Military reference books and manuals (2009-2023, Volume 4) - page 10
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Central Index of Investigations (DCII). An automated DoD repository that identifies
investigations conducted by DoD investigative agencies. DCII does not contain eligibility information.
(IC Standard 700-1, 4 Apr 2008)
Effective 26 July 2010, DCII is operated and maintained by the Defense Manpower Data Center
(DMDC) on behalf of the DoD components and USD(I). See website at: <https://dcii.dmdc.osd.mil>
Access to DCII is normally limited to DoD and other federal agencies that have adjudicative,
investigative and/or counterintelligence missions. Although the DCII database is physically
maintained by the DMDC the data it contains is the responsibility of the contributing agencies.
-- Also, a centralized database, organized in a searchable format, of selected unique identifying
information and security clearance data utilized by security and investigative agencies in the DoD, as well
as selected other Federal agencies, to determine security clearance status and the existence or physical
location of criminal and personnel security investigative files. The DCII database is physically maintained
by the Defense Manpower Data Center; however, the data that it contains is the responsibility of the
contributing agencies. (DoDI 5505.7, Titling & Indexing Subjects of Criminal Investigations in DoD, 27 Jan
2012)
-- Also, an alphabetical index of personal names and impersonal titles that appear as subjects of
incidents in investigative documents held by the criminal, counterintelligence, fraud, and personnel
security investigative activities of the Defense Investigative Service (DIS), the Defense Criminal
Investigative Service (DCIS), and the NSA. DCII records will be checked on all subjects of DOD
investigations. (AR 380-67, Personnel Security Program, 24 Jan 2014)
Defense Clandestine Service (DCS). The primary DoD element authorized to conduct clandestine human
intelligence (HUMINT) operations is response to high priority national-level intelligence requirements as
identified by the USD(I). DCS shall operate worldwide, to include high CI threat and politically sensitive
environments. Also see National Clandestine Service.
Also see classified SECDEF memorandum, subj: (U) Established of the Defense Clandestine
Service, 20 Apr 2012
-- Also, [a DoD organization that] conducts human intelligence (HUMINT) operations to answer
national-level defense objectives for the President, the Secretary of Defense, and senior policymakers.
The civilian and military workforce of the DCS conducts clandestine and overt intelligence operations in
concert with the Central Intelligence Agency, the Federal Bureau of Investigation, and our Military
Services to accomplish their mission in defense of the Nation. (www.dia.mil/dcs/; accessed 5 Sep 2013)
Defense Combating Terrorism Center (DCTC). A functional center with the Defense Intelligence Agency
focused on terrorism intelligence and related issues within DoD.
Previously known as the Joint Intelligence Task Force for Combating Terrorism (JITF-CT). In the
fall of 2012, JITF-CT, the Joint Threat Finance Intelligence Office (JTFI), selected elements from
the Defense CI & HUMINT Center, and DIA elements from the Counternarcotics and Western
Hemisphere Office (CNW), transitioned into a single center -- the Defense Combating Terrorism
Center (DCTC).
DCTC is the lead national-level, all-source international terrorism intelligence effort within DoD. It is
DoD’s all-source national-level intelligence fusion center responsible for enabling DoD counter-
terrorism and force protection operations. DCTC analytical assessments address terrorist
capabilities, activities and intentions, including terrorist finance activity; see DoDD 2000.12 and
DoDI 2000.12.
DIA’s Office of Counterintelligence(OCI) focuses on the intelligence apparatus and intelligence
activities of international terrorists. In
instances where the two missions intersect, DCTC and OCI
collaborate and coordinate to ensure that DIA presents a timely, accurate, and consistent picture of
the threat to U.S. forces and interests around the world.
106
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Counterintelligence and Human Intelligence Center (DCHC). Previously a center within the
Defense Intelligence Agency (DIA) for counterintelligence and human intelligence that was established on
3 August 2008. DCHC was disestablished 28 Jan 2013 by Dir DIA (DIA Vision2020).
Defense Counterintelligence Anomalies Team (DCAT). [DoD CI element that] provides analysis and
deconfliction of anomalies and identifies and shares CI insider threat trends with the DoD Components.
The DCAT develops, promotes, expands, and improves upon insider threat detection efforts by reaching
across organization boundaries and cultivating awareness of anomalies. (DoD Manual 5240.26, CI
Insider Threat Program, draft 20 Nov 2013) See anomalies.
DoD Components report and handle “anomalies” in accordance with DoDD O-5240.02
(Counterintelligence) and DoDI 5240.26 (Countering Espionage, International Terrorism, and the CI
Insider Threat).
Defense Counterintelligence Components. DoD organizations that perform national and DoD
counterintelligence and counterintelligence-related functions, including the DoD Counterintelligence Field
Activity and the counterintelligence elements of the Military Departments, the Defense Agencies with
organic counterintelligence, the Joint Staff, the Office of the Secretary of Defense, and the Combatant
Commands. (DoDD 5143.01, USD/I, 23 Nov 2005)
Defense Counterintelligence Enterprise. The collective of DoD organizations authorized to conduct
counterintelligence and related activities. See Defense Counterintelligence Components,
Defense Counterintelligence Knowledge Base (DCIKB). Serves the Defense CI enterprise as the web-
enabled system for collecting observations of CI best practices and lessons learned, disseminating these
across DoD CI, conducting triage for further action and facilitating change.
DCIKB collects, analyzes, manages, and disseminates knowledge gained through operational
experience, exercises, and supporting activities in order to achieve higher levels of performance
and to provide information and analysis on emerging issues and trends.
-- NIPRNet website at: <https//sss.mccll.usmc/dcikb>
-- SIPRNet website at: <www.mccll.usmc.smil.mil/dcikb>
Defense Counterintelligence Manager. The official responsible who provides the centralized
management of Defense CI Enterprise-wide activities. (DoDD O-5240.02, CI, 20 Dec 2007 with change 1
dated 30 Dec 2010)
Director DIA serves as the Defense CI Manager, with responsibility to provided for central
management of Defense CI Enterprise-wide activities (see O-DoDD 5240.02, para 5.3.1).
This role is a corollary to the Director DIA’s role as the Defense HUMINT Manager; see Defense
HUMINT Manager.
Defense Courier Service (DCS). A global courier network for the expeditious, cost-effective, and secure
distribution of highly classified and sensitive material.
For DoD policy see DoDI 5200.33, Defense Courier Operations (DCO), 30 Jun 2011.
DCS is under the United States Transportation Command (USTRANSCOM). On 15 November
2005, the Defense Courier Division (TCJ3-C) assumed operational control of worldwide defense
courier stations and continues to synchronize the defense courier related activities of the
USTRANSCOM staff. See web site at: <http://www.transcom.mil/dcd/> Note: DCS was previously
known as the Armed Forces Courier Service (ARFCOS).
Defense Criminal Investigative Service (DCIS). The criminal investigative arm of the Inspector General
(IG) of the Department of Defense responsible for investigating: terrorism; technology/munitions theft &
diversion; cyber crime; substandard/defective products; and fraud, bribery & corruption. (DCIS - see
website at <http://www.dodig.mil/INV/DCIS/index.html>)
107
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Criminal Investigative Organizations (DCIOs). The Defense Criminal Investigative Service, the
U.S. Army Criminal Investigation Command, the Naval Criminal Investigation Service, and the Air Force
Office of Special Investigations. (DoDI 5505.7, Titling & Indexing Subjects of Criminal Investigations in
DoD, 27 Jan 2012)
Defense Critical Asset (DCA). An asset of such extraordinary importance to operations in peace, crisis,
and war that its incapacitation or destruction would have a very serious, debilitating effect on the ability
of the Department of Defense to fulfill its missions. (DoDD 3020.40, DoD Policy and Responsibilities for
Critical Infrastructure, 14 Jan 2010 w/ chg 2 dated 21 Sep 2012) Also see defense critical infrastructure
program (DCIP); task critical asset (TCA).
Defense Critical Infrastructure (DCI). The composite of DoD and non-DoD assets essential to project,
support, and sustain military forces and operations worldwide. DCI is a combination of task critical assets
and defense critical assets. (DoDD 3020.40, DoD Policy and Responsibilities for Critical Infrastructure,
14 Jan 2010 w/ chg 2 dated 21 Sep 2012) Also see defense critical infrastructure program (DCIP).
-- Also, Department of Defense and non-Department of Defense networked assets and facilities
essential to project, support, and sustain military forces and operations worldwide. (JP 3-27, Homeland
Defense, 29 Jul 2013)
-- Also, DoD and non-DoD cyber and physical assets and associated infrastructure essential to
project and support military forces worldwide. (DoD Strategy for Homeland Defense & Civil Support)
Defense Critical Infrastructure Program (DCIP). A DoD risk management program that seeks to ensure
the availability of DCI [Defense Critical Infrastructure]. (DoDD 3020.40, DoD Policy and Responsibilities
for Critical Infrastructure, 14 Jan 2010 w/ chg 2 dated 21 Sep 2012) Also see defense critical asset,
defense critical infrastructure, task critical asset.
DCIP is an integrated risk management program designed to support DoD mission assurance.
The purpose of the DCIP is to ensure the availability of Defense Critical Infrastructure in an all-
threat and all-hazard environment.
Key DCIP references include:
-- DoD, Strategy for Defense Critical Infrastructure, March 2008
-- DoDD 3020.40, DoD Policy & Responsibilities for Critical Infrastructure, 14 Jan 2010 with Chg 2
-- DoDI 3020.45, DCIP Management, 21 Apr 2008
-- DoDI 3020. 51, Intelligence Support to DCIP, 23 Jun 2011
-- DoDI 5240.19, CI Support to DCIP, 31 Jan 2014
-- DoD Manual 3020.45-M, Vol 3, DCIP Security Classification Manual, 15 Feb 2011
-- CJCSI 3209.01, Defense Critical Infrastructure Program, 9 Jan 2012
-- USSTRATCOM, Strategic Mission Assurance Data System (SMADS) User Manual, Apr 2013
DCIP is a evolving program, see web site at: <http://dcip.dtic.mil/>
Defense Cyber Crime Center (DC3). The Defense Computer Forensics Laboratory and the Defense
Computer Investigations Training Program comprise the Defense Cyber Crime Center. The forensics
laboratory provides counterintelligence, criminal, and fraud computer-evidence processing, analysis,
and diagnosis to DoD investigations. The investigations training program provides training in computer
investigations and computer forensics to DoD investigators and examiners. AFOSI is the DoD executive
agent for the Center. (DC3 web site)
DC3 sets standards for digital evidence processing, analysis, and diagnostics for any DoD
investigation that requires computer forensic support to detect, enhance, or recover digital media,
including audio and video. The Center assists in criminal, counterintelligence, counterterrorism,
and fraud investigations of the Defense Criminal Investigative Organizations (DCIOs) and DoD
counterintelligence activities. It also supports safety investigations and Inspector General and
commander-directed inquiries.
108
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
DC3 aids in meeting intelligence community document exploitation objectives from a criminal law
enforcement forensics and counterintelligence perspective. DC3 provides computer investigation
training to forensic examiners, investigators, system administrators, and any other DoD members
who must ensure Defense information systems are secure from unauthorized use, criminal and
fraudulent activities, and foreign intelligence service exploitation. DC3 remains on the leading edge
of computer technologies and techniques through research, development, testing, and evaluation
applied to digital evidence processing and computer forensic analysis; and by partnering with
governmental, academic, and private industry computer security officials.
-- DC3 web site at <http://www.dc3.mil/dc3/dc3About.php>
Also see DoDD 5505.13E, DoD Executive Agent for DC3, 1 Mar 2010
Defense HUMINT Enterprise (DHE). The collective of DoD organizations authorized to conduct HUMINT
and related activities under the centralized management of the DHM [Defense HUMINT Manager].
(DoDD S-3325.09, Oversight, Management, and Execution of Defense Clandestine Source Operations,
9 Jan 2013 w/ chg 1 dated 13 Jun 2013) Also see Defense Clandestine Service.
-- Also, the collective of DoD organizations authorized to conduct HUMINT and related activities.
(DoDD S-5200.37, Management & Execution of Defense HUMINT (U), 9 Feb 2009)
Defense HUMINT Executor. The senior DoD intelligence official as designated by the head of each of the
DoD components who are authorized to conduct human intelligence and related intelligence activities.
(JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)
Defense HUMINT Manager (DHM). The Director DIA, as designated by the USD(I), is the official
responsible for the centralized management of the DoD-wide HUMINT Enterprise. (DoDD S-5200.37,
Management and Execution of Defense HUMINT (U), 9 Feb 2009)
-- Also, [Dir DIA] serve as the Defense HUMINT Manager (DHM) responsible for centralized
management of the DoD-wide HUMINT enterprise, which is based on decentralized execution of HUMINT
operations and related activities. (DoDD 5105.21, DIA, 18 Mar 2008)
Defense Industrial Base (DIB). The Department of Defense, government, and private sector worldwide
industrial complex with capabilities to perform research and development, design, produce, and maintain
military weapon systems, subsystems, components, or parts to meet military requirements. (JP 1-02 and
JP 3-27, Homeland Defense, 29 Jul 2013)
DoD is responsible for critical infrastructure protection within the defense industrial base per PDD-21.
-- PDD-21, Critical Infrastructure Security and Resilience, 12 Feb 2013
_______________________
The DIB Sector consists of government and private sector organizations that can support military
operations directly; perform R&D; design, manufacture, and integrate systems; and maintain depots
and service military weapon systems, subsystems, components, subcomponents, or parts—all of
which are intended to satisfy U.S. military national defense requirements.
The government component of the DIB consists of certain laboratories, special-purpose
manufacturing facilities, capabilities for production of uniquely military material such as arsenals and
ammunition plats, and other services.
The private sector of the DIB consists of hundreds of thousands of independent, competing domestic
and foreign companies and supply chains, delivering a vast array of products and services to DoD.
DIB defense-related products and services equip, inform, mobilize, deploy, and sustain U.S. military
and allied military forces worldwide. The DIB companies also deliver national security products and
services to other federal agencies.
-- Defense Industrial Base Sector-Specific Plan: An Annex to the National Infrastructure Protection Plan,
2010, p. 15
109
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Infrastructure Sector (DIS), A virtual association within the DCIP that traverses normal
organizational boundaries and encompasses defense networks, assets, and associated dependencies
that perform similar functions within the Department of Defense and are essential to the execution of the
National Defense Strategy. (DoDD 3020.40, DoD Policy and Responsibilities for Critical Infrastructure,
14 Jan 2010 w/ chg 2 dated 21 Sep 2012)
IAW the DoDD 3020.40, the ten (10) defense infrastructure sectors are:
DIB Sector. The DoD, U.S. Government (USG), and private sector worldwide industrial complex
with capabilities to perform research, development, and design and to produce and maintain
military weapon systems, subsystems, components, or parts to meet military requirements.
Financial Services Sector. The DoD, USG, and private sector worldwide network and its supporting
infrastructure that meet the financial services needs of the Department of Defense across the range
of military operations.
GIG Sector. The globally interconnected, end-to-end set of information capabilities, associated
processes, and personnel for collecting, processing, storing, disseminating, and managing
information on demand to warfighters, policy makers, and support personnel. It includes all owned
and leased communications (commercial telecommunication infrastructure) and computing systems
and services, software (including applications), data, security services, and other associated
services necessary to achieve information superiority. It also includes National Security Systems as
defined in section 11103 of title 40, U.S.C. (Reference (n)).
Health Affairs Sector. The DoD, USG, and private sector worldwide healthcare network and its
supporting infrastructure that meet the healthcare needs of DoD personnel across the range of
military operations.
Intelligence Sector. Those DoD, USG, and private sector facilities, networks, and systems (assets)
located worldwide or extra-terrestrially that conduct and support the collection, production, and
dissemination of intelligence, surveillance, and reconnaissance information essential to the
execution of the National Military Strategy. These assets encompass human intelligence,
geospatial intelligence, measurement and signature intelligence, signals intelligence, open-source
intelligence, and technical intelligence; counterintelligence collection, processing, and exploitation
means; and all-source analysis and production, including the networks and means over which
intelligence information is shared, communicated, and/or disseminated.
Logistics Sector. The DoD, USG, and private sector worldwide facilities, networks, and systems
that support the provision of supplies and services to U.S. forces.
Personnel Sector. The DoD, USG, and private sector worldwide network that coordinates and
supports personnel and human resource functions of DoD personnel.
Public Works Sector. The DoD, USG, and private sector worldwide network, including the real
property inventories (environment, land, buildings, and utilities), that manages the support,
generation, production, and transport of commodities (e.g., electric power, oil and natural gas,
water and sewer, and emergency services) for and to the Department of Defense.
Space Sector. The DoD, USG, and private sector worldwide network, including both space- and
ground-based systems and facilities, that supports launch, operation, maintenance, specialized
logistics, and control systems for the space assets relied upon by the Department of Defense.
Transportation Sector. The DoD, USG, and private sector worldwide network that provides military
lift support (surface, sea, and air) for U.S. military operations.
Defense Infrastructure Sector Lead Agents (DISLAs). Designated DoD officials and their respective
defense sector organizations that perform defense infrastructure sector responsibilities. In coordination
with their respective PSAs [Principal Staff Assistants], the DISLAs characterize their defense
infrastructure sectors to identify functions, systems, interdependencies, and, ultimately, sector task critical
assets that support Combatant Command, Military Department, and Defense Agency missions and sector
functions. (DoDD 3020.40, DoD Policy and Responsibilities for Critical Infrastructure, 14 Jan 2010 w/ chg
2 dated 21 Sep 2012)
110
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Intelligence. Integrated departmental intelligence that covers the broad aspects of national
policy and national security and that intelligence relating to capabilities, intentions, and activities of foreign
powers, organizations, or persons, including any foreign military or military-related situation or activity
which is significant to Defense policy-making or the planning and conduct of military operations and
activities. Defense intelligence includes Active and Reserve military, strategic, operational, and tactical
intelligence. (DoDD 5143.01, USD/I, 23 Nov 2005)
Defense Intelligence Agency (DIA). A Department of Defense combat support agency and a member of
the United States Intelligence Community responsible for providing timely, objective, and cogent military
intelligence to warfighters, defense planners, and defense and national security policymakers. DIA is a
major producer and manager of foreign military intelligence.
