both the KGB and CIA to turn away

countless volunteers.

-- Victor Cherkashin, Former KGB Intelligence Officer and author of Spy Handler (2005)

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Dangle Operation. An operation in which an enticing intelligence target is dangled in front of an

opposition service in hopes they will think him or her a bona fide recruit. The dangle is really a double

agent. (Spy Dust) Also see dangle; double agent penetration; provocation

Database. Within DoD: None - term removed from JP 1-02.

Previously defined in JP 2-0, Joint Intelligence (22 Jun 2007) as: information that is normally

structured and indexed for user access and review. Databases may exist in the form of physical

files (folders, documents, etc.) or formatted automated data processing system data files.

Data Mining. A program involving pattern-based queries, searches or other analyses of I or more

electronic databases, where -- (a) a department or agency of the Federal Government. or a non-Federal

entity acting on behalf of the Federal Government, is conducting the queries, searches, or other analyses

to discover or locate a predictive pattern or anomaly indicative of terrorist or criminal activity on the part of

any individual or individuals; (b) the queries, searches, or other analyses are not subject-based and do

not use personal identifiers of a specific individual. or inputs associated with a specific individual or group

of individuals, to retrieve information from the database or databases; and (c) the purpose of the queries,

searches, or other analyses is not solely- (i) the detection of fraud, waste, or abuse in a Government

agency or program; or (ii) the security of a Government computer system. (Data Mining Reporting Act,

§804(b)(I)(A))

This definition limits covered activities to predictive, pattern-based data mining, which is significant

because analysis performed within the ODNI and its constituent elements for counterterrorism and

similar purposes is often performed using various types of “link analysis” tools.

Unlike "pattern-based" tools, these link analysis tools start with a known or suspected terrorist or

other subject of foreign intelligence interest and use various methods to uncover links between that

known subject and potential associates or other persons with whom that subject is or has been in

contact. The Data Mining Reporting Act does not include such analyses within its definition of "data

mining" because such analyses are not "pattern-based."

-- ODNI 2009 Data Mining Report

____________________________

Data mining is finding key pieces of intelligence that may be buried in the mass of data available.

Data mining uses automated statistical analysis techniques to search for the specific data

parameters that intelligence professionals predetermine will answer their information requirements.

Data mining can help organize the mass of collected data.

-- ADRP 2-0, Intelligence, Aug 2012, p. 3-6

DCAT. See Defense Counterintelligence Anomalies Team.

DCII. See Defense Central Index of Investigations.

DCIP. See Defense Critical Infrastructure Program.

DCIP Assessment. A comprehensive assessment of a Defense Critical Asset consisting of an in-depth

look based on current DoD DCIP Assessment benchmarks. (CJCSI 3209.01, Defense Critical

Infrastructure Program, 9 Jan 2012) Also see Defense Critical Infrastructure Program.

DCIP CI Coverage Plan. A formally coordinated, comprehensive plan that outlines the CI support to DCA

and Tier 1 TCA protection. A DCIP CI coverage plan is prepared by the critical asset manager and

identifies the appropriate support of DoD, non-DoD, and other CI elements necessary to the development

and validation of DoD-wide CI support to the DCIP. (DoDI 5240.19, CI Support to DCIP, 31 Jan 2014).

Also see Defense Critical Infrastructure Program.

If a “CI Support Plan (CISP)” has been developed for the DCIP organization and meets the

requirements of the DCIP CI Coverage Plan IAW DoDI 5240.19 (Table 2) then another plan is not

required. For CISPs see DoD Instruction 5240.24, Counterintelligence Activities Supporting RDA.

100

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

DCIP Threat Assessment. A compilation of strategic intelligence information incorporating multi-faceted

threats facing DCAs [Defense Critical Assets] and Tier 1 TCAs [Task Critical Assets]. DCIP threat

assessments address threats posed to DCAs from domestic and transnational terrorist elements, foreign

intelligence and security services, and weapons of mass destruction. (DoDI 5240.19, CI Support to DCIP,

31 Jan 2014) Also see Defense Critical Infrastructure Program.

Dead Drop. A clandestine location for transferring material to or from an agent or asset. (National

HUMINT Glossary)

-- Also, a place where a person might leave communications or material in concealment for another

person. It serves as a cutout between human elements of a clandestine organization. (AFOSI Instruction

71-101, 6 Jun 2000)

-- Also, a place, unattended by witting individuals, to which communications, materials, or equipment

can be left by one individual and from which they can be taken by another individual without either

meeting or, ordinarily, seeing one another. Also called a dead letter box, or simply drop. (AFOSI Manual

71-142, OFCO, 9 Jun 2000)

-- Also, a prearranged hidden location used for the clandestine exchange of packages, messages,

and payments, which avoids the necessity of an intelligence officer and an agent being present at the

same time. (FBI -- Affidavit: USA vs. Robert Philip Hanssen, 16 Feb 2001)

-- Also, a secret location where materials can be left in concealment for another party to retrieve.

This eliminates the need for direct contact in hostile situations. (CI Centre Glossary)

-- Also, a preferred means of covert communications in denied areas, separates the agent and

handler [case officer] by time, but carries the risk of leaving the package unattended in an environment

that could change without warning. (Spycraft, p. 61)

-- Also, pre-cased hiding places used by intelligence services to conduct [clandestine] exchanges with

agents. (James M. Olson, Fair Play: The Moral Dilemmas of Spying, 2006)

-- Also, a predetermined secret location where [case] officers and agents leave messages and other

items for undetected collection by other parties. (Encyclopedia of the CIA, 2003)

-- Also, a clandestine communications technique, the dead drop allows agents to exchange

messages and other items without the need for a meeting that might attract the attention of hostile

surveillance. The dead drop is usually an innocuous, prearranged site where a package or film canister

can be secreted temporarily so it can be recovered by the addressee. Ideally, the location is sufficiently

innocent to enable both parties to visit it, at different times, without compromising themselves. The use of

dead drops is standard tradecraft for espionage professionals, and is usually associated with a remote

signaling arrangement so both sides can indicate to the other when a particular drop is ready for

servicing. The objective is to obviate the need for personal contact that in denied areas is high risk.

(Historical Dictionary of Cold War Counterintelligence, 2007)

Eliminates the need for direct contact…

In intelligence usage, dead drops are used as a clandestine cut-out to avoid personal meetings

which can draw attention to the connection between an intelligence officer/agent handler and an

agent/asset. As a rule, a dead drop site is not used more than once.

For a detailed description of dead drops and concealment devices, see Spycraft, pp. 388-400.

101

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Debriefing. Systematically covering topics and areas with a voluntary source who consents to a formal

interview. (Educing Information - Interrogation: Science and Art, Dec 2006) Also see strategic debriefing;

educing information; elicitation; intelligence interrogation; interrogation; interview.

-- Also, the systematic questioning of individuals to procure information to answer specific collection

requirements by direct and indirect questioning techniques. (Defense HUMINT Enterprise Manual

3301.002, Vol II Collection Operations, 23 Nov 2010; also Army FM 2-22.3, HUMINT Collector

Operations, 6 Sep 2006)

-- Also, [in detainee operations] the process of using direct questions to elicit intelligence information

from a cooperative detainee to satisfy intelligence requirements. (DoDD 3115.09, DoD Intelligence

Interrogations, Detainee Debriefings, and Tactical Questioning, 11 Oct 2012 w/ chg 1 dated 15 Nov 2013)

-- Also, interviewing under other than hostile conditions, of an individual who has completed an

intelligence assignment or who has, through observation, participation, or personal knowledge,

information of intelligence or counterintelligence value or significance. (AR 381-20, Army CI Program,

25 May 2010)

Counterintelligence debriefings are forms of overt collection entailing the questioning of human

sources to satisfy CI requirements.