DIA is the nation’s premier all-source military intelligence organization, providing the most
authoritative assessments of foreign military intentions and capabilities to U.S. military
commanders and civilian policymakers.
______________________
DIA’s core mission resides in four intelligence competencies: all-source analysis,
counterintelligence (CI), human intelligence (HUMINT), and measurement and signature
intelligence (MASINT).
-- 2012-2017 Defense Intelligence Agency Strategy
Copy available at: <http://www.dia.mil/about/strategic-plan/2012-2017-DIA-Strategic-Plan.pdf>
______________________
Director DIA serves as the Defense HUMINT Manager responsible for centralized management of
the DoD-wide HUMINT enterprise.
-- DoDI 5105.21, DIA, 18 Par 2008, para 6.2.1, p.5
DIA VISION2020
(IOC 28 Jan 2013)
VISION2020 [is] a transformational effort within DIA that redesigns and will fundamentally
reposition the Agency to better address our nation’s challenges. […]
VISION2020 aims to build a strong intelligence capability that will integrate and operationalize
intelligence to ensure the security of the United States well into the 21st Century.
DIA’s new center of gravity will be compromise of four Regional Centers (Asia/Pacific,
Europe/Eurasia, Middle East/Africa, and the Americas) and one Functional Center (Defense
Combating Terrorism Center DCTC))…
-- LTG Michael T. Flynn (USA), Director DIA
Defense Intelligence Analysis Program (DIAP). The DoD intelligence analysis community’s resource
allocation and prioritization program. The DIAP establishes the policies, procedures, responsibilities,
and levels of analytic effort required to provide timely, objective, and cogent intelligence to warfighters,
defense planners, and policymakers. (DoDI 5240.18, CI Analysis & Production, 17 Nov 2009 with change
1 dated 15 Oct 2013)
-- Also, a DIA developed intelligence analysis production plan to enhance the ability of defense
intelligence to focus on critical areas of national security interest, while maintaining a perspective on
potential emerging threats. (DIA)
GDIP Directive No. 006, Subject: Defense Intelligence Analysis Program, 31 Oct 2005, establishes
the policies, procedures, responsibilities, and levels of analytical effort required for Defense
intelligence to provide timely, objective, and cogent military intelligence to warfighters, defense
planners, and defense and national security policymakers. Program guidance and roles and
responsibilities posted on INTELINK at: <http://www.dia.ic.gov/admin/diap/index.htm>.
DIAP organizations are responsible for proactively producing intelligence on topics for which they
are assigned responsibility IAW Defense Intelligence Analysis Program Management Guidance,
24 Feb 2010. DIA’s Office of Counterintelligence is responsible for analyzing foreign intelligence
activities and threats to US Defense and Service interests.
111
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Intelligence Components. All DoD organizations that perform national intelligence, Defense
Intelligence, and intelligence-related functions, including: the Defense Intelligence Agency; the National
Geospatial-Intelligence Agency; the National Reconnaissance Office; the National Security Agency/
Central Security Service; and the intelligence elements of the Active and Reserve component of the
Military Departments, including the United States Coast Guard when operating as a service in the United
States Navy. (DoDD 5143.01, USD/I, 23 Nov 2005)
Defense Intelligence Enterprise. The Enterprise is comprised of intelligence, CI, and security
components of the Joint Staff, Combatant Commands, Military Departments, and other Department
elements, as well as those organizations under the authority, direction, and control of the Under Secretary
of Defense for Intelligence (USD(I)). (DIA, 2012-2017 Defense Intelligence Agency Strategy)
Defense Intelligence Operations Coordination Center (DIOCC). [Defense-level entity that] integrates and
synchronizes military and National Intelligence capabilities. The DIOCC plans, prepares, integrates,
directs, manages and synchronizes continuous full-spectrum Defense intelligence operations in support
of Combatant Commands. (CJCSM 3314.01, Intelligence Planning, 28 Feb 2007) Also see Joint
Intelligence Operations Center (JIOC).
To be disestablished per SECDEF memo, subj: Track Four Efficient Initiatives Decision, 14 Mar
2011 (p.43) which directs the disestablishment the DIOCC and the transfer of its functions to the
Joint Staff.
Defense Personnel Security Research Center (PERSEREC). A Department of Defense entity dedicated
to improving the effectiveness, efficiency and fairness of the DoD personnel security system.
PERSEREC was established in response to a recommendation by the DoD Security Review
Commission (known as the Stilwell Commission), set up in the wake of the very damaging Walker
espionage case, to improve DoD’s personnel security system. In its 1985 report, the commission
called for a personnel security research center to provide policymakers with an objective basis for
policies and processes related to the security clearance system.
PERSEREC report entitled, Espionage and Other Compromises of National Security: Case
Summaries from 1975 to 2008 (11 Aug 2009), provides summaries of 141 publicly reported
espionage related cases. These cases demonstrate that loyal and conscientious employees
continue to be the target of attempts by agents of foreign intelligence services to recruit them as
sources of sensitive defense and intelligence information.
Also see Changes in Espionage by American: 1947- 2007, PERSEREC Technical Report 08-5
(March 2008). PERSEREC reports available at: <http://www.dhra.mil/perserec/index.html>
Defense Security Enterprise (DSE). The organizations, infrastructure, and measures (to include policies,
processes, procedures, and products) in place to safeguard DoD personnel, information, operations,
resources, technologies, and facilities against harm, loss, or hostile acts and influences. This system of
systems comprises personnel, physical, industrial, information, and operations security, as well as SAP
security policy, critical program information protection policy, and security training. It addresses, as part of
information security, classified information, including sensitive compartmented information, and controlled
unclassified information. It aligns with counterintelligence, information assurance, foreign disclosure,
security cooperation, technology transfer, export control, cyber security, nuclear physical security,
chemical and biological agent security, antiterrorism, force protection, and mission assurance policy and
is informed by other security related efforts. (DoDD 5200.43, Management of the Defense Security
Enterprise, 1 Oct 2012, w/ chg 1 dated 24 Apr 2013)
112
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Security Service (DSS). An agency of the Department of Defense (DoD) located in Quantico,
Virginia with field offices throughout the United States. The Under Secretary of Defense for Intelligence
provides authority, direction and control over DSS. DSS provides the military services, Defense Agencies,
24 federal agencies and approximately 13,000 cleared contractor facilities with security support services.
(DSS Glossary) Also see industrial security; National Industrial Security Program (NISP).
DSS is the DoD Cognizant Security Office for industrial security, responsible for the DoD portion of
the National Industrial Security Program (NISP) and, by mutual agreement, other U.S. Government
departments and agencies; provides security education & training products and services;
administers the industrial portion of the DoD Personnel Security Program (PSP); provides
authorized counterintelligence services; and also supports DoD efforts to improve security
programs and processes.
- DoDD 5105.42, Defense Security Service, 3 Aug 2010 (w/ chg 1 dated 31 Mar 2011)
_______________________
On behalf of the Department of Defense and other U.S. Government Departments and Agencies,
the DSS supports national security and the warfighter through our security oversight and education
missions. DSS oversees the protection of U.S. and foreign classified information and technologies
in the hands of industry under the National Industrial Security Program (NISP).
The NISP applies to all Executive Branch Departments and Agencies and to all cleared contractor
facilities located within the United States (Para 1-102, NISPOM).
DSS elements include:
The Center for Development of Security Excellence (CDSE) is located in Linthicum, Md., and
provides security education and training to DoD security professionals through formal classroom
and distributed learning methodologies (i.e., computer-based, web-based and tele-training).
The Defense Industrial Security Clearance Office (DISCO), located in Fort Meade, Md., processes
requests for industrial personnel security investigations and provides eligibility or clearance
determinations for cleared industry personnel under the NISP.
See DSS web site at: <http://www.dss.mil/ >
(SIPRNet at <https://www.dss.smil.mil>)
_______________________
DSS has organic counterintelligence support. The DSS CI Directorate’s mission is to identify
unlawful penetrators of cleared U.S. defense industry and articulate the threat for industry and U.S.
government leaders.
The CI Directorate's premier publication, Targeting U.S. Technologies: A Trend Analysis of
Reporting from Defense Industry, analyzes suspicious contact reports (SCRs) from across the DIB
describing suspicious foreign activity targeting U.S. personnel, technologies, and export-controlled
products. This publication is available in both an unclassified and classified version. See DSS CI
web page at: <http://www.dss.mil/isp/count_intell/index.html>
_______________________
Timelines -
Jan 1972 - the Defense Investigative Service (DIS)—predecessor to DSS—established to
consolidate DoD personnel security investigations (PSIs)
May 1993 - DIS established a counterintelligence office
Nov 1997 - DIS redesignated as the Defense Security Service (DSS) to reflect the agency’s
broader mission and functions, including industrial security, personnel security,
security education and training missions.
Feb 2005 - DSS’s personnel security investigations functions transferred to the Office of
Personnel Management (OPM)
Dec 2007 - Director DSS named the functional manger for DoD security training
Defense Technology Base. All aspects of basic research plus those portions of applied research and
technology development devoted to military systems in the generic sense. Prototyping and test and
evaluation of specific technology enabled capabilities to prove the feasibility of a concept are also
included. Development and engineering for specific military systems are NOT part of the defense
technology base. (DoDI 3100.08, The Technical Cooperation Program (TTCP), 7 Aug 2012)
113
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Defense Unknown Subject Team (DUST). DoD’s Enterprise-level focal point and action center to resolve
CI leads in which the subject’s identity and/or specific affiliation with the DoD is not evident. (DoD FCIP
Strategy FY 2013-2017) Also see Unknown Subject; Unknown Subject Lead.
-- Also, [DoD element that] serves as the DoD focal point to resolve CI leads in which the subject’s
identity and specific affiliation with DoD is not evident.
DoD Components will report unknown subject leads to the DUST in accordance with DoD
Instruction 5240.26, Countering Espionage, International Terrorism, and the Counterintelligence
Insider Threat (Enclosure 3, paragraph 1)
Defensive Counterintelligence Activities. Those counterintelligence activities designed to protect…
personnel, operations, technology, and information against collection or exploitation by a foreign
intelligence service, as contrasted with offensive counterintelligence activities, which are designed to
attack the intelligence services of foreign adversaries by penetrating, collaborating, or conspiring with
them to achieve that purpose. (AR 381-20, Army CI Program, 25 May 2010)
Defensive Cyberspace Operations (DCO). Passive and active cyberspace operations intended to
preserve the ability to utilize friendly cyberspace capabilities and protect data, networks, net-centric
capabilities, and other designated systems. (JP 1-02 and JP 3-12, Cyberspace Operations, 5 Fen 2013)
Defensive Travel Security Briefing. Formal advisories that alert traveling personnel of the potential for
harassment, exploitation, provocation, capture, entrapment, or criminal activity. These briefings, based
upon actual experience when available, include recommended courses of action to mitigate adverse
security and personal consequences. The briefings also suggest passive and active measures that
personnel should take to avoid becoming targets or inadvertent victims in hazardous areas. (DSS
Glossary)
Deliberate Compromise. The act, attempt, or contemplation of intentionally conveying classified
documents, information, or material to any unauthorized person, including public disclosure, or the
intentional misuse or mishandling of classified information, (AR 381-20, Army CI Program, 25 May 2010)
Delimitations Agreement. Common term for the DoD/Department of Justice Agreement Governing the
Conduct of Defense Department Counterintelligence Activities in Conjunction with the Federal Bureau of
Investigation. (AR 381-20, Army CI Program, 25 May 2010)
Demarche. An official protest delivered through diplomatic channels from one government to another.
(Words of Intelligence, 2nd Edition, 20110
Denial. Measures taken to block, prevent, or impair US intelligence collection. (Foreign Denial &
Deception Committee, 30 Mar 2006)
-- Also, the attempt to block information that could be used by an opponent to learn some truth.
(Roy Godson and James J. Wirtz, “Strategic Denial and Deception,” in Strategic Denial and Deception:
The 21st Century Challenge, eds. Roy Godson and James J. Wirtz, 2002) Also see deception.
-- Also, methods used to conceal state and military secrets particularly from foreign
intelligence collections. (Joseph W. Caddell; Deception 101 - A Primer on Deception, Strategic
Studies Institute, US Army War College, 2004)
114
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, activities and programs designed to eliminate, impair, degrade, or neutralize the effectiveness
of intelligence collection within and across any or all collection disciplines, human and technical.
(Dr. James B. Bruce, “Denial and Deception in the 21st Century: Adaptation Implications for Western
Intelligence,” in Defense Intelligence Journal, Vol 15, No 2, 2006; pp 13-27)
Denial and Deception - equal parts art and science
Keeping secrets and negating access conceals the truth from an opponent’s acquisition. Denial
hides the real and deception portrays the fake.
For additional information see Joint Pub 3-13.4, Military Deception, 13 Jul 2006
Denial of intelligence collection is a significant impediment to successful analysis
Denied Area. An area under enemy or unfriendly control in which friendly forces cannot expect to operate
successfully within existing operational constraints and force capabilities. (JP 1-02 and JP 3-05, Special
Operations, 18 Apr 2011)
-- Also, a country with which the US has no official or formal diplomatic relations, or a country in which
the capabilities and focus of the local CI services create an operating environment so hostile as to require
non-traditional tradecraft of the highest order. (National HUMINT Glossary)
Denied Area Tradecraft. The specialized clandestine methodology used in handling agents in particularly
difficult and hostile environments. (James M. Olson, Fair Play: The Moral Dilemmas of Spying, 2006)
Departmental Intelligence. Intelligence that any department or agency of the Federal Government
requires to execute its own mission. (JP 1-02)
Department of Defense Components. The Office of the Secretary of Defense, the Military Departments,
the Chairman of the Joint Chiefs of Staff and the Joint Staff, the combatant commands, the Office of the
Inspector General of the Department of Defense, the Department of Defense agencies, Department of
Defense field activities, and all other organizational entities in the Department of Defense. (JP 1, Doctrine
for the Armed Forces of the United States, 25 Mar 2013)
Department of Defense Intelligence Information System (DoDIIS). The combination of Department of
Defense personnel, procedures, equipment, computer programs, and supporting communications that
support the timely and comprehensive preparation and presentation of intelligence and information to
military commanders and national-level decision makers. (JP 2-0, Joint Intelligence, 22 Oct 2013)
-- Also, a DIA-led enterprise that manages the intelligence information technology activities of and
provides intelligence technology to the Department of Defense, the combatant commands, and other
national security entities. (National Intelligence: A Consumer’s Guide - 2009)
Department of State / Bureau of Diplomatic Security (DS). The security and law enforcement arm of the
U.S. Department of State. DS is responsible for providing a safe and secure environment for the conduct
of U.S. foreign policy; it is involved in international investigations, threat analysis, cyber security,
counterterrorism, security technology, and protection of people, property, and information.
Every diplomatic mission in the world operates under a security program designed and maintained
by DS. In the United States, diplomatic security personnel protect the Secretary of State and high-
ranking foreign dignitaries and officials visiting the United States, investigates passport and visa
fraud, and conducts personnel security investigations. Operating from a global platform in 25 U.S.
cities and 159 foreign countries, diplomatic security ensures that America can conduct diplomacy
safely and securely. DS plays a vital role in protecting U.S. embassies and personnel overseas,
securing critical information systems, investigating passport and visa fraud, and fighting the war
on terror.
-- Department of State website: <http://state.gov/m/ds/index.htm>
115
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Department of State / Bureau of Intelligence and Research (INR). State’s intelligence component that
provides analysis of global developments to the State Department and contributes its unique perspectives
to the community’s National Intelligence Estimates. (WMD Report, 31 Mar 2005)
For additional information: <http://www.state.gov/s/inr/ >
Department of Homeland Security (DHS) / Directorate of Information Analysis and Infrastructure
Protection. Monitors, assesses, and integrates terrorist-related information; and assesses and addresses
the vulnerabilities of the nation’s critical infrastructure. (WMD Report, 31 Mar 2005)
Department of Treasury / Office of Terrorism and Financial Intelligence. Treasury’s intelligence
component that collects and processes information that bears on U.S. fiscal and monetary policy and
threats to U.S. financial intuitions. (WMD Report, 31 Mar 2005)
Dependency. [In critical infrastructure protection usage] a relationship or connection in which one entity
is influenced or controlled by another entity. (DoDD 3020.40, DoD Policy and Responsibilities for Critical
Infrastructure, 14 Jan 2010 w/ chg 2 dated 21 Sep 2012)
Derogatory Information. Issue information that adversely reflects on a person’s loyalty, reliability and
trustworthiness. (IC Standard 700-1, 4 Apr 2008)
Desired Perception. In military deception, what the deception target must believe for it to make the
decision that will achieve the deception objective. (JP 1-02 and JP 3-13.4, Military Deception, 13 Jul
2006)
Detainee. A term used for any person captured or otherwise detained by an armed force. (JP 1-02)
Within DoD, detainee includes any person captured, detained, or otherwise under the control of
DoD personnel (military, civilian, or contract employee). It does not include persons being held
primarily for law enforcement purposes except where the United States is the occupying power.