Debriefings are conducted to obtain CI information acquired by the Component’s own employees

in the course of their duties. CI debriefings are also used to exploit the opportunity presented by

walk-ins and other persons who contact CI elements to provide information of potential CI interest.

-- DoDI S-5240.17, (U) CI Collection Activities, 14 Mar 2014 (encl 3, para 2c(1))

Also see Appendix C “Counterintelligence Collection Methods (U)” in JP 2-01.2, Counterintelligence

and Human Intelligence in Joint operations (U), 16 Mar 2011 w/ chg 1 dated 26 Aug 2011.

Debriefing Operations. Operations conducted to debrief cooperating sources may include refugees,

émigrés, displaced persons (DPs), local populace, friendly forces, members of U.S. and foreign

governmental and non-governmental organizations, as well as U.S. and foreign personnel employed

within the academic, business, or scientific communities. The source may or may not be in custody, and

their willingness to cooperate need not be immediate or constant. (DHE-M 3301.002, Vol II Collection

Operations, 23 Nov 2010)

Decentralized Execution. Delegation of execution authority to subordinate commanders. (JP 1-02)

Deception. Those measures designed to mislead the enemy by manipulation, distortion, or falsification

of evidence to induce the enemy to react in a manner prejudicial to the enemy's interests. (JP 1-02 and

JP 3-13.4, Military Deception, 13 Jul 2006) Also see counterdeception; deception means; deception in

support of OPSEC; denial, military deception.

-- Also, deliberately manipulating information and perceptions in order to mislead. (Foreign Denial &

Deception Committee, 30 Mar 2006)

-- Also, an action intended by an actor to influence the perceptions, decisions, and actions of another.

(CIA, A Tradecraft Primer: Structured Analytical Techniques for Improving Intelligence Analysis, June

2005)

-- Also, any attempt—by words or actions—intended to distort another person’s or group’s perception

of reality. (Textbook of Political-Military Counterdeception: Basic Principles & Methods, August 2007)

Deception is a fundamental ingredient of military art.

All warfare is based on deception.

-- Sun Tzu (400-320 B.C.)

102

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Deception is the distortion of perceived reality

“Deception is an instrument of policy…. [It] must be orchestrated to succeed.”

-- William R. Johnson, Thwarting Enemies at Home and Abroad (2009)

Analysts should routinely consider that their information base is susceptible to deception-- the

distortion of perceived reality.

Richard Heuer, author of Psychology of Intelligence Analysis, notes that analysts often reject the

possibility of deception because they see no evidence of it. He then argues that rejection is not

justified under these circumstances. If deception is well planned and properly executed, one should

not expect to see evidence of it readily at hand. Rejecting a plausible but unproven hypothesis too

early tends to bias the subsequent analysis, because one does not look for the evidence that might

support it. The possibility of deception should not be rejected until it is disproved or, at least, until a

systematic search for evidence has been made and none has been found.

See Deception 101 -A Primer on Deception (2004) by Joseph W. Caddell; available online at:

<http://www.strategicstudiesinstitute.army.mil/pubs/display.cfm?pubID=589>

Also see Textbook of Political-Military Counterdeception: Basic Principles & Methods (2007) by

Barton Whaley, published by the National Defense Intelligence College.

O, what a tangled web we weave,

When first we practise to deceive!

-- Sir Walter Scott, Marmion (1808)

MASKIROVKA

According to a declassified 1983 White House National Security Decision Directive --

The Soviet Union… doctrine of "maskirovka" [called] for the use of camouflage, concealment and

deception (CC&D) in defense-related programs and in the conduct of military operations. They

define maskirovka as a set of measures to deceive, or mislead, the enemy with respect to Soviet

national security capabilities, actions, and intentions. These measures include concealment,

simulation, diversionary actions and disinformation.