As a matter of policy, all detainees will be treated as EPWs until some other legal status is
determined by competent authority.
For additional information see JP 3-63, Detainee Operations, 30 May 2008.
Detection.
1) In tactical operations, the perception of an object of possible military interest but
unconfirmed by recognition; 2) In surveillance, the determination and transmission by a surveillance
system that an event has occurred; 3) In arms control, the first step in the process of ascertaining the
occurrence of a violation of an arms control agreement; and 4) In chemical, biological, radiological, and
nuclear environments, the act of locating chemical, biological, radiological, and nuclear hazards by use
of chemical, biological, radiological, and nuclear detectors or monitoring and/or survey teams. (JP 1-02)
Deterrence. The prevention from action by fear of the consequences. Deterrence is a state of mind
brought about by the existence of a credible threat of unacceptable counteraction. (JP 1-02)
Devil’s Advocacy. Challenging a single, strongly held view or consensus by building the best possible
case for an alternative explanation. (CIA, A Tradecraft Primer: Structured Analytical Techniques for
Improving Intelligence Analysis, June 2005)
Devil’s Advocacy is most effective when used to challenge an analytical consensus or key
assumption regarding a critically important intelligence question.
DIAP. Also see Defense Intelligence Analysis Program (DIAP).
116
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Digital and Multimedia (D/MM) Forensics. The application of computer science and investigative
procedures involving the examination of D/MM material. D/MM forensics is derived from a combination
of definitions as it applies across the spectrum of computer forensics, audio forensics, image analysis,
and video analysis. Also see digital evidence, digital forensics, and forensic science.
D/MM forensic sub-disciplines include:
Computer and Electronic Device Forensics. The scientific examination, analysis, and/or
evaluation of digital and electronic materials.
Audio Forensics. The scientific examination, analysis, comparison, and/or evaluation of audio.
Image Analysis. The application of image science and domain expertise to examine and interpret
the content of an image and/or the image itself.
Video Analysis. The scientific examination, comparison, and/or evaluation of video.
Digital Evidence. Information of probative value stored or transmitted in binary form. (DoDD 5505.13E,
DoD Executive Agent for the DoD Cyber Crime Center, 1 Mar 2010)
-- Also, information stored or transmitted in binary form that may be introduced and relied upon in
court. (DoJ, Electronic Crime Scene Investigation, 2nd Edition: A Guide for First Responders, Apr 2008)
Digital evidence is information and data of value to an investigation that is stored on, received, or
transmitted by an electronic device. This evidence is acquired when data or electronic devices are
seized and secured for examination. Digital evidence:
- Is latent, like fingerprints or DNA evidence.
- Crosses jurisdictional borders quickly and easily.
- Is easily altered, damaged, or destroyed.
- Can be time sensitive.
-- Electronic Crime Scene Investigation, 2nd Edition, April 2008.
Available online at: www.ncjrs.gov/pdffiles1/nij/219941.pdf
Also see United States Secret Service, Best Practices for Seizing Electronic Evidence v.3, A
Pocket Guide for First Responders
Digital Forensics. In its strictest connotation, the application of computer science and investigative
procedures involving the examination of digital evidence - following proper search authority, chain of
custody, validation with mathematics, use of validated tools, repeatability, reporting, and possibly expert
testimony. Beyond traditional legal purposes, the same techniques, scientific rigor, and procedural
precision now support the range of military operations and courses of action, e.g., computer network
operations as well as CI objectives. (DoDD 5505.13E, DoD Executive Agent for the DoD Cyber Crime
Center, 1 Mar 2010) Also see digital & multimedia forensics, digital evidence, and forensic science.
-- Also, the application of science to the identification, collection, examination, and analysis of data
while preserving the integrity of the information and maintaining a strict chain of custody for the data.
(NIST, Glossary of Key Information Security Terms, May 2013)
Digital Tradecraft. The conduct, topics, or techniques of modern espionage or CI that employ digital or
cyber means. (DoDI S-5240.23, CI Activities in Cyberspace, 13 Dec 2010 with change 1 dated 16 Oct
2013)
-- Also, digital or cyber tactics, techniques, and procedures designed to obscure or frustrate
observation by hostile or unfriendly entities. (DoDI S-3325.10, [FOUO title], 6 Jun 2013)
Digraph and/or Trigraph. A two and/or three-letter acronym for the assigned Codeword or nickname.
(DoD 5220.22.22-M-Sup 1, NISPOM Supplement, Feb 1995)
117
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Diplomatic and/or Consular Facility. Any Foreign Service establishment maintained by the US
Department of State abroad. It may be designated a "mission" or "consular office," or given a special
designation for particular purposes, such as "United States Liaison Office." A "mission" is designated as
an embassy and is maintained in order to conduct normal continuing diplomatic relations between the US
Government and other governments. A "consular office" is any consulate general or consulate that may
participate in most foreign affairs activities, and varies in size and scope. (JP 1-02)
Diplomatic Establishment. A mission, consulate, embassy, residential compound, or other premises
owned or leased and used by a government for official purposes. (Words of Intelligence, 2nd Edition,
2011)
Diplomatic Immunity. A status wherein diplomatic officers accredited to a foreign government as
ambassadors, or other public ministers, are immune from the jurisdiction of all courts and tribunals of the
receiving states whether criminal or civil. The status of diplomatic immunity protects the bearer from
prosecution, civil suit, punishment, or compelled testimony in the country to which he or she is accredited.
(Words of Intelligence, 2nd Edition, 2011)
Diplomatic Security. The set of measures enacted to ensure that the diplomatic representatives of a
nation-state, kingdom, or other political entity are able to conduct that entity’s foreign affairs in a
confidential, safe manner. (US State Department) See Department of State / Bureau of Diplomatic
Security.
Security is a basic function of diplomacy, and specific components of diplomatic security include
preserving the confidentiality of diplomatic documents and communications, protecting diplomatic
personnel, ensuring the integrity of diplomatic personnel through background investigations, and
safeguarding diplomatic posts overseas and diplomatic facilities at home.
-- History of the Bureau of Diplomatic Security of the United States Department of State (October 2011)
Direct Access. Descriptor used for sources with firsthand access to the information provided.
(DoDI S-5200.42, Defense HUMINT and Related Intelligence Activities (U), 8 Dec 2009) Also see
indirect access.
Direct Liaison Authorized (DIRLAUTH). That authority granted by a commander (any level) to a
subordinate to directly consult or coordinate an action with a command or agency within or outside of
the granting command. (JP 1, Doctrine for the Armed Forces of the United States, 25 Mar 2013)
Direct Support (DS). A mission requiring a force to support another specific force and authorizing it to
answer directly to the supported force's request for assistance. (JP 1-02)
Direction Finding (DF). A procedure for obtaining bearings of radio frequency emitters by using a
highly directional antenna and a display unit on an intercept receiver or ancillary equipment. (JP 1-02)
Director Defense Intelligence Agency (Dir DIA). Advises the Secretary of Defense, the Chairman of the
Joint Chiefs of Staff, and the Combatant Commanders on all matters concerning all-source Defense
Intelligence.
Director DIA serves as the Defense Counterintelligence Manager [emphasis added], the
Defense HUMINT Manager, the Defense Collection Manager…, and the Commander of the Joint
Functional Component Command-Intelligence, Surveillance, and Reconnaissance (JFCC-ISR).
See DoDD 5105.21, DIA, 18 Mar 2002.
118
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Director of National Intelligence (DNI). Serves as the principal adviser to the President, the National
Security Council, and the Homeland Security Council for intelligence matters related to the national
security; oversees the 16 federal organizations that make up the intelligence community (IC); and
manages the implementation of the National Intelligence Program (NIP). (IRTPA 2004)
Office of the Director of National Intelligence (ODNI) is charged with: 1) integrating the domestic
and foreign dimensions of US intelligence so that there are no gaps in our understanding of threats
to our national security; 2) bringing more depth and accuracy to intelligence analysis; and 3)
ensuring that US intelligence resources generate future capabilities as well as present results.
DNI created by Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) in December
2004. The Office of the Director of National Intelligence (ODNI) began operations in April 2005.
It was created to drive strategic integration, ensure better coordination, and provide oversight &
governance of the Intelligence Community (IC).
--
See ODNI Fact Sheet (Oct 2011): <http://www.dni.gov/files/documents/ODNI%20Fact%20Sheet_2011.pdf>
Dirty Bomb. An explosive-driven radiological dispersal device.
See NRC fact sheet, “Dirty Bombs,” May 2007(accessed 27 June 2011); available on line at:
Also see Congressional Research Service (CRS) report R41890, “Dirty Bombs”: Technical
Background, Attack Prevention and Response, Issues for Congress,” 24 June 2011.
Disaffected Person. A person who is alienated or estranged from those in authority or lacks loyalty to the
government; a state of mind. (JP 1-02)
Discards. [S]pies supposedly deliberately sacrificed to distract a counterintelligence investigation away
from a better target. This is a controversial strategy about which there remains much debate within the
intelligence community… (Historical Dictionary of Cold War Counterintelligence, 2007)
Discovery. Part of the pre-trial litigation process during which each party requests relevant information
and documents from the other side in an attempt to "discover" pertinent facts. Generally discovery
devices include depositions, interrogatories, requests for admissions, document production requests and
requests for inspection.
Discoverability. Discoverability means users can “discover” selected values (e.g., who, what, where,
when), but cannot gain access to the underlying information until the user requesting access is authorized
and authenticated. (Markle Task Force, 1 Sep 2009)
Discoverability is the first step in an effective system for information sharing, offering users the
ability to “discover” data that exists elsewhere. Discoverability means users can “discover” selected
values (e.g., who, what, where, when), but cannot gain access to the underlying information until
the user requesting access is authorized and authenticated. In many ways, knowing where relevant
information can be found or who has the information is the essential first step towards information
sharing as this makes collaboration and analysis possible. A system of discoverability also avoids
the bulk transfers of data required in large centralized databases, improving security and
minimizing privacy risks.
Disguise. Concealment or misrepresentation of the physical characteristics or true nature or identity of
a person or object. (CIA in D&D Lexicon, 1 May 2002)
Disinformation. Carefully contrived misinformation prepared by an intelligence or CI service for the
purpose of misleading, deluding, disrupting, or undermining confidence in individuals, organizations,
or governments. (CI Community Lexicon)
119
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Dissemination. The timely distribution of intelligence products (oral, written, or graphic form) to
departmental and agency intelligence Consumer’s is a suitable format. (CI Community Glossary)
-- Also, the timely conveyance of intelligence in suitable form to customers. (ICS Glossary)
Dissemination and Integration. In intelligence usage, the delivery of intelligence to users in a suitable
form and the application of the intelligence to appropriate missions, tasks, and functions. Also see
intelligence process. (JP 1-02 and JP 2-01, Joint and National Intelligence Support to Military Operations,
5 Jan 2012)
Divided Loyalties. Broadly defined, individuals with intellectual or emotional commitments to another
country through cultural affinity. (PERSEREC Technical Report 02-5, Espionage Against the United
States by American Citizens 1947-2001, July 2002) Also see ideology, MICE.
DNA. The abbreviation for deoxyribonucleic acid, which is the genetic material present in the cells of all
living organisms. DNA is the fundamental building block for an individual's entire genetic makeup.
(www.ojp.usdoj.gov; accessed 29 Apr 2013)
A person's DNA is the same in every cell (with a nucleus). DNA is contained in blood, semen, skin
cells, tissue, organs, muscle, brain cells, bone, teeth, hair, saliva, mucus, perspiration, fingernails,
urine, feces, etc.
Document and Media Exploitation (DOMEX). The processing, translation, analysis, and dissemination
of collected hard copy documents and electronic media, which are under U.S. Government’s physical
control and are not publicly available; excludes: handling of documents and media during collection, initial
review, and inventory process; and documents and media withheld from the IC DOMEX dissemination
system in accordance with DNI-sanctioned agreements and policies to protect sources and methods.
(ICD 302, Document and Media Exploitation, 6 Jul 2007) Also see Document Exploitation (DOCEX),
Harmony, and National Media Exploitation Center (NMEC).
-- Also, the processing, translation, analysis, and dissemination of collected hard-copy documents
and electronic media that are under U.S. Government physical control and are not publicly available. In
the Department of Defense this includes the handling of documents and media during their collection,
initial review, inventory, and input to a database. (DoDD 3300.03, DoD DOMEX, 11 Jan 2011)
-- Also, the handling and exploitation of documents and/or media for intelligence purposes. (HDI
Lexicon, April 2008)
The National Media Exploitation Center (NMEC) is responsible for ensuring the rapid collection,
processing, exploitation, dissemination and sharing of all acquired and seized media throughout
the intelligence, counterintelligence, military and law enforcement communities. See ICD 302,
copy available online at <http://www.fas.org/irp/dni/icd/icd-302.pdf>
Director DIA is the IC Executive Agent for NMEC (DoDD 3300.03, DoD DOMEX, 11 Jan 2011)
Document Exploitation (DOCEX). The systematic extraction of information from all media formats is
response to collection requirements. (Term previously defined in Army FM 2-0, Intelligence, May 2004)
Also see Document and Media Exploitation (DOMEX); Harmony; and NMEC.
Doctrine. Fundamental principles by which the military forces or elements thereof guide their actions in
support of national objectives. It is authoritative but requires judgment in application. (JP 1-02)
“Doctrine evolves from theory and concepts based on values, beliefs, historical perspective,
experience, and research.”
-- AR 600-100, Army Leadership, 8 Mar 2007
120
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, Joint Doctrine: fundamental principles that guide the employment of US military forces in
coordinated action toward a common objective. Joint doctrine contained in joint publications also
includes terms, tactics, techniques, and procedures. It is authoritative but requires judgment in
application. (JP 1-02)
DoD CI Campaign (previously referred to as “DoD CI Strategic Campaign). See the FOUO definition in
O-DoDD 5240.02, Counterintelligence, 20 Dec 2007, with change 1 dated 30 Dec 2010; available on
DoD CI Campaigns drive and shape Defense CI engagement against critical foreign intelligence
threats globally to achieve strategic outcomes; these CI Campaigns are managed by DIA’s Office
of Counterintelligence (OCI-1).
DoD Criminal Investigative Organizations. The term refers collectively to the United States Army Criminal
Investigation Command, Naval Criminal Investigative Service, U.S. Air Force Office of Special
Investigations, and Defense Criminal Investigative Service, Office of the IG DoD. (DoDD 5525.07)
DoD Functional Manager for Security Training. Director Defense Security Service (DSS).
DoD Law Enforcement Organizations. Organizations, agencies, entities, and offices of the Military
Departments and Defense Agencies and the DoD Inspector General that perform a law enforcement
function for those departments and agencies and are manned by DoD LEOs [Law Enforcement Officers].
(DoDI 2000.26, Suspicious Activity Reporting, 1 Nov 2011)
DoD Personnel Travel Clearance. Travel clearance for DoD and DoD-sponsored personnel performing
official temporary travel abroad. The three types of clearance are country clearance, theater clearance,
and special area clearance. (DoDD 4500.54E, DoD Foreign Clearance Program, 28 Dec 2009)
DoD Strategic CI Campaign. See FOUO definition in O-DoDD 5240.02, CI, 20 Dec 2007.
DoD Unknown Subject. The subject of a DoD CI investigation whose identity has not been determined.
(DoDI 5240.04, CI Investigations, 2 February 2009 with change 1 dated 15 Oct 2013) Also see Defense
Unknown Subject Team; Unknown Subject.
An “unknown subject” is commonly referred to as an “UNSUB.”
DIA’s Office of Counterintelligence (OCI-2) serves as the focal point and central repository for DoD
unknown subject CI leads, reports and information.
Domestic Activities. Activities within the United States that do not involve a significant connection with
a foreign power, organization, or person. (AR 381-20, Army CI Program. 25 May 2010)
Domestic Intelligence. Intelligence relating to activities or conditions within the United States that
threaten internal security and that might require the employment of troops; and intelligence relating to
activities of individuals or agencies potentially or actually dangerous to the security of the Department
of Defense. (JP 1-02 and JP 3-08, Interorganizational Coordination During Joint Operations, 24 Jun 2011)
Domestic Terrorism. Terrorism perpetrated by the citizens of one country against persons in that country.
This includes acts against citizens of a second country when they are in the host country, and not the
principal or intended target. (DoDI 2000.12, DoD Antiterrorism Program, 1 Mar 2012 with change 1 dated
9 Sep 2013)
-- Also, Americans attacking Americans based on U.S.-based extremist ideologies. (FBI)
-- Also, domestic terrorists: people who commit crimes within the homeland and draw inspiration from
U.S.-based extremist ideologies and movements. (CRS Report R42536, The Domestic Terrorist Threat:
Background and Issues for Congress, 15 May 2012)
121
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
One particularly insidious concern that touches all forms of domestic extremism is the lone
offender—a single individual driven to hateful attacks based on a particular set of beliefs without a
larger group’s knowledge or support. In some cases, these lone offenders may have tried to join a
group but were kicked out for being too radical or simply left the group because they felt it wasn’t
extreme or violent enough. We believe most domestic attacks are carried out by lone offenders to
promote their own grievances and agendas.
_______________________
The Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) do not officially list
domestic terrorist organizations, but they have openly delineated domestic terrorist “threats.” These
include individuals who commit crimes in the name of ideologies supporting animal rights,
environmental rights, anarchism, white supremacy, anti-government ideals, black separatism, and
anti-abortion beliefs.
-- CRS Report R42536, The Domestic Terrorist Threat: Background and Issues for Congress, 15 May 2012
Dossier. A file consisting of information concerning an individual. (National HUMINT Glossary)
Double Agent. Agent in contact with two opposing intelligence services, only one of which is aware of the
double contact or quasi-intelligence services. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations,
16 Mar 2011 w/ chg 1 dated 26 Aug 2011) Also see dangle; dangle operation; provocation.
No term is more misused by amateurs and greenhorns than “double agent.”
-- William R. Johnson, Former Army Intelligence and CIA
In its simplest form, a double agent works for two intelligence services
at the same time, with only one of the services understanding this.
-- Stuart A. Herrington, Traitors Among Us: Inside the Spy Catcher’s World (1999), p. 132
_________________________
The double agent is the most characteristic tool of
counterespionage operations, and he comes in many guises.
-- Allan W. Dulles, The Craft of Intelligence (2006), p. 123
_________________________
The first purpose of any double agent program is to engage the enemy. …The basic use of double
agents is to keep contact with the enemy. What you use that contact for depends on the state of
your CI program at any moment. But without contact, there isn’t much you can do.
A double agent operation is a channel in which information moves in both directions. On each end
of the channel is an intelligence or counterintelligence service. The intelligence service seeks to
ensure that the flow of material through the channel is beneficial to itself. The CI service seeks to
ensure that the flow of material is detrimental to its opponent.
-- William R. Johnson (Former CIA Officer)
_________________________
The caviar of the intelligence business.
-- James M. Olson, Former Chief of CIA Counterintelligence
122
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, an agent who is cooperating with an intelligence service of one government on behalf of and
under the control of an intelligence or security service of another government, and is manipulated by one
to the detriment of the other. (Glossary of Intelligence Terms and Definitions, IC Staff, 1978)
-- Also, a person pretending to work as a spy for one government while actually working as [an asset]
for another government. (WMD Report, 31 Mar 2005)
-- Also, an agent working for two opposing agencies; he is loyal to one while betraying the other.
(TOP SECRET: The Dictionary of Espionage and Intelligence, 2005)
-- Also, double agents - individuals under the control of one intelligence agency who offer their
services to an opposing intelligence agency. (“Double Agent Operations,” Espionage, Naval Investigative
Service Command; nd, circa 1989)
-- Also, a clandestine operative who works for two opposing espionage organizations but who is loyal
to one of the organizations and betrays the other. (Encyclopedia of the CIA, 2003)
-- Also, a person who engages in clandestine activity for two intelligence or security services (or more
in joint operations), who provides information about one or about each to the other, and who wittingly
withholds significant information from one on the instructions of the other or is unwittingly manipulated by
one so that significant facts are withheld from the adversary. (John P. Dimmer - 1962; see below)
A World of Stratagems
“To tackle enemy espionage (whoever the enemy may turn out to be) it is therefore of paramount
importance to keep a firm hold on the enemy’s own system of agents and informers. Knowledge of
his methods, knowledge of his intentions, and knowledge of the personnel of his organization are
all vitally necessary. Surely all these objects are the best attained by the maintenance of double
agents! The confession of faith is consequently a simple one. It amounts to this: that in peace as
well as in war a carefully cultivated double agent system is the safest and surest weapon of
counterespionage [emphasis added], and the one most easily adaptable to changing conditions,
changing problems, and even changing enemies.”
-- J.C. Masterman, The Double-Cross System (1972)
_____________________
The term “double agents” as used during OSS operations in WWII:
“…captured agents who would
be persuaded to continue their activities for the enemy, ostensibly in good faith but acting at the
direction of X-2 [OSS Counterintelligence]….” Also “the case of an agent recruited by X-2 [OSS
CI] and infiltrated into enemy territory to induce the enemy to employ him as an agent and return
him to Allied territory.”
-- Kermit Roosevelt, War Report of the OSS (1976)
_____________________
“The fact that doubles have an agent relationship with both sides distinguishes them from
penetrations, who normally are placed with the target service in a staff or officer capacity…. The
double agent is one of the most demanding and complex counterintelligence activities in which an
intelligence service can engage. Directing even one double agent is a time-consuming and tricky
undertaking that should be attempted only by a service having both competence and
sophistication.”
-- John P. Dimmer, CIA (1962)
_____________________
“One side has a agent whom it deliberately tries to work in as an agent on the other side, of course
without the other knowing anything about it… the most advanced and dangerous kind of work an
agent can do, both for the agent himself and for the two parties.”
-- Colonel Stig Erik Constans Wennerström, Swedish Air Force
Spy for the GRU -- convicted of treason in 1964
Note: For a full account of the Wennerström affair see An Agent in Place by Thomas
Whiteside (1966), republished in 1983 in Ballantine Intelligence Library
123
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
_____________________
Double Agents “can serve as excellent channels through which misleading information can flow
to the enemy. So double agents serve both as collectors of positive intelligence and channels for
deception.”
-- Church Committee (Senate Report 94-755 , 26 April 1976)
A condoned channel of communication with the enemy
For additional open source information regarding double agents see:
William R. Johnson, Thwarting Enemies at Home and Abroad: How to Be a Counterintelligence
Officer, Georgetown University Press (2009); pp. 91-153.
Federal Government Security Clearance Programs, Report # 99-166, Hearings before the
Permanent Subcommittee on Investigations of the Committee on Governmental Affairs, US Senate,
April 1985, specifically testimony on pp. 63-103 regarding two Army CI controlled double agent
operations: 1) Chief Warrant Officer Jamos Szmolka against the Hungarian Intelligence Service in
1977-1981; and 2) Sergeant “Smith” against the KGB for over 10 years starting in the early 1970’s.
“Double Agent Operations,” Espionage, Naval Investigative Service Command (nd, circa 1989);
pp. 24-33.
John P. Dimmer (aka F.M. Begum), “Observations on the Double Agent,” Studies in Intelligence,
V6: 11, pp 57-72 (1962); declassified, originally classified Secret. Available online at:
J.C. Masterman, The Double-Cross System (1972). Double agent operations against the Germans
in World War II. Nazi agents in Britain were captured or turned themselves in and were then used
by the British to broadcast mainly disinformation to their Nazi controllers.
John Barron, Operation Solo: The FBI's Man in the Kremlin (1996). Operation Solo tells the
remarkable and true story of FBI run double agent Morris Childs, code named "Agent 58", who, for
twenty-seven years, provided the FBI with the Kremlin's innermost secrets during fifty-two
clandestine missions to the Soviet Union, China, and Eastern Europe.
David Wise, Cassidy’s Run (2000). True-life story of US Army Sgt. Joseph Cassidy who
successfully pretended to be a traitor to his country. In the eyes of his Soviet handlers, he was a
mole planted deep inside DoD. This US Army/FBI double agent operation - code named
Operation SHOCKER -- flushed out 10 Soviet spies including a Russian sleeper agent in the Bronx
and revealed the lengths to which Soviet intelligence would go to penetrate DoD.
Andrew Tully, Inside the FBI (1980). Chapter 5 “Spies for Sale” (pp. 70-81) tells the story of a joint
Naval Investigative Service and FBI double agent operation [Operation LEMONAID] targeting the
Russian Intelligence Service resulting in the arrest of three Russians working out of the United
Nations for espionage on 20 May 1978. Also see Jeremy J. Leggatt, “Art Lindberg’s Walk in the
Cold,” Reader’s Digest, June 1980.
Downgrade. To determine that classified information requires, in the interests of national security, a lower
degree of protection against unauthorized disclosure than currently provided, coupled with a changing of
the classification designation to reflect such a lower degree. (JP 1-02)
Doxing. [Cyber usage] Publicly releasing a person’s identifying information including full name, date of
birth, address, and pictures typically retrieved from social networking site profiles. (FBI; see
Dry Clean. [Tradecraft jargon] Actions taken to determine if one is under surveillance. (Spy Book)
Dry Cleaning. [Tradecraft jargon] Any technique used to elude surveillance. A usual precaution used by
intelligence personnel when actively engaged in an operation. (AFOSI Manual 71-142, OFCO, 9 Jun
2000)
-- Also, any technique used to detect surveillance; a usual precaution engaged in by intelligence
personnel when actively engaged in an operation. (FBI FCI Terms)
124
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Dynamic Threat Assessment (DTA). An intelligence assessment developed by the Defense Intelligence
Agency that details the threat, capabilities, and intentions of adversaries in each of the priority plans in the
Joint Strategic Capabilities Plan. (JP 2-0, Joint Intelligence, 22 Oct 2013)
The DTA is used by the Combatant Commanders and COCOM planning staffs to conduct Mission
Analysis for Step 1 - Strategic Guidance under Adaptive Planning and Execution (APEX).
Dual Agent. Within DoD, term rescinded by JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011.
Previously defined in JP 1-02 as “one who is simultaneously and independently employed by two
or more intelligence agencies, covering targets for both.”
Dual Citizen. Any person who is simultaneously a citizen of more than one country. (DSS Glossary)
Dual-use. Technology and articles that are potentially used either for commercial/civilian purposes or for
military, defense, or defense-related purposes. (DoDI 2040.02, International Transfers of Technology,
Articles, and Services, 10 Jul 2008) See critical technology.
DUST. See Defense Unknown Subject Team.
125
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
E ==========================================
Economic Espionage. The knowing misappropriation of trade secrets with the knowledge or intent that
the offense will benefit a foreign government, foreign instrumentality, or foreign agent. Misappropriation
includes, but is not limited to, stealing, copying, altering, destroying, transmitting, sending, receiving,
buying, possessing, or conspiring to obtain trade secrets without authorization. (Economic Espionage
Act of 1996, PL 104-294)
Economic Espionage… is a fact of life
I think you have to separate very clearly what are the fields which are covered by the alliance and
the fields which are not covered by an alliance. It’s clear that when you are allies, you have certain
sectors, I’m speaking of the armaments. I’m thinking of diplomatic matters where normally you
should not try to gather intelligence. But in all of the other fields, being allied does not prevent the
states from being competitors. Even during the Cold War, the economic competition existed. Now
the competition between the states is moving from the political-military level to the economic and
technological level. In economics, we are competitors, not allies. I think that even during the
Cold War getting intelligence on economic, technological, and industrial matters from a country with
which you are allies is not incompatible with the fact that you are allies.
-- Pierre Marion, Former Director of French Intelligence (DGSE)
as quoted in Friendly Spies by Peter Schweizer (1993)
_______________________________
Section 101(a) of the Economic Espionage Act of 1996 criminalizes economic espionage.
The Economic Espionage Act (EEA) of 1996 (18 USC §§ 1831-1839) is concerned in particular
with economic espionage and foreign activities to acquire US trade secrets. In this context, trade
secrets are all forms and types of financial, business, scientific, technical, economic, or engineering
information, including patterns, plans, compilations, program devices, formulas, designs,
prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or
intangible, and whether stored or unstored, compiled, or memorialized physically, electronically,
graphically, photographically, or in writing, if the owner (the person or entity in whom or in which
rightful legal or equitable title to, or license in, is reposed) has taken reasonable measures to keep
such information secret and the information derives independent economic value, actual, or
potential from not being generally known to, and not being readily ascertainable through, proper
means by the public. Activities to acquire these secrets include the criminal offenses: economic
espionage and industrial espionage.
The Office of the National Counterintelligence Executive submits an annual report to Congress on
the threat to the United States from foreign economic collection and industrial espionage; see
_______________________________
“US intelligence officials put the cost of lost sales due to illicit appropriation of
technology and business ideas at between $US100 billion and $US250 billion a year.”
-- Financial Times, January 2011
Educing Information (EI). The full range of approaches to obtain useful information from sources.
EI includes elicitation, debriefing, and interrogation. (Educing Information - Interrogation: Science and
Art, Dec 2006) Also see debriefing; elicitation; interrogation; interview.
The 2006 Intelligence Science Board report Educing Information - Interrogation: Science and Art
Effect.
1) The physical or behavioral state of a system that results from an action, a set of actions, or
another effect; 2) The result, outcome, or consequence of an action; 3) A change to a condition, behavior,
or degree of freedom. (JP 1-02 and JP 3-0, Joint Operations, 11 Aug 2011)
126
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Effects-Based Operations (EBO). [Non-doctrinal term] A process for obtaining a desired strategic
outcome [emphasis added] or effect on the enemy. (JFCOM Glossary at www.jfcom.mil/about/glossary.htm)
Effects Bases Operations: Coordinated sets of actions directed at shaping the behavior of friends,
foes, and neutrals in peace, crisis, and war.
The concept of EBO focuses “coordinated sets of actions” on objectives defined in terms of human
behaviors in multiple dimensions and on multiple levels, and measures their success in terms of the
behavior produced…. Effects cannot be isolated. All effects, at each level and in each arena, are
interrelated and are cumulative over time. And lastly, effects are both physical and psychological in
nature.
-- Edward A. Smith, Effects Based Operations: Applying Network Centric Warfare in Peace, Crisis, and War
(2002)
eGuardian. The FBI’s unclassified, law enforcement-centric threat reporting system. It provides a means
to disseminate SARs dealing with information regarding a potential threat or suspicious activity rapidly
throughout the national law enforcement community. (DoDI 2000.26, Suspicious Activity Reporting, 1 Nov
2011) See suspicious activity report.
All reports in the eGuardian system Shared Data Repository are viewable through Guardian, the
FBI’s classified threat reporting system. DoD personnel assigned to Joint Terrorism Task Forces
(JTTFs) and the National Joint Terrorism Task Force (NJTTF) have access to Guardian.
For additional information see:
Electronic Intelligence (ELINT). Technical and geolocation intelligence derived from foreign
noncommunications electromagnetic radiations emanating from other than nuclear detonations or
radioactive sources. (JP 1-02 and JP 3-13.1, Electronic Warfare, 25 Jan 2007) Also see electronic
warfare; foreign instrumentation signals intelligence; signals intelligence.
ELINT is a sub-category of signals intelligence (SIGINT) that engages in dealing with information
derived primarily from electronic signals that do not contain speech or text (which are considered
Communications Intelligence aka COMINT). Two major branches of ELINT are Technical ELINT
(TechELINT) and Operational ELINT (OpELINT) described as follows:
-- TechELINT describes the signal structure, emission characteristics, modes of operation,
emitter functions, and weapons systems associations of such emitters as radars, beacons,
jammers, and navigational signals. A main purpose of TechELINT is to obtain signal
parameters which can define the capabilities and the role that the emitter plays in the larger
system, such as a ground radar locating aircraft, and thus lead to the design of radar
detection, countermeasure, or counterweapons equipment.
-- OpELINT concentrates on locating specific ELINT targets and determining the operational
patterns of the systems; these results are commonly called Electronic Order of Battle (EOB).
For additional information see: Richard L. Bernard, Electronic Intelligence (ELINT) at NSA, 2009.
Also see additional background information at: <www.fas.org/irp/nsa/almanac-elint.pdf>
Electronic Surveillance. The acquisition of a nonpublic communication by electronic means without
the consent of a person who is party to an electronic communication or, in the case of a nonelectronic
communication, without the consent of a person who is visibly present at the place of communication.
(DoD 5240.1-R, Dec 1982) Also see surveillance; foreign intelligence surveillance act (FISA).
Governed by the Foreign Intelligence Surveillance Act (FISA) of 1978 (50 USC §1805).
For DoD CI see Chap 5. Proc 5 - Electronic Surveillance, DoD 5240.1-R, Procedures Governing
the Activities of DoD Intelligence Components that Affect United States Persons, 7 Dec 1982
______________________
127
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
The Electronic Communications Privacy Act of 1986 (ECPA) prohibits unauthorized electronic
eavesdropping. ECPA consists of three parts. The first, often referred to as Title III, outlaws
wiretapping and electronic eavesdropping, except as otherwise provided. The second, the Stored
Communications Act, governs the privacy of, and government access to, the content of electronic
communications and to related records. The third outlaws the use and installation of pen registers
and of trap and trace devices, unless judicially approved for law enforcement or intelligence
gathering purposes.
-- Also, the use of electronic devices to monitor or record conversations, activities, sound, or
electronic impulses. (Army FM 2-22.2, Counterintelligence, Oct 2009)
-- Also, (ELSUR) under Title III and FISA is the non-consensual electronic collection of information
(usually communications) under circumstances in which the parties have a reasonable expectation of
privacy and court orders or warrants are required. (FBI Domestic Investigations and Operations Guide,
15 Oct 2011)
Electronic Tracking Device. Direction finder including electronic tracking devices, such as, radio
frequency beacons and transmitters, vehicle locator units, and the various devices that use a Global
Positioning System [GPS] or other satellite system for monitoring non-communication activity. (FBI
Domestic Investigations and Operations Guide, 16 Dec 2008)
Electronic Warfare (EW). Military action involving the use of electromagnetic and directed energy to
control the electromagnetic spectrum or to attack the enemy. Electronic warfare consists of three
divisions: electronic attack, electronic protection, and electronic warfare support. (JP 1-02 and JP 3-13.1,
Electronic Warfare, 25 Jan 2007)
Electronics Security. The protection resulting from all measures designed to deny unauthorized persons
information of value that might be derived from their interception and study of noncommunications
electromagnetic radiations, e.g., radar. (JP 1-02 and JP 3-13.1, Electronic Warfare, 25 Jan 2007)
Elements of Espionage. The fundamentals components in which an intelligence service conducts
espionage… some or all of the following elements are present in every espionage operation: 1) contact &
communication; 2) collection; 3) motive / reward; 4 travel; and 5) tradecraft. (Espionage 101: Elements of
Espionage, US Army AFCITC Course Handout, 3 Dec 1996, authored by CW4 Constance Y. Huff, USA)
Also see Espionage; Espionage Act; Espionage Against the United States.
Espionage investigative elements are different than the prosecutorial elements (which are
addressed in Title 18 USC, §§ 792-798 and Article 106, UCMJ).