-- National Security Decision Directive 108, Soviet Camouflage, Concealment and Deception, 12 Oct 1983

(declassified). Copy available at <http://www.fas.org/irp/offdocs/nsdd/nsdd-108.pdf>

Deception Channel. A means by which controlled information can be reliably transmitted to the target.

(CIA in D&D Lexicon, 1 May 2002)

Feeding the enemy self-destructive information is the oldest of arts…. A successful feed should

not be considered an operation in and of itself, but rather the fruit of a long fight for control over a

channel of information. Therein lies the art.

-- Angelo Codevilla, Informing Statecraft: Intelligence for a New Century (1992), p. 349

Deception In Support of OPSEC (DISO). A military deception activity that protects friendly operations,

personnel, programs, equipment, and other assets from FISS [Foreign Intelligence Security Service]

collection. (DoDI S-3604.01, Department of Defense Military Deception, 11 Mar 2013) Also see

deception, military deception.

The intent of DISO is to create multiple false indicators to confuse FISS, make friendly intentions

harder to interpret by FISS, or to limit the ability of FISS to collect accurate intelligence on friendly

forces.

DISOs are not targeted against adversary military, paramilitary, or violent extremist organization

decision-makers with the intent of eliciting a particular decision or reaction, but are targeted against

a FISS or an adversary’s intelligence collectors to protect friendly forces by masking, simulating, or

dissimulating signatures and observables needed to ascertain friendly capabilities, intent, or

vulnerabilities.

103

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

Deception Means. Methods, resources, and techniques that can be used to convey information to the

deception target. There are three categories of deception means: 1) physical means -- activities and

resources used to convey or deny selected information to a foreign power; 2) technical means -- military

material resources and their associated operating techniques used to convey or deny selected

information to a foreign power; and 3) administrative means -- resources, methods, and techniques to

convey or deny oral, pictorial, documentary, or other physical evidence to a foreign power. (JP 1-02 and

JP 3-13.4, Military Deception, 13 Jul 2006)

-- Also, the vehicles or resources for conveying the deception story or deception-related information

directly or indirectly to the target. These generally consist of sources accepted by the target as reliable or

believable. Deception means have been subdivided into: physical, technical, administrative, and special

means. (CIA in D&D Lexicon, 1 May 2002)

Deception Target. The adversary decisionmaker with the authority to make the decision that will achieve

the deception objective. (JP 1-02 and JP 3-13.4, Military Deception, 13 Jul 2006)

Decipher. Convert enciphered text to plain text by means of a cryptographic system. (CNSSI No. 4009,

National Information Assurance Glossary, 26 April 2010)

Declared. An individual or action whose intelligence affiliation is disclosed. (HDI Lexicon, April 2008)

-- Also, an officer, asset, agent, or action whose Agency affiliation is formally identified to a foreign

intelligence or security service, government or organization, or other USG entity. (National HUMINT

Glossary)

Declassification. The authorized change in the status of information from classified information to

unclassified information. (EO 13526, Classified National Security Information, 29 Dec 2009 and DoD IG

Evaluation Guide, 22 Jan 2013)

Deconfliction. The process of sharing information regarding collection between multiple agencies to

eliminate potential duplication of effort, multiple unintended use of the same source, or circular reporting.

(Previously in DoDI S-5240.17, CI Collection, 12 Jan 2009)

Decoy. An imitation in any sense of a person, object, or phenomenon which is intended to deceive

enemy surveillance devices or mislead enemy evaluation. (JP 1-02).

Decode. Convert encoded text to plain text by means of a code. (CNSSI No. 4009, National Information

Assurance Glossary, 26 April 2010)

Decrypt. Generic term encompassing decode and decipher. (CNSSI No. 4009, National Information

Assurance Glossary, 26 April 2010)

Deduction. [One of the four basic types of reasoning applied to intelligence analysis,] it is the process of

reasoning from general rules to particular cases. Deduction may also involve drawing out or analyzing

premises to form a conclusion. (Cited in (DIA, Intelligence Essentials for Everyone, June 1999) Also see

abduction; induction; scientific method.