Elicitation. In intelligence usage, the acquisition of information from a person or group in a manner that
does not disclose the intent of the interview or conversation. (JP 2-0, Joint Intelligence, 22 Oct 2013)
Also see educing information; debriefing; interrogation; interview.
-- Also, engaging with a source in such a manner that he or she reveals information without being
aware of giving away anything of value. (Educing Information - Interrogation: Science and Art, Dec 2006)
-- Also, the strategic use of conversation to extract information from people without giving them the
feeling they are being interrogated. (FBI)
-- Also, the use of generalized questions to ascertain someone’s knowledge on a particular topic.
(Army FM 2-22.2, Counterintelligence, Oct 2009
A casual conversation with a hidden agenda
The subtle extraction of information during an apparently “normal” and “innocent” conversation.
A supplemental technique used during interviews, debriefings and interrogations.
_____________________
128
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Elicitation is the practice of obtaining information about a topic from conversations, preferably
without the source knowing what is happening.
-- Robert M. Clark, Intelligence Analysis: A Target-Centric Approach (2004), p. 72
_____________________
Elicitation, that is to say, like a lot of other tradecraft techniques, has its Scylla and Charybdis. On
one hand, the cautious seeker risks concealing his purpose in such general questions or remarks
that he evokes nothing of value. On the other hand, if the questions are excessively direct, the
contact may quickly suspect he is being interrogated for intelligence purposes and bring the
interview to an abrupt and unpleasant end.
-- George G. Bull, “The Elicitation Interview,” Studies in Intelligence, vol. 14 no. 2 (Fall 1970), pp. 115-22.
Originally classified “Secret” [declassified].
_____________________
Elicitation is a technique used to discreetly gather information. It is a conversation with a specific
purpose: collect information that is not readily available and do so without raising suspicion that
specific facts are being sought. It is usually non-threatening, easy to disguise, deniable, and
effective. The conversation can be in person, over the phone, or in writing. Conducted by a skilled
collector, elicitation will appear to be normal social or professional conversation. A person may
never realize she was the target of elicitation or that she provided meaningful information.
-- Elicitation Techniques, FBI (accessed 20 Aug 2012)
See pdf available at: <http://www.fbi.gov/about-us/investigate/counterintelligence/elicitation-brochure>
Emanation Security. Unintentional signals that, if intercepted and analyzed, would disclose the
information transmitted, received, handled, or otherwise processed by information systems.
Synonymous with Transient Electromagnetic Pulse Emanation Standard (TEMPEST). (DSS Glossary)
Also see TEMPEST.
Emerging Warning Concerns. Newly identified issues relevant to national security of sufficient significance
to warrant temporary attention by the Defense Intelligence Enterprise. An emerging warning issue may be
redefined as an enduring warning issue based on national security priorities and operational plans.
(DoDD 3115.16, The Defense Warning Network,5 Dec 2013)
Émigré. A person who lawfully departed his or her country with the intention of resettlement elsewhere.
(Defense HUMINT Enterprise Manual 3301.002, Vol II Collection Operations, 23 Nov 2010)
-- Also, a person who departs from his country for any lawful reason with the intention of permanently
resettling elsewhere. (ICS Glossary)
Emission Security. The component of communications security that results from all measures taken to
deny unauthorized persons information of value that might be derived from intercept and analysis of
compromising emanations from cryptoequipment and telecommunications systems. (JP 1-02 and JP 6-0,
Joint Communications, 10 Jun 2010). Also see also communications security.
Equipment Exploitation Operations. Intelligence exploitation operations of all types foreign and non-
foreign material which may have military application or answer a collection requirement. This material
includes material found on a detainee or on the battlefield (Captured Enemy Equipment (CEE)), or
purchased through either open or clandestine means (Foreign Military Acquisition). (DHE-M 3301.002,
Vol II Collection Operations, 23 Nov 2010)
Enabling Activities.
[In CI and HUMINT usage] Any activity that supports Defense CI and HUMINT
operations, functions, and missions, including source validation, collection management, collection
requirements management, cover, cover support, information systems, production management, source
communications, targeting, and training. (DoDI O-5100.93, Defense CI & HUMINT Center, 13 Aug 2010)
129
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Encipher. To convert plain text into unintelligible form by means of a cipher system. (JP 1-02)
-- Also, convert plain text to cipher text by means of a cryptographic system. (CNSSI No. 4009,
National Information Assurance Glossary, 26 April 2010)
Encode. Convert plain text to cipher text by means of a code. (CNSSI No. 4009, National Information
Assurance Glossary, 26 April 2010)
Encrypt. Generic term encompassing encipher and encode. (CNSSI No. 4009, National Information
Assurance Glossary, 26 April 2010)
Encryption. The process of changing plaintext into ciphertext for the purpose of security or privacy.
(CNSSI No. 4009, National Information Assurance Glossary, 26 April 2010)
End State. Set of required conditions that defines achievement of the commander's objectives. (JP 1-02)
Enduring Warning Issue. A significant national security issue, usually linked to an operation plan or
concept plan, that is well defined and are longstanding potential threats to the interests of the U.S. and its
allies. (DoDD 3115.16, The Defense Warning Network,5 Dec 2013)
Enemy Combatant (EC). A person engaged in hostilities against the United States or its coalition
partners during an armed conflict. (DoDD 2310.01E and JP 3-56, Detainee Operations, 6 Feb 2008)
Esoteric Communications. Public statements whose surface meaning (manifest content) does not reveal
the real purpose, meaning, or significance (latent content) of the author. (Army Techniques Publication
2-22.9, Open-Source Intelligence, 10 Jul 2012)
Espionage. Intelligence activity directed towards the acquisition of information through clandestine
means. (NSCID 5 and DCID 5/1) Also see Elements of Espionage; Espionage Act; Espionage Against
the United States.
“The object of secret intelligence activity [espionage] is to obtain by secret means
information which cannot otherwise be secured and which is not elsewhere available.”
-- Kermit Roosevelt, War Report of the OSS (1976)
“In espionage, two factors are constant. Intelligence officers recruit foreign nationals who can
provide classified information on their governments’ plans and intentions, and the
counterintelligence services of those countries try to thwart these operations.”
--
Brian P. Fairchild (CIA Case Officer for 20 years), “Human Intelligence, Operational Security and the
CIA’s Directorate of Operations.” Statement before the Joint Economic Committee, United States
Congress 20 May 1998
-- Also, 1) Intelligence activity directed toward the acquisition [of] information through clandestine
means and proscribed by the laws of the country against which it is committed; 2) Overt, cover, or
clandestine activity designed to obtain information relating to the national defense with an intent or reason
to believe that it will be used to the injury of the United States or to the advantage of a foreign nation.
(CI Community Lexicon)
-- Also, Clandestine intelligence activity. This term is often interchanged with “clandestine collection.”
(Senate Report 94-755, Book I - Glossary, 26 Apr 1976)
-- Also, 1) The art of spying; 2) The act of seeking information for one government that the other
government wishes to keep secret. (TOP SECRET: The Dictionary of Espionage and Intelligence, 2005)
Espionage is the clandestine collection of information by people either in a position of trust for the
targeted entity, or with access to people with such access. The process of recruiting such
individuals and supporting their operations is the HUMINT discipline of agent handling.
130
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
_____________________
“Espionage—the use of spies or secret agents to steal information from enemies,
adversaries, or competitors—is one of the oldest forms of intelligence gathering.”
-- Arthur S. Hulnick, “Espionage: Does It Have a Future in the 21st Century?”
The Brown Journal of World Affairs; XI: 1 (2004)
_____________________
“Espionage is distinguished from other forms of intelligence gathering by its clandestinity
and its ‘illegal means’ of acquisition.”
-- Frederick P. Hitz, Former Inspector General of the CIA (1990-1998)
_____________________
“Espionage is the theft of information in contravention of another nation’s laws by a person known
as an ‘agent.’ This act of theft may be direct, as in the secret copying of a classified document, or
the indirect, as in hiding of an eavesdropping device, or merely oral, but is done by an agent and it
breaks either a foreign law or the internal regulation of an alien organization. Espionage is not the
confidential purchase of information where mere embarrassment, rather than illegality, is risked. It
is not the flattery, bribery, or coercion of a person to influence his actions within legal limits. It is
not ‘a scuttling, violence-prone business. . . incompatible with democracy.’ But rather a silent,
surreptitious, violence-shunning business serving the nation.”
-- William R. Johnson, “Clandestinity and Current Intelligence,” Studies in Intelligence, vol. 20, no. 3
(Fall 1976), pp. 15-69. Originally classified “Secret / No Foreign Dissem” [declassified].
Espionage, since it is based on human vulnerability,
can penetrate even the most heavily guarded repositories of national secrets.
-- Also, [Crime of Espionage] the act of obtaining, delivering, transmitting, communicating, or
receiving information about the national defense with an intent, or reason to believe, that the information
may be used to the injury of the United States or to the advantage of any foreign nation. (JP 1-02 and
JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)
Espionage is a national security crime, specifically a violation of Title 18 USC, §§ 792-798 and
Article 106, Uniform Code of Military Justice (UCMJ).
See article “Espionage: The American Judicial Response. An in Depth Analysis of the Espionage
Laws and Related Statues” by Harold W. Bank (45 pages).
Copy at <http://www.wcl.american.edu/journal/lawrev/21/bank.pdf.> (accessed 31 Oct 2012)
______________________
“The man engaged in espionage on behalf of his own country is committing a patriotic act.
The man who gives away or sells his own country’s secrets is committing treason.”
-- Allen W. Dulles, The Craft of Intelligence (2006), p. 179
______________________
“Espionage is a crime almost devoid of evidence…”
-- Peter Wright (Former Asst Director MI5), Spycatcher (1987)
______________________
“The act of espionage is unlike any other criminal act in that it leaves no traces. Indeed, unless the
agent is caught, the government office that has been penetrated is usually unaware that any crime
has taken place. The actual detection of espionage is a very specialized task….”
-- Miles Copeland, Without Cloak or Dagger (1974), p. 160
_____________________
“...[E]spionage in it's own way is a very unique crime: There are no smoking guns, no battered
victims, rarely do we have any forensic evidence, no bait money, no exploding dye packs, no bank
surveillance films. Espionage, in many cases, leaves no footprints."
-- William H. Webster, Director FBI (12/10/85)
______________________
131
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
“Because it leaves no footprints, espionage is one of the more difficult crimes to uncover. Yet the
business of catching spies affects profoundly the American way of life. If done well, it protects our
freedoms by keeping us strong. If done poorly, it can impinge on our liberties just as surely as a
takeover by a foreign power.”
-- Ronald Kessler, Spy vs. Spy (1988), p. 8
______________________
“... the essence of espionage, even the most innocuous sort, is betrayal of trust. One
might almost say that is the defining element, because without it, there is no espionage.”
-- Aldrich Ames, CIA Traitor & Convicted Spy
as quoted in as quoted in Confessions of a Spy by Pete Earley
______________________
“Espionage is a crime of double-edged secrecy. Spies, well experienced in clandestine procedures
and operating not as individuals but as agents of a nation, are hard to detect by traditional police
work. And the loot that they seek is not the kind of evidence that can be labeled Exhibit A in the
courtroom. …And there is still another kind of secret that a trail reveals: the failings of the secret-
holder’s own security safeguards”
-- Thomas B. Allen and Norman Polmar, Merchants of Treason: America’s Secret for Sale (1988), p. 163
______________________
“No matter how overwhelming the evidence can be, prosecuting espionage cases is never easy."
-- John L. Martin, Retired Chief Counterespionage Section, US Department of Justice
Espionage Act. The Espionage Act of 1917 (18 USC § 792 et seq.) is a U.S. federal law passed in June
1917, shortly after the U.S. entry into World War I. It prohibited any attempt to interfere with military
operations, to support U.S. enemies during wartime, to promote insubordination in the military, or to
interfere with military recruitment. The law was further strengthen by the Espionage and Sabotage Act of
1954, which authorized the death penalty or life imprisonment for espionage or sabotage in peacetime as
well as during wartime. The Act requires agents of foreign governments to register with the U.S.
Government. It also suspended the statue of limitations for treason. In 1958, the scope of the act was
broaden to cover Americans engaged in espionage against the U.S. while overseas. Also see espionage.
Statues now governing espionage date from the first effort to protect the governments’ secrets in
the Defense Secrets Act of 1911. The Espionage Act of 1917 adopted the approach take in 1911,
incorporating many of its key phrases. Most of the 1917 act in turn has been incorporated without
many revisions into 18 U.S. Code 793, the core statute for dealing with espionage. The last
revisions in wording made to section 793 were in 1950 with the Internal Security Act; also in that
act 18 U.S. Code 794 was added.
-- PERSEREC Technical Report 08-05, Changes in Espionage by Americans: 1947-2007, March 2008.
___________________________
The Federal Espionage Laws codified in Title 18 Section 793 and 794 US Code along with other
related crimes date back to the terrorist attack of 1916 on Black Tom Island carried out by the
German IIIb intelligence service. This event had such an impact on the nation that proposals were
made to court martial civilians since there were no viable laws to deal with espionage at the time.
The result was the 1917 Espionage Law of which codified a very restricted definition of the crime
of Espionage. As you know espionage has four elements:
- Unauthorized transmittal
- of national defense information
- to a foreign power or agent
- with the intent to harm the US or aid that foreign power.
As a result of a German espionage case in the early 1940s, that was appealed, and precedence
was established that the national defense security information transmitted in an espionage case
had to be protected information. Accordingly, it is essential to prove in an espionage prosecution
that the information affected the military defense of the United States and was protected
information not in the public domain at the time it was transmitted.
-- Prepared Statement of David G. Major, President CI Centre, before the US House of Representatives,
Committee on the Judiciary Subcommittee on Crime, Terrorism, and Homeland Security “Enforcement
of Federal Espionage Laws” Hearing, 29 January 2008
_______________________________
132
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Prominent among the statutory offenses enacted by Congress and relating to matters of national
security are the espionage laws found in title 18, sections 791 through 798.' The activities covered
therein by these sections go far beyond those limited to any dictionary definition or popular concept
of the term "espionage."
The obtaining of national defense information for the benefit or use of foreign nations or its
subsequent transmittal is the primary target of the espionage laws. However, equally as criminal is
the conspiracy and attempt to do any of the above as well as the receiving or obtaining of national
defense information with reason to believe that such information was to be used in violation of the
espionage laws. In addition, the willful refusal to turn over national defense information upon proper
demand by lawful authority and the loss or compromise of national defense information through
gross negligence is also included in the statutory proscription. The penalties prescribed for violation
of the espionage laws are severe.
-- Commission on Government Security - 1957, p. 617
Espionage Indicators. Warning signs that an insider may be working for or is susceptible to control by a
Foreign Intelligence Entity (FIE). These warning signs are the result of an insider’s actions, activities, and
behaviors that may be indicative of potential espionage-related activity. Also see indicator.
-- Also, Potential Espionage Indicators: Activities, behavior or circumstances that may, unless
satisfactorily explained, be indicative of potential espionage activity by an individual who may be acting as
a witting espionage agent or spy. (DSS CI Report, Potential Espionage Indicators in Personnel Security
Investigations, undated, circa early 2000)
Mere exhibition of an espionage indicator does not necessarily indicate spying or a Foreign
Intelligence Entity (FIE) connection; individuals may exhibit PEI for a variety of legitimate reasons.
Presence of PEI, especially multiple PEI, warrants further CI action.
In CI usage, Indicators are different from anomalies. Espionage indicators are manifested in an
insider’s actions, activities, and behaviors whereas anomalies surface as a result of FIE actions
and activities [see anomalies, anomalous activity, anomaly].
-- Indicator: an individual’s action, activity or behavior
-- Anomaly: foreign power activity or knowledge
Potential Espionage Indicators alone do not presuppose that an individual is necessarily working
on behalf of a FIE… additional CI follow-up is required.
DoD Directive 5240.06, Counterintelligence Awareness and Reporting, 17 May 2011, lists
reportable contacts , activities, indicators, and behaviors associated with foreign intelligence
activities (FIEs), a term that includes international terrorists; for specifics see Tables 1-3 at
Enclosure 4.
Essential Elements of Information (EEI). The most critical information requirements regarding the
adversary and the environment needed by the commander by a particular time to relate with other
available information and intelligence in order to assist in reaching a logical decision. (JP 2-0, Joint
Intelligence, 22 Oct 2013)
Essential Elements of Friendly Information (EEFI). Key questions likely to be asked by adversary officials
and intelligence systems about specific friendly intentions, capabilities, and activities, so they can obtain
answers critical to their operational effectiveness. (Previously in JP 2-01, Joint and National Intelligence
Support to Military Operations)
Essential Task. A specified or implied task that an organization must perform to accomplish the mission
that is typically included in the mission statement. (JP 5-0, Joint Operation Planning, 11 Aug 2011)
Also see implied task; specified task.
133
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Estimative Intelligence. Intelligence that identifies, describes, and forecasts adversary capabilities and
the implications for planning and executing military operations. (JP 1-02 and JP 2-0, Joint Intelligence,
22 Oct 2013)
Evaluation. In intelligence usage, appraisal of an item of information in terms of credibility, reliability,
pertinence, and accuracy. (JP 1-02)
Evaluation and Feedback. In intelligence usage, continuous assessment of intelligence operations
throughout the intelligence process to ensure that the commander’s intelligence requirements are being
met. (JP 2-01, Joint and National Intelligence Support to Military Operations, 5 Jan 2012)
Evidence. Testimony, writings, material object, or other things presented to the senses that are offered
to prove the existence or nonexistence of a fact.
"No matter how overwhelming the evidence can be,
prosecuting espionage cases is never easy."
-- John L. Martin, Retired Chief of Internal Security at the Department of Justice
In legal proceedings there are several different types: 1) in terms of their relationship to the crime,
they are known as “direct” or “circumstantial,” and 2) in terms of their relationship to the world at
large, they are known as “testimonial” or “physical.”
TESTIMONIAL: statements or the spoken word from the victim(s) or witness(es).
PHYSICAL: includes such things as hairs, fibers, latent fingerprints, and biological material.
Physical evidence is objective and when documented, collected, and preserved properly may be
the only definitive way to reliably place or link someone to a crime scene. This is why Physical
evidence is known as the "silent witness."
Physical evidence has the potential to play a critical role in the
overall investigation and resolution of a suspected criminal act.
-- US Department of Justice,
Crime Scene Investigation: A Guide for Law Enforcement, January 2000
-- Also, anything that helps to ascertain the truth of a matter, or gives proof of a fact. Evidence may
be physical or testimonial. (AR 195-5, Evidence Procedures, 25 Jun 2007)
-- Also, the legal data that conclusions or judgments may be based on. It is the documentary or verbal
statements and material objects admissible as testimony in a court of law. Evidence is the means by
which any alleged matter of fact is proven or disproved. Evidence includes all matters, except comment
or argument, legally submitted to a court. Evidence is the source from which a court-martial or jury must
form its conclusions as to the guilt or innocence of an accused. Testimonial evidence, e.g., sworn
statements of eyewitness accounts and admissions of guilt, is obtained through communication with
people. Physical evidence, e.g., identified weapons and fingerprints, is obtained by searching crime
scenes, tracing leads, and developing technical data. Investigators must always be evidence conscious.
Both physical and testimonial evidence are vital to the successful prosecution of an investigation. (Army
FM 3-19.13, Law Enforcement Investigations, Jan 2005)
Evidence is the source from which a court-martial or jury must form its conclusions as to the guilt or
innocence of an accused. Evidence is the means by which any alleged matter of fact is proven or
disproved. Evidence includes all matters, except comment or argument, legally submitted to a
court.
-- Army FM 3-19.13, Law Enforcement Investigations, Jan 2005, p. 1-8
134
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, evidence in its broadest sense, refers to anything that is used to determine or demonstrate
the truth of an assertion; the term has specialized meanings when used with respect to specific fields,
such as criminal investigations and legal discourse. …Legal evidence concerns the tight rules governing
the presentation of facts that tend to prove or disprove the point at issue.
…Testimony (which tells) and
exhibits (which show) are the two main categories of evidence presented at a trial or hearing. (Wikipedia;
accessed 1 Aug 2007)
The law of evidence governs the use of testimony (e.g., oral or written statements, such as an
affidavit) and exhibits (e.g., physical objects) or other documentary material which is admissible
(i.e., allowed to be considered by the trier of fact, such as a jury) in a judicial or administrative
proceeding (e.g., a court of law). Evidence must be acquired/received, processed, safeguarded
and disposed of properly.
Military Rules of Evidence are Part III of the Manual for Courts-Martial; Appendix 22 of the MCM is
Analysis of the Military Rules of Evidence.
Also see “Evidence” in Chapter 8 of Army FM 2-22.2, Counterintelligence, October 2009, pp. 8-5
through 8-8.
____________________
“Espionage is a crime almost devoid of evidence…”
-- Peter Wright, Spycatcher (1987)
____________________
“While espionage may be ALMOST devoid of evidence, it is NOT VOID of evidence.”
-- ESPIONAGE 101: Elements of Espionage by CW4 Connie Huff (USA), 3 Dec 1996
Evidence Identifiers. Tape, labels, containers, and string tags used to identify the evidence, the person
collecting the evidence, the date the evidence was gathered, basic criminal offense information, and a
brief description of the pertinent evidence. (Crime Scene Investigation: A Guide for Law Enforcement,
Sep 2013)
Execute Order (EXORD). 1) An order issued by the Chairman of the Joint Chiefs of Staff, by the authority
and at the direction of the Secretary of the Defense, to implement a decision by the President or SECDEF
to initiate military operations; 2) An order to initiate military operations as directed. (JP 1-02 and JP 5-0,
Joint Operation Planning, 11 Aug 2011)
Execution Planning. The Adaptive Planning and Execution System translation of an approved course of
action into an executable plan of action through the preparation of a complete operation plan or operation
order. (JP 5-0, Joint Operation Planning, 11 Aug 2011)
Executive Agent (EA) [within DoD]. A term used to indicate a delegation of authority by the Secretary of
Defense or Deputy Secretary of Defense to a subordinate to act on behalf of the Secretary of Defense.
(JP 1, Doctrine for the Armed Forces of the United States, 25 Mar 2013)
Exfiltration. The removal of personnel or units from areas under enemy control by stealth, deception,
surprise, or clandestine means. (JP 1-02)
-- Also, a clandestine rescue operation designed to get a defector, refugee, or operative and his or
her family out of harm's way. (CI Centre Glossary)
-- Also, a clandestine operation undertaken to remove an individual from a denied area. (Historical
Dictionary of Cold War Counterintelligence, 2007)
-- Also, the surreptitious extraction of operatives in the field. (Encyclopedia of the CIA, 2003)
135
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, an operation to get an individual secretly and illegally [in violation of a foreign country’s law]
out of a hostile area. (James M. Olson, Fair Play: The Moral Dilemmas of Spying, 2006)
Examples include the escapes of KGB officer Oleg Gordievsky from the Soviet Union in 1985,
orchestrated by MI6, and KGB officer Victor Sheymov, his wife, and daughter from the Soviet Union
in 1980, carried out by the CIA.
Expanded-scope Screening [Polygraph]. (ESS) An examination that includes the questions from a CSP
polygraph and questions related to falsification of security forms, involvement with illegal drugs, and
criminal activity. Previously known as full-scope polygraph. (DoDI 5210.91, PCA Procedures, 12 Aug
2010 with change 1 dated 15 Oct 2013)
Exploitation. The process of obtaining information from any source and taking advantage of it. (DoDD
5205.02E, DoD OPSEC Program, 20 Jun 2012)
-- Also, the process of obtaining intelligence information from any source and taking advantage of it
for intelligence purposes.
(ODNI, U.S. National Intelligence - An Overview 2011)
Export Enforcement Coordination Center (E2C2). The primary forum within the federal government for
executive departments and agencies to coordinate and enhance their export control enforcement efforts.
The Center maximizes information sharing, consistent with national security and applicable laws. This
helps partner agencies detect, prevent, disrupt, investigate and prosecute violations of U.S. export control
laws. (www.ice.gov)
Executive Order 13558 created the Export Enforcement Coordination Center. E2C2 provides a
venue through which to deconflict technology transfer investigations,
For additional information see <http://www.ice.gov/export-enforcement-coordination-center/>
Extremist Activity. As used in this regulation, an activity that involves the use of unlawful violence or the
threat of unlawful violence directed against the Army, DOD, or the United States based on political,
ideological, or religious tenets, principals, or beliefs. (AR 381-12, Threat Awareness and Reporting
Program, 4 Oct 2010)
Eyewash. [Tradecraft jargon] False entries made in files, usually to protect the security of a source, often
indicating that a particular target has rejected a pitch, when in fact the offer was accepted. (Historical
Dictionary of Cold War Counterintelligence, 2007)
136
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
F ==========================================
Fabricator. An individual or group who, usually without genuine resources, invents or inflates information
for personal or political gain or political purposes. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint
Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)
-- Also, an agent who furnishes false information for financial gain. (A Spy’s Journey)
False Flag. Development or execution of any imitative or operation under false national sponsorship or
credentials (aka “false colors”). The Russian term is foreign flag. (CIA in D&D Lexicon, 1 May 2002)
Also see false-flag approach and false-flag recruitment
-- Also, occurs when an individual is recruited believing he or she is cooperating with an intelligence
service of a specific country. In actuality, he or she has been deceived and is cooperating with an
intelligence service of another country. (AFOSI Manual 71-119, CI Investigations, 27 Oct 2009)
-- Also, the technique for misrepresenting an individual’s country of origin is a risky but well-
established tactic adopted by all counterintelligence agencies in the absence of other, safer alternatives.
Invariably, the strategy is one of last resort when a suspect is known to have engaged in espionage, but
is thought to be currently inactive. The offer to be reengaged as a spy may be accepted and result in
sufficient evidence to secure a conviction, or may prompt an incriminating action. (Historical Dictionary of
Cold War Counterintelligence, 2007)
-- Also, approach by a hostile intelligence officer who misrepresents himself or herself as a citizen
of a friendly country or organization. The person who is approached may give up sensitive information
believing that it is going to an ally, not a hostile power. (Spy Book)
-- Also, the use of a third country’s nationality to effect the recruitment of an agent so they do not
know an activity’s true country of origin. (A Spy’s Journey)
False-Flag Approach. An intelligence officer or agent who represents themselves as a person of another
nationality in order to foster trust and lessen suspicion about the contact. (AR 381-12, Threat Awareness
and Reporting Program, 4 Oct 2010) Also see false flag; false-flag recruitment.
False-Flag Recruitment. A situation that occurs when an individual is recruited believing that he/she is
cooperating with an intelligence eservice of a specific country, when in actually he/she has been deceived
and is cooperating with an intelligence service of another country. (CI Community Lexicon) Also see
false-flag; false-flag approach.
“…’false flag’ recruitment—when an intelligence service recruits a target while pretending to
represent another nation—a common piece of tradecraft. When you finally recruit the target, he
believes he is providing information to some other nation. The Israelis have often used this
technique by impersonating CIA officers when trying to recruit Arabs.”
-- Duane R. Clarridge, A Spy For All Seasons: My Life in the CIA (1997), p. 97
-- Also, an individual recruited believing he/she is cooperating with an intelligence service of a specific
country when, in reality, the individual has been deceived and is working on behalf of an intelligence
service of another country. (ICS Glossary & AR 381-47, OFCO, 17 Mar 2006)
137
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, recruitment of an individual under the guise of working for one entity when actually working for
another entity. (HDI Lexicon, April 2008)
Can also be used as a CI investigative technique to determine whether a suspected spy intends to
or has committed espionage or other national security crimes against the United States; in this type
of false flag a U.S. CI or law enforcement officer poses as an intelligence operative of a foreign
power in an undercover operation. The FBI has successfully used this type of false flag operation
in several espionage cases, e.g., see United States of America v. Stewart Davis Nozette (U.S.
District Court for the District of Columbia, case number: 09-0565M)
Faraday Bag. Specialty collection bags for electronic parts with lining to protect the contents from
electromagnetic forces. (Crime Scene Investigation: A Guide for Law Enforcement, Sep 2013)
FIE. See Foreign Intelligence Entity.
FISS. See Foreign Intelligence and Security Service.
Federal Bureau of Investigation (FBI). The primary investigative arm of the US Department of Justice
(DoJ) with jurisdiction over violations of more than 200 categories of federal law and also a statutory
member of the US Intelligence Community. The FBI’s mission is to protect and defend the United States
against terrorist and foreign intelligence threats, to uphold and enforce the criminal laws of the United
States, and to provide leadership and criminal justice services to federal, state, municipal, and
international agencies and partners. (www.fbi.gov)
“The FBI is unique in having a dual responsibility—to prevent harm to national security as a
member of the U.S. Intelligence Community and to enforce federal laws as part of the Department
of Justice. The Bureau reports to both the Attorney General and the Director of National
Intelligence.”
-- FBI, Today’s FBI - Facts and Figures 2010-2011
___________________
The FBI has authority to investigate threats to the national security pursuant to Presidential
Executive Orders, Attorney General authorities, and various statutory sources. Per EO 12333 (US
Intelligence Activities) the FBI coordinates the clandestine collection of foreign intelligence
collected through human sources or through human-enabled means and counterintelligence
activities inside the United States.
___________________
“We always thought of the FBI highly. We viewed it, this organization, as a formidable one. In the
intelligence business, it’s better to overestimate than underestimate, we never just thought of the
FBI as incompetent or weak organization. It was an adversary, a formidable adversary, truly.”
-- Oleg Kalugin, Retired KGB General (served in Washington DC and Former Chief of Line KR)
Federal Grand Jury (FGJ). An independent panel charged with determining whether there is probable
cause to believe one or more persons committed a particular federal offense. If the FGJ believes
probable cause exists, it will vote a “true bill” and the person will be indicted. An indictment is the most
typical way a person is charged with a felony in federal court.
(FBI Domestic Investigations and
Operations Guide, 15 Oct 2011)
Federal Polygraph Examiner. Military, civilian, or contractor personnel authorized to conduct polygraph
examinations on behalf of a federal agency. (DoD 5210.48, Polygraph and Credibility Assessment
Program, 25 Jan 2007 with change 2 dated 15 Nov 2013)
138
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Federally Funded Research and Development Center (FFRDC). Research and development-performing
organizations that are exclusively to substantially financed by the Federal Government and are supported
by the Federal Government either to meet a particular research and development objective or, in some
instances, to provide major facilities at either universities or corporate or contractor locations for applied
research to development purpose. (DoDI O-5240.24, CI Activities Supporting RDA, 8 Jun 2011 with
change 1 dated 15 Oct 2013)
Feed Material. Information that is usually true but unimportant given to an individual to pass to another
intelligence service to maintain or enhance his value to that service. Sometimes called build-up material.
(FBI FCI Terms)
Feedback. Information or intelligence provided to deception planners as to the progress of a deception
operation and, ultimately, its success or failure. (CIA in D&D Lexicon, 1 May 2002)
Fifth Columnist. A subversive who acts out of secret sympathy for an enemy of his or her own country.
(Encyclopedia of the CIA, 2003)
-- Also, people who clandestinely undermine a larger group such as a nation from within. A fifth
column can be a group of secret sympathizers of an enemy that are involved in sabotage within military
defense lines, or a country's borders. A key tactic of the fifth column is the secret introduction of
supporters into the whole fabric of the entity under attack. (Wikipedia; accessed 9 August 2012)
The term was coined in 1936, during the Spanish Civil War. It was said then that the Spanish
rebels had four columns of troops marching on the city of Madrid—and an additional “fifth column”
of sympathizers within the city itself. Ready to take up arms at a moments’ notice.
-- Encyclopedia of the CIA (2003)
______________________________
In the United States at the end of the 1930s, as involvement in the European war seemed ever
more likely, those who feared the possibility of betrayal from within used the newly coined term
"fifth column" as a shorthand for sedition and disloyalty.
-- Wikipedia; accessed 9 August 2012
______________________________
The fifth column is “that portion of our population which is ready to give assistance or
encouragement in any form to invading or opposing ideologies.”
-- Attorney General Robert H. Jackson, 1940
(later Associate Justice of the United States Supreme Court, 1941-1954)
______________________________
The Communist Party of the United States is a fifth column if there ever was one.
-- J. Edgar Hoover, Director Federal Bureau of Investigation
Testimony before Committee on Un-American Activities,
U. S. House of Representatives, circa 1948
Financial Crimes Enforcement Network (FinCEN). An element of the Department of Treasury with the
mission to safeguard the financial system from the abuses of financial crime, including terrorist financing,
money laundering and other illicit activity. FinCEN administers the Bank Secrecy Act; supports law
enforcement, intelligence, and regulatory agencies through sharing and analysis of financial intelligence;
builds global cooperation with counterpart financial intelligence units; and networks people, ideas, and
FinCEN exercises regulatory functions primarily under the Currency and Financial Transactions
Reporting Act of 1970, as amended by Title III of the USA PATRIOT Act of 2001 and other
legislation, which legislative framework is commonly referred to as the "Bank Secrecy Act" (BSA).
139
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
The BSA is the nation's first and most comprehensive Federal anti-money laundering and counter-
terrorism financing (AML/CFT) statute. In brief, the BSA authorizes the Secretary of the Treasury
to issue regulations requiring banks and other financial institutions to take a number of precautions
against financial crime, including the establishment of AML programs and the filing of reports that
have been determined to have a high degree of usefulness in criminal, tax, and regulatory
investigations and proceedings, and certain intelligence and counter-terrorism matters.
Financial Record. An original, its copy, or information known to have been derived
from the original record held by a financial institution that pertains to a customer's relationship
with the financial institution. (DoDI 5400.15, Guidance on Obtaining Information from Financial
Institutions, 2 Dec 2004 w/ chg 3 Jul 2007)
Finding. A written legal determination made by the President of the United States authorizing a particular
covert action important to US national security, in compliance with the Foreign Assistance Act of 1961, as
amended by the 1971 Hughes-Ryan Amendment. (National HUMINT Glossary) Also see covert action.
The President shall approve all covert action Findings in writing. Under Section 662 of the Foreign
Assistance Act of 1961, as amended, all covert actions undertaken… must be authorized by a
Presidential Finding that each such operation is important to US national security.
-- National Security Decision Directive Number 159, 18 Jan 1985 (originally TS-Sensitive, declassified)
According to the Congressional Research Service, the reference to a “presidential finding” took
on its current popular meaning when Congress adopted the Hughes-Ryan amendment to the
Foreign Assistance Act in 1974. Section 662 of the statute prohibits the expenditure of
appropriated funds by or on behalf of the CIA for covert actions “unless and until the President finds
that each such operation is important to the national security of the United States and reports, in a
timely fashion, a description and scope of such operation to the appropriate committees of
Congress.”
The requirements of this provision subsequently went through a series of transformations, the
vestiges of which were recently codified in the Intelligence Authorization Act, FY1991, which still
requires a written presidential finding satisfying certain conditions set forth in the statute for covert
actions to occur. Such presidential findings, which are classified, are to be “reported to the
intelligence committees as soon as possible” after being approved “and before the initiation of the
covert action authorized by the finding.” These findings are not published in the Federal Register
or reproduced in CFR Title 3 compilations.