For additional information see Knowledge Management in the Intelligence Enterprise by Edward

Waltz (2003) and Critical Thinking and Intelligence Analysis by David Moore, JMIC Press (2006).

Deep Cover. A cover for status designed to withstand close scrutiny by the opposition or through due

diligence. (National HUMINT Glossary)

Defection. Conscious abandonment of loyalty, duty, and principle to one’s country. (AFOSI Manual

71-142, OFCO, 9 Jun 2000)

104

Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)

__________________________________________________________________________________________________

-- Also, conscious (mental and/or physical) abandonment of loyalty, allegiance, duty, and principle to

one’s country. (ICS Glossary)

Defector. A person who has consciously abandoned loyalty to his country and who possess intelligence

information of value to another country or countries. (CI Community Lexicon)

-- Also, a person who, for political or other reasons, has repudiated his country and may be in

possession of information of interest to the US Government. (ICS Glossary)

-- Also, a person of any nationality, usually from a country whose interests are hostile or inimical to

the U.S., who has escaped from the control of his or her country, is unwilling to return to that country, and

is of special value to the U.S. Government because: he or she is able to add valuable new or confirmatory

information to existing U.S. intelligence knowledge; he or she is, or has been, of operational or political

value to a U.S. department or agency; or the defection can be psychologically exploited to the advantage

of the U.S. (Defense HUMINT Enterprise Manual 3301.002, Vol II Collection Operations, 23 Nov 2010)

“Next to penetrations (moles), defectors are

your best weapon against alien intelligence services.”

-- William R. Johnson, Thwarting Enemies at Home and Abroad (2009)

____________________

An act of treason - a “defector is an individual who has committed treason, a person who first

accepted identification with a regime and then betrayed his allegiance to cooperate with a hostile

foreign intelligence service.”

-- Wilhelm Marbes, “Psychology of Treason,” in Studies of Intelligence, vol. 30, no. 2 (Summer 1986),

pp. 1-11. Originally classified “Secret” [declassified].

____________________

Defectors “…certainly the next best thing to penetration. But defector information was finite: it

ceased the moment the defector stepped out of his office and crossed to our side.”

-- Richard Helms, A Look Over My Shoulder: A Life in the Central Intelligence Agency(2003)

____________________

"It's the job of intelligence agencies to distinguish between defectors who claim to have something

to say and defectors who are lying and they obviously didn't do their job. The Germans didn't, and

we didn't."

-- Richard Perle regarding the Iraqi defector CURVEBALL, 15 Feb 2011

____________________

“Sometimes the bona fides of a defector remain in dispute for many years, as is the case of Yuri

Nosenko, who defected from the U.S.S.R. soon after the assignation of President John F. Kennedy

in 1963.”

-- Loch K. Johnson and James J. Wirtz, Intelligence and National Security: The Secret World of Spies

(2008), p.299

Defector in Place. See recruitment-in-place.

Defense Attaché. See Senior Defense Official / Defense Attaché (SDO/DATT).

Defense Attaché Office (DAO). An organizational element of the U.S. diplomatic mission through which

the Defense Attaché System conducts its mission and to which may be attached or assigned such other

military detachments or elements as the Secretary of Defense may direct. (DoDI C-5105.32, Defense

Attaché System, 18 Mar 2009) Also see Senior Defense Official / Defense Attaché (SDO/DATT).

-- Also, a DoD organization established as part of the U.S. diplomatic mission, through which the

mission of the Defense Attaché System is accomplished. (DoDI C-5105.81, Implementing Instructions for

DoD Operations at U.S. Embassies, 6 Nov 2008)

105

Military reference books and manuals (2009-2023, Volume 4) - page 9