Firewall. A hardware/software capability that limits access between networks and/or systems in
accordance with a specific security policy. . (CNSSI No. 4009, National Information Assurance Glossary,
26 April 2010)
FIVE EYES (FVEY). Australia, Canada, New Zealand, United Kingdom and the United States. (CAPCO
and DoDI C-5240.08, CI Security Classification Guide, 28 Nov 2011)
Five Ws (also known as the Five Ws and one H). The formula for getting the "full" story on something.
The maxim of the Five Ws (and one H) is that in order for a report to be considered complete it must
answer a checklist of six questions, each of which comprises an interrogative word: Who, What, When,
Where, Why, and How? (Wikipedia; accessed 20 Feb 2009)
Flag Officer. A term applied to an officer holding the rank of general, lieutenant general, major general,
or brigadier general in the US Army, Air Force or Marine Corps or admiral, vice admiral, or rear admiral
in the US Navy or Coast Guard. (JP 1-02)
Flaps and Seals. [Intelligence parlance for] the clandestine opening, reading, and resealing of either
envelopes or packages without the recipient’s knowledge. (Spycraft)
140
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
For or On Behalf of a Foreign Power. The determination that activities are for or on behalf of a foreign
power shall be based on consideration of the extent to which the foreign power is involved in (a) control
or policy direction; (b) financial or material support; or (c) leadership, assignments, or discipline. (AFOSI
Manual 71-119, CI Investigations, 27 Oct 2009)
Force Multiplier. A capability that, when added to and employed by a combat force, significantly
increases the combat potential of that force and thus enhances the probability of successful mission
accomplishment. (JP 1-02 and JP 3-05.1, Joint Special Operations Task Force Operations, 26 Apr 2007)
Force Protection (FP). Preventive measures taken to mitigate hostile actions against Department of
Defense personnel (to include family members), resources, facilities, and critical information . (JP 1-02
and JP 3-0, Joint Operations, 11 Aug 2011)
Force Protection Detachment (FPD). A CI element that provides CI support to transiting and assigned
ships, personnel, and aircraft in regions of elevated threat. (DoDD O-5240.02, Counterintelligence,
20 Dec 2007 with change 1 dated 30 Dec 2010; also JP 1-02 and JP 2-01.2, CI & HUMINT in Joint
Operations, 16 Mar 2011 w/ change 1 dated 26 Aug 2011)
The primary focus of FPDs is to provide current and actionable force protection information to the
commander of “in transit” resources. FPDs were created in the aftermath of the USS Cole (DDG
67) bombing in the Port of Aden, Yemen on 12 October 2000.
_____________________
Service counterintelligence programs are integral to force protection and must be adequately
manned and funded to meet the dynamic demands of supporting in-transit forces.
-- Finding 20, DoD USS Cole Commission Report, 8 Jan 2001 (p. 97); p. 7 in the unclassified version.
_____________________
The FPD primary mission is to detect and warn of threats to DoD personnel and resources in-
transit at overseas locations without a permanent DoD CI presence. … FPDs shall maintain liaison
contact with host nation officials to assess an operational picture of the local intelligence, terrorist,
and criminal threat.
-- DoDI 5240.22, CI Support to Force Protection, 24 Sep 2009, pp. 7-8 (encl 3, para 5)
_____________________
The principal responsibility of the FPD is to provide FP [force protection] services to DoD
personnel, aircraft, ships and resources, as well as coordinate component FP activities. The FPD
detects and warns of threats to DoD military and civilian assets in-transit at overseas locations that
do not possess a permanent DoD CI presence.
-- Erika Triscari, “Force Protection Detachments, the Force Multiplier,” The Guardian, April 2006, pp. 6-9.
Force Protection Response Group (FPRG). For specifics see DoDI S-5240.15, FPRG (U), 20 Aug 2010.
Foreign Agents Registration Act (FARA). A disclosure statute, enacted in 1938, that requires persons
acting as agents of foreign principals in a political or quasi-political capacity to make periodic public
disclosure of their relationship with the foreign principal, as well as activities, receipts and disbursements
in support of those activities. Disclosure of the required information facilitates evaluation by the
government and the American people of the statements and activities of such persons in light of their
function as foreign agents. (22 USC §611)
See more on the FARA at DoJ website: <http://www.fara.gov>
The FARA Registration Unit of the Counterespionage Section in the National Security Division
(NSD), Department of Justice (DoJ) is responsible for the administration and enforcement of the
Act. See DoJ website at <http://www.usdoj.gov/criminal/fara/index.html>
141
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Foreign Collection Threat. Opportunity for a foreign entity or cooperating DoD personnel (an insider)
to overtly, covertly or clandestinely collect information about RDA programs, technologies, system
capabilities and employment methods that may enable an adversary to copy, counter, or defeat6 a
capability, or inhibit, exploit, or sabotage a defense system. Within the context of [DoDI O-5240.24], the
term collectively refers to threats posed by or form an insider, cyber exploitation, supply chain
manipulation, an FIE [foreign intelligence entity], a foreign company, international transfers or exports of
technology, and disposal of export-controlled technology. (DoDI O-5240.24, CI Activities Supporting RDA,
8 Jun 2011 with change 1 dated 15 Oct 2013)
Foreign Computer Intrusion. The use or attempted use of any cyber-activity or other means, by, for, or
on behalf of a foreign power to scan, probe, or gain unauthorized access into one or more U.S.-based
computers. (AG Guidelines for Domestic FBI Operations, 29 Sep 2008)
Foreign Contact. Contact with any person or entity that is not a U.S. Person. (IC Standard 700-1, 4 Apr
2008)
Foreign Connection. A U.S. person has a foreign connection when a reasonable belief exists that the
U.S. person is or has been in contact with, or has attempted to contact, a foreign person or representative
of a foreign power for purposes harmful to U.S. national security interests; or when a reasonable belief
exists that the U.S. person is acting or encouraging others to act in furtherance of the goals or objectives
of a foreign person or power for purposes harmful to U.S. national security interests. (DoDD 5148.11,
ATSD/IO, 24 Apr 2013)
-- Also, a foreign connection is established by a reasonable belief that a U.S. person is or has been in
contact with, or has attempted to contact, a foreign person or a representative of a foreign power, or a
reasonable belief that a U.S. person is acting or encouraging others to act to further the goals or
objectives of a foreign person or foreign power. (DoDI 2000.12, DoD Antiterrorism Program, 1 Mar 2012
with change 1 dated 9 Sep 2013)
Foreign Counterintelligence Program (FCIP). Military component of the National Intelligence Program
(NIP) that conducts counterintelligence activities in support of the Department of Defense. Also see
National Intelligence Program (NIP).
Within the National Intelligence Program (NIP) the two key national-level DoD intelligence
programs are the General Defense Intelligence Program (GDIP) and the FCIP.
-- Adapted from Dan Elkins, Financial Management of Intelligence Resources: A Primer (3rd Edition), May 1992
Foreign Cultural Analysis. Analysis of information on the demographics, norms, values, institutions, and
artifacts of a population used to assist in anticipating the actions of that population within the operating
environment. (DoDD 3600.01, Information Operations, 14 Aug 2006 with chg 1, 23 May 2011)
Foreign Denial & Deception. Foreign capabilities and techniques designed to conceal, manipulate, deny,
deceive, influence, induct uncertainty, and generate gaps in U.S. intelligence capabilities and/or conceal
intentions. Also see denial; deception, military deception.
Aggressive foreign D&D efforts erode our intelligence advantage
Foreign knowledge and understanding of US intelligence capabilities are significant and growing
problems across all intelligence disciplines and represent serious challenges to US national
Security.
“America’s toughest adversaries know a great deal about our intelligence system
and are becoming better at hiding their intentions and capabilities.”
-- The National Intelligence Strategy, October 2005, p.9
Foreign Denial & Deception Committee (FDDC). An interagency intelligence committee that operates
under the auspices of the National Intelligence Council (see ICD 204).
142
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Foreign Instrumentation Signals Intelligence (FISINT). Technical information and intelligence derived
from the intercept of foreign electromagnetic emissions associated with the testing and operational
deployment of non-US aerospace, surface, and subsurface systems. Foreign instrumentation signals
intelligence is a subcategory of signals intelligence. Foreign instrumentation signals include but are not
limited to telemetry, beaconry, electronic interrogators, and video data links. (JP 1-02 and JP 2-01, Joint
and National Intelligence Support to Military Operations, 5 Jan 2012) Also see signals intelligence
(SIGINT).
In the early 1980s the term TELINT (telemetry intelligence) was broadened to include other key
signals that also describe missile/space events and was renamed Foreign Instrumentation Signals
Intelligence (FISINT).
Foreign Intelligence (FI). Information relating to capabilities, intentions, and activities of foreign powers,
organizations, or persons, but not including counterintelligence, except for information on international
terrorist activities. (National Security Act §3(2), 50 USC §401a) Also see positive intelligence.
-- Also, information relating to the capabilities, intentions, or activities of foreign governments or
elements thereof, foreign organizations, foreign persons, or international terrorist activities. (EO 12333 as
amended and JP 2-0, Joint Intelligence, 22 Oct 2013)
FI collection disciplines include: human intelligence (HUMINT); signals intelligence (SIGINT);
geospatial intelligence (GEOINT), including imagery intelligence (IMINT); and measurement &
signatures intelligence (MASINT).
FI does not include counterintelligence. FI is one of the two components of intelligence, the other
is counterintelligence (CI) per Executive Order 12333 US Intelligence Activities as amended and
the National Security Act of 1947 as amended.
Foreign Intelligence Agent. A person other than a foreign intelligence officer, who is engaged in
intelligence activities or sabotage for on the behalf of a foreign power, or international terrorist activity, or
who knowingly conspires with or aids and abets such a person in these activities. (CI Community Lexicon)
Also see agent; and agent net.
Foreign Intelligence and Security Service (FISS). An organization of a foreign country capable of
executing all or part of the intelligence cycle. Note: sometimes referred to as FIS (Foreign Intelligence
Service). Also see foreign intelligence entity.
-- Also, a foreign government’s intelligence and security organization. (DoD FCIP Strategy FY 2013-
2017)
Foreign Intelligence Collection Threat. The potential of a foreign power, organization, or person to overtly
or covertly collect information about U.S. acquisition program technologies, capabilities, and methods of
employment that could be used to develop a similar weapon system or countermeasures to the U.S.
system or related operations. (DoD 5200.1-M, Acquisition Systems Protection Program, March 1994)
Foreign Intelligence Entity (FIE). Any known or suspected foreign organization, person, or group (public,
private, or governmental) that conducts intelligence activities to acquire U.S. information, block or impair
U.S. intelligence collection, influence U.S. policy, or disrupt U.S. systems and programs. This term
includes a foreign intelligence and security service [FISS] and international terrorist organizations.
(JP 1-02; JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011; DoDD
5240.06, CIAR, 17 May 2011 with change 1 dated 30 May 2013; and DoDI S-5240.17, CI Collection
Activities, 14 Mar 2014)
FIE is a more encompassing term, which includes but not limited to Foreign Intelligence and
Security Services (FISS), as well as Foreign Intelligence Services (FIS).
143
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, any known or suspected foreign organization, person, or group (public, private, or
governmental) that conducts intelligence activities to acquire U.S. information, blocks or impairs U.S.
intelligence collection, influences U.S. policy, or disrupts U.S. systems and programs. This term includes
a foreign intelligence and security service and international terrorists. (DoDI 5240.26, Countering
Espionage, International Terrorism, and Counterintelligence Insider Threat, 4 May 2012 with change 1
dated 15 Oct 2013)
-- Also, any known or suspected foreign organization, person, or group (public, private, governmental)
that conducts intelligence activities to acquire U.S. information, blocks or impairs US intelligence
collection, influence US policy, or disrupts US systems and programs. This term includes foreign
intelligence and security services and international terrorists. (DoDI S-5240.23, CI Activities in
Cyberspace, 13 Dec 2010 with change 1 dated 16 Oct 2013) Note: this definition is slightly different than
the one above.
-- Also, any foreign organization, person, or group (public, private, governmental) that conducts
intelligence activities to acquire U.S. information, block or impair U.S. intelligence collection, influence
U.S. policy, or disrupt U.S. systems and programs. This term includes a foreign intelligence and security
service as defined in Joint Publication 1-02. (DoDI 5240.18, CI Analysis & Production, 17 Nov 2009 with
change 1 dated 15 Oct 2013)
-- Also, known or suspected foreign state or non-state organizations or persons that conduct
intelligence activities to acquire U.S. information, block or impair U.S. intelligence collection, influence
U.S. policy, or disrupt U.S. systems and programs. The term includes foreign intelligence and service
services and international terrorists. (ICD 750, Counterintelligence Programs, 5 Jul 2013)
Foreign Intelligence Information.
1) Information that relates to, and if concerning a United States person
is necessary to, the ability of the United States to protect against— (a) actual or potential attack or other
grave hostile acts of a foreign power or an agent of a foreign power; (b) sabotage or international
terrorism by a foreign power or an agent of a foreign power; or (c) clandestine intelligence activities by an
intelligence service or network of a foreign power or by an agent of a foreign power; or 2) information with
respect to a foreign power or foreign territory that relates to, and if concerning a United States person is
necessary to—(a) the national defense or the security of the United States; or (b) the conduct of the
foreign affairs of the United States. (Foreign Intelligence Surveillance Act of 1978; Public Law 95-511,
25 October 1978) Also see Foreign Intelligence Surveillance Act (FISA).
Foreign Intelligence Liaison. Activities or relationships between elements of the United States
Government and elements of foreign governments or international organizations on matters involving
foreign intelligence, counterintelligence, or clandestine intelligence activity.
Foreign Intelligence Officer. A member of a foreign intelligence service. (CI Community Lexicon)
[Also referred to as an IO (intelligence officer)]. Also see agent handler.
Foreign Intelligence Service (FIS). An organization of a foreign country capable of executing all or part
of the intelligence cycle. (CI Community Lexicon) Also see Foreign Intelligence and Security Service,
Foreign Intelligence Entity.
Foreign Intelligence Entity (FIE) is a more all encompassing term which includes but is not limited
to FIS.
_________________________
The importance of intelligence services in the fortune of nations can’t be overstated…. The
existence or absence of a well-working spy network on the territory of a potential enemy may well
spell the difference between victory and defeat.
-- Alexander Orlov in Handbook of Intelligence and Guerrilla Warfare (1963)
144
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Foreign Intelligence Surveillance Act (FISA). [50 USC §1801 / Public Law 95-111] …the legal authority
authorizing and regulating electronic surveillance within the United States for foreign intelligence or
counterintelligence purposes and physicals searches within the United States for foreign intelligence
purposes. The act sets out the application, order, and report process to be followed. (CI Community
Lexicon) Also see Foreign Intelligence Surveillance Court.
Primary purpose must be collection of foreign intelligence information.
FISA prescribes procedures for the physical & electronic surveillance and collection of "foreign
intelligence information" between or among "foreign powers". Subchapters of FISA provide for:
electronic surveillance; physical searches; pen registers and trap & trace devices for Foreign
Intelligence (FI) purposes; and access to certain business records for FI purposes. FISA does
not apply to U.S. counterintelligence activities overseas.
--
FISA, codified in 50 U.S.C. §1801, et seq was amended by the FISA Amendments Act of 2008.
_____________________
The Foreign Intelligence Surveillance Act of 1978, P.L. 95-511, 92 Stat. 1783 (25 Oct 1978), 50
USC §§ 1801 et seq., provides a statutory framework for gathering foreign intelligence
information through the use of electronic surveillance, physical searches, and pen registers or
trap and trace devices, and access to business records and other tangible things, the 1978 Act
dealt only with electronic surveillance.
The provisions passed almost 30 years ago became Title I of FISA. As originally enacted, the
measure provided a statutory framework for collection of foreign intelligence information through
the use of electronic surveillance of communications of foreign powers or agents of foreign powers,
as those terms were defined in the act. The act has been amended repeatedly in the intervening
years in an effort to address changing circumstances. Then, as now, the Congress sought to strike
a balance between national security interests and civil liberties.
FISA consists of seven parts. The first authorizes electronic surveillance in foreign intelligence
investigations. The second authorizes physical searches in foreign intelligence cases. The third
permits the use and installation of pen registers and trap and trace devices in the context of a
foreign intelligence investigation. The fourth affords intelligence officials access to business records
and other tangible items. The fifth directs the Attorney General to report to Congress on the
specifics of the exercise of FISA authority. The sixth, scheduled to expire on 30 December 2012,
permits the acquisition of the communications of targeted overseas individuals and entities. The
seventh creates a safe harbor from civil liability for those who assist or have assisted in the
collection of information relating to the activities of foreign powers and their agents.
____________________
Electronic surveillance can provide vital information needed to identify those who are acting or
preparing to act against U.S. interests for the benefit of foreign powers, including those engaged
in espionage, sabotage, or terrorist acts or who otherwise pose a threat to the nation or its citizens,
and to uncover their plans or activities. This information may not be readily uncovered by other
investigative means. Thus, surveillance can provide a valuable tool for protecting the security of
the nation and its citizens.
--
CRS Report RL34279: Foreign Intelligence Surveillance Act: An Overview of Selected Issues, 7 Jul 2008
_______________________
Note: Under 50 USC §1801(e)(1), foreign intelligence information is information that relates
to U.S. ability to protect against: 1) possible hostile acts of a foreign power or agent of a foreign
power; 2) sabotage or terrorism by a foreign power or agent, and: 3) . clandestine intelligence
activities by a foreign power or agent. Foreign intelligence information includes information with
respect to a foreign power or foreign territory that relates to the national defense, national security,
or conduct of foreign affairs of the United States.
_______________________
145
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Probable cause under FISA: “Ordinarily, probable cause speaks to the probability of the existence
of a certain fact, e.g., probable cause to believe a crime has been, is, or is about to be committed
and that the search will result in the discovery of evidence or contraband. FISA authorizes issuance
of a surveillance or search order predicated upon the probability of a possibility; the probability to
believe that the foreign target of the order may engage in spying, or the probability to believe that
the American target of the order may engage in criminal spying activities, 50 U.S.C. 1805(a)(3)(A),
1824(a)(3)(A), 1801(b)(1)(B), (b)(2)(A).3 But it is the predicate not the standard that is changed.
The probable cause standard is the same in FISA as in a criminal context: would a prudent
individual believe that a fact is probably true. It is the focus that is different. Would a prudent
individual believe that spying may occur.”
-- CRS Memorandum (American Law Division), 30 Jan 2006
_______________________
Misc. FISA References& Background
Foreign Intelligence Surveillance of 1978, 50 USC §1801 (Public Law 95-111)
Presidential Directive/NSC-19, Electronic Surveillance Abroad and Physical Searches for Foreign
Intelligence Purposes, 25 Aug 1977 [declassified]; amended by POTUS via 24 Aug 1979 White
House Memo [declassified]
Executive Order 12139, FISA, 23 May 1979
Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008 (PL 110-261), 10 Jul 2008
Executive Order 12949, Foreign Intelligence Searches, 9 Feb 1995
A thorough constitutional justification of FISA can be found in United States v. Duggan (743 F.2d
59[2d Cir. 1984]) where both Fourth and Fifth Amendment challenges to this kind of electronic
surveillance were addressed by the court.
US Senate. The Foreign Intelligence Surveillance Act of 1978: The First Five Years, Report 98-
660, 98th Congress, 2nd Session, Washington, DC, 1984.
CRS Report R42725, Reauthorization of the FISA Amendment s Act, 2 Jan 2013; copy available
at:
For additional FISA background see FAS website at: <http://www.fas.org/irp/agency/doj/fisa/>
Foreign Intelligence Surveillance Court (FISC) [often referred to as the “FISA Court”]. A U.S. federal court
established in 1978 when Congress enacted the Foreign Intelligence Surveillance Act (FISA)--codified, as
amended, at 50 USC §§ 1801-1885c. The Court entertains applications submitted by the U.S.
Government for approval of electronic surveillance, physical search, and other investigative actions for
foreign intelligence purposes.
Most of the Court’s work is conducted ex parte as required by statute, and due to the need to
protect classified national security information. The FISC sits in Washington D.C. and is composed
of eleven federal district court judges who are designated by the Chief Justice of the United States.
Each judge serves for a maximum of seven years and their terms are staggered to ensure
continuity on the Court. By statute, the judges must be drawn from at least seven of the United
States judicial circuits, and three of the judges must reside within 20 miles of the District of
Columbia. No judge may be appointed to this court more than once, and no judge may be
appointed to both the Court of Review and the FISC. FISC Judges typically sit for one week at a
time, on a rotating basis.
For additional information, see the FISC web site at: <http://www.fisc.uscourts.gov/>
-- FISC Rules of Procedures at: <http://www.fisc.uscourts.gov/rules-procedure>
-- FISC Public Findings at: <http://www.fisc.uscourts.gov/public-filings>
146
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Foreign Intelligence Threat. The all-source intelligence threat posed by foreign intelligence entities to US
interests.
Foreign Intelligence Threats
[T]he leading state intelligence threats to US interests in 2014 will continue to be Russia and
China, based on their capabilities, intent, and broad operational scope. Sophisticated foreign
intelligence entities will continue to employ human and cyber means to collect national security
information.
-- Hon. James R. Clapper, DNI, Statement for the Record, Worldwide Threat Assessment of the US
Intelligence Community, SSCI, 29 January 2014
________________________
Foreign intelligence services, along with terrorist groups, transnational criminal organizations, and
other nonstate actors, are targeting and acquiring our national security information, undermining
our economic and technological advantages, and seeking to influence our national policies and
processes covertly. These foreign intelligence efforts employ traditional methods of espionage and,
with growing frequency, innovative technical means. Among significant foreign threats, Russia and
China remain the most capable and persistent intelligence threats and are aggressive practitioners
of economic espionage against the United States. Countering such foreign intelligence threats
is a top priority for the Intelligence Community for the year ahead [emphasis added].
-- Hon. James R. Clapper, DNI, Statement for the Record, Worldwide Threat Assessment of the US
Intelligence Community, Senate Committee on Armed Services, 18 April 2013, p. 8
Foreign Liaison Officer (FLO). A foreign government military member or civilian employee who is
authorized by his or her government to act as an official representative of that government in its dealings
with the DoD and Military Services in connection with programs, projects, or agreements of mutual
interest to DoD and the foreign government. (adapted from AR 380-10, 22 Jun 2005)
Three types of FLOs:
1) A Security Assistance FLO is a foreign government representative who is assigned to a DoD
element or contractor facility pursuant to a requirement that is described in an FMS LOA;
2) An Operational FLO is a foreign government representative who is assigned to a DoD element
pursuant to a documented requirement to coordinate operational matters, such as combined
planning or training and education; and
3) A National Representative FLO is a foreign government representative who is assigned to his or
her national embassy or legation in Washington, DC (for example, an attaché), to conduct liaison
activities with DoD / Military Services.
Foreign Material. Any item of foreign origin including physical possession of, or access to, an item of
foreign material or technology. (DIAM 58-4, Foreign Material Program, 22 Feb 2002)
Foreign Material Acquisition (FMA). FMP [Foreign Material Program] activities that include gaining
physical possession, or access to, an item of foreign material or technology. (DoDD S-3325.01E, Foreign
Material Program (U), 30 Dec 2011)
Foreign Material Exploitation (FME). FMP [Foreign Material Program] activities that include analysis,
testing, evaluation, and documentation of the S&TI [Scientific & Technical Intelligence] characteristics
of an item of foreign material. (DoDD S-3325.01E, Foreign Material Program (U), 30 Dec 2011)
Foreign Military Intelligence Collection Activities (FORMICA). Entails the overt debriefing, by trained
HUMINT personnel, of all U.S. persons employed by the Department of Defense who have access to
information of potential national security value. (DoDI C-5205.01, FORMICA (U), 22 Jan 2009; also
JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)
Foreign National. Any person other than a US citizen, US permanent or temporary legal resident alien,
or person in US custody. (JP 1-02)
147
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, any person who is not a citizen of the U.S. (IC Standard 700-1, 4 Apr 2008)
Foreign Ownership, Control or Influence (FOCI). A U.S. company is considered under foreign ownership,
control, or influence whenever a foreign interest has the power, direct or indirect, whether or not
exercised and whether or not exercisable through ownership of the U.S. company’s securities, by
contractual arrangements or other means, to direct or decide matters affecting the management or
operations of that company in a manner which may result in unauthorized access to classified information
and/or special nuclear material or may affect adversely the performance of classified matters.
(ISC 2008-700-1, 4 Apr 2008)
Within DoD, see DTM 09-019, Policy Guidance for FOCI, 2 Sep 2009 (with chg 6 dated 9 Jan
2014)
Foreign Power. Any foreign government (regardless of whether recognized by the United States),
foreign-based political party (or faction thereof), foreign military force, foreign-based terrorist group, or
any organization composed, in major part, of any such entity or entities. (DoD 5240.1-R, Dec 1982)
-- Also, foreign power means: (1) a foreign government or any component thereof, whether or not
recognized by the United States; (2) a faction of a foreign nation or nations, not substantially composed
of United States persons; (3) an entity that is openly acknowledged by a foreign government or
governments to be directed and controlled by such foreign government or governments; (4) a group
engaged in international terrorism or activities in preparation thereof; (5) a foreign-based political
organization, not substantially composed of United States persons; or (6) an entity that is directed and
controlled by a foreign government or governments. (50 USC § 1801a). Also see Agent of a Foreign
Power.
Foreign Service National (FSN). Foreign nationals who provide clerical, administrative, technical, fiscal,
and other support at foreign service posts abroad and are not citizens of the United States. The term
includes third country nationals who are individuals employed by a US mission abroad and are neither
a citizen of the US nor of the country to which assigned for duty. (JP 1-02 and JP 3-68, Noncombatant
Evacuation Operations, 23 Dec 2010)
Foreign Terrorist Tracking Task Force (FTTTF). A specialized task force that was created pursuant to
Homeland Security Presidential Directive No. 2 and was consolidated into the FBI pursuant to the
Attorney General's directive in August 2002. The FTTTF uses innovative analytical techniques and
technologies that help keep foreign terrorists and their supporters out of the United States or lead to their
location, detention, prosecution, or removal. The participants include DoD, Department of Homeland
Security's bureaus of Immigration and Customs Enforcement (ICE) and Customs and Border Protection,
State Department, Social Security Administration, Office of Personnel Management, Department of
Energy, and CIA. (FBI website: <http://www.fbi.gov/congress/congress06/mueller120606.htm>)
Foreign Visits System (FVS). Automated system operated by the Office of the Under Secretary of
Defense (Policy) that provides staffing and database support for processing requests for visits by foreign
nationals to DoD activities and defense contractors. FVS consists of an unclassified segment that allows
the online submission of visit requests from embassies in Washington, DC, and, in some cases, directly
from foreign governments overseas. FVS also has a classified segment that provides staffing, decision-
making support, and database capabilities to the military departments and DIA.
Forensics. [In computer / cyber usage] The practice of gathering, retaining, and analyzing computer-
related data for investigative purposes in a manner that maintains the integrity of the data. (CNSSI No.
4009, National Information Assurance Glossary, 26 April 2010) Also see forensic science.
Forensic Copy. An accurate bit-for-bit reproduction of the information contained on an electronic device
or associated media, whose validity and integrity has been verified using an accepted algorithm. (CNSSI
No. 4009, National Information Assurance Glossary, 26 April 2010)
148
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Forensic Science (often shortened to forensics). The application of multidisciplinary scientific processes
to establish facts. (DoDD 5205.15E, DoD Forensic Enterprise, 16 Apr 2011) Also see digital & multimedia
forensics, digital evidence, and digital forensics.
The Secretary of the Army is the DoD Executive Agent (EA) for Forensics, specifically for those
forensic disciplines relating to deoxyribonucleic acid (DNA), serology, firearms and tool marks,
latent prints, questioned documents, drug chemistry, and trace materials, as well as forensics
relating to forensic medicine disciplines such as forensic pathology, forensic anthropology, forensic
toxicology, and DNA analysis to identify human remains.
The Secretary of the Air Force is the DoD EA for Digital and Multimedia (D/MM) Forensics,
specifically for those forensics disciplines relating to computer and electronic device forensics,
audio forensics, image analysis, and video analysis.
Forensic-Enabled Intelligence (FEI). The intelligence resulting from the integration of scientifically
examined materials and other information to establish full characterization, attribution, and the linkage of
events, locations, items, signatures, nefarious intent, and persons of interest. (JP 2-0, Joint Intelligence,
22 Oct 2013.
FORMICA. See Foreign Military Intelligence Collection Activities.
FOUR EYES (ACGU). Australia, Canada, United Kingdom, and the United States. (CAPCO)
Front.
[In intelligence usage] a legitimate operation created by an intelligence organization as a cover for
its operatives. (Encyclopedia of the CIA, 2003)
-- Also, Front Company [in law enforcement/criminal investigation usage] a company or business
entity that is established, used, or co-opted for an illicit purpose; wherein the management, control,
influence or criminal activities are being directed by a hidden or disguised individual or group. (Colin A.
May, M.S., CFE, U.S. Department of Commerce, Sep 2010)
For additional information see Colin A. May, “Front Companies: Challenges and Tools in Criminal
Investigations,” IALEIA Journal, Vol. 19, No. 1, pp. 101-120, September 2010. The IALEIA Journal
is published by the International Association of Law Enforcement Intelligence Analysts, Inc.,
According to Colin May (in his article cited above, p. 102),”many people use the phrase ‘front
company’ when they are really describing the front company’s distant cousin—the Shell
Company. The Financial Crimes Enforcement Network… defines shell companies as ‘limited
liability companies and other business entities with no significant assets or ongoing business
activities.’ The shell simply is a paper company; they have also been called “International
Business Corporations (IBCs)” or ‘shelf companies,’ since in some off-shore jurisdictions, the
incorporators already have created the companies and simply pull them off the shelf to change
the beneficial owner. The difference cannot be overstated….”
“Front companies conduct actual business—shells do not. [Shells] are simply paper
companies. Front companies have tangible operations, although they may be illicit or
illegitimate, they are definite business transactions. The main difference that many
investigators and intelligence analysts seem to miss is the ‘action’ piece in a front company—
and that, of course, is highly dependent on the criminal’s intended purpose for the front
company. A shell, used by a criminal, disguises their involvement in the business, but the shell
has no actual operations, whereas the front company does.”
Also see Defense Security Service (DSS) article “Front Companies: Who is the End User?” at:
149
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Full Field Counterintelligence Investigation. An investigation which is conducted when there are specific
and articulable facts giving reason to believe that a person over whom Army counterintelligence has
jurisdiction may be involved in acts that may constitute threats to national security. (AR 381-20, Army CI
Program, 25 May 2010) See CI Investigation.
Within the FBI referred to as “Full Investigation” which may be opened to detect, obtain information
about, or prevent or protect against federal crimes or threats to the national security or collect
foreign intelligence. These cases may be opened if there is an “articulable basis” of possible
criminal or national threat activity.
The Investigation of threats to the national security can be investigated under FBI’s criminal
investigation authority or its authority to investigate threats to the national security. A Full
Investigation solely for the collection of positive foreign intelligence extends the sphere of the FBI’s
information gathering activities beyond federal crimes and threats to the national security and
permits the FBI to seek information regarding a broader range of matters relating to foreign powers,
organizations, or persons that may be of interest to the conduct of the United States’ foreign affairs.
-- FBI’s Domestic Investigation and Operations Guide (redacted copy), 15 Oct 2011
Full-Spectrum Counterintelligence Activities. Full array of CI activities - both offensive & defensive - that
can be applied in executing CI effects-based operations to achieve strategic outcomes in peacetime,
crisis, war and post conflict activities (e.g., stabilization operations/reconstruction efforts). These activities
support national security objectives, as well as defense decision-makers and the Combatant
Commanders.
Functional Component Command. A command normally, but not necessarily, composed of forces of two
or more Military Departments which may be established across the range of military operations to perform
particular operational missions that may be of short duration or may extend over a period of time. (JP 1,
Doctrine for the Armed Forces of the United States, 25 Mar 2013)
Functional Managers. Executive Order 12333 designates three Functional Managers: Director CIA for
human intelligence (HUMINT), Director NSA for signals intelligence (SIGINT), and Director NGA for
geospatial intelligence (GEOINT), (EO 12333, para 1.3 (b)(12)(A)(i-iiii)) See ICD 113, Functional
Managers.
Pursuant to EO 12333, Functional Managers report to the DNI concerning the extent of their duties
as Functional Managers, and may be charged with developing and implementing strategic
guidance, policies, and procedures for activities related to a specific intelligence discipline or set of
intelligence activities; setting training and tradecraft standards; and ensuring coordination within
and across intelligence disciplines and IC elements and with related non-intelligence activities.
Functional Managers may also advise on resource management; policies and procedures;
collection capabilities and gaps; intelligence processing and dissemination; technical architectures;
and other issues or activities, as applicable.
Note: The National Counterintelligence Executive (NCIX) is the Mission Manager for CI.
Functional Support [Analytical Product]. A type of CI analytical product that supports the specific needs
of a Defense CI Component. A functional support product is related to the CI functions of collection,
investigation, OFCO {Offensive Counterintelligence Operation], and functional services as described in
DoDI 5240.16. The depth and comprehensiveness varies depending on the requestor’s requirements.
An investment in analytical effort may be significant. The production timeline ranges from hours to weeks,
but can vary widely depending on the function the analysis supports. (DoDI 5240.18, CI Analysis &
Production, 17 Nov 2009 with change 1 dated 15 Oct 2013) Also see Counterintelligence Analytical
Product.
150
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Functional Support Plan (FSP). Annexes to the National Intelligence Support Plan (NISP) [that] describe
how service intelligence centers and Combat Support Agencies support COCOM plans. (Adaptive
Planning Roadmap II, 5 Mar 2008) Also see Counterintelligence Functional Support Plan (CI FSP).
Director DoD Counterintelligence Field Activity (CIFA)* will “fully integrate CI into the intelligence
campaign planning process by developing and updating the CI functional support plans.”
-- DUSD (CI&S) memo, subj: Counterintelligence Support to COCOMs, 29 Dec 2006
* Note: CIFA’s mission and functions transitioned into DIA effective 3 August 2008.
Fusion. In intelligence usage, the process of managing information to conduct all-source analysis and
derive a complete assessment of activity. (JP 2-0, Joint Intelligence, 22 Oct 2013)
-- Also, consolidating, combining, and correlating information together. (ADRP 2-0, Intelligence,
Aug 2012)
Fusion Center. A State and major urban area focal point for the receipt, analysis, gathering, and sharing
of threat-related information between the Federal Government, SLTT, and private sector partners.
(Source: DHS in the National Infrastructure Protection Plan 2013)
151
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
G ==========================================
Gap. See intelligence gap.
GAMA (G). Unclassified term used to describe a type of sensitive compartmentalized information (SCI).
(Words of Intelligence, 2nd Edition, 2011)
General Defense Intelligence Program (GDIP). An integrated Defense Intelligence capability that
includes DIA, the Service technical production centers, and special collection activities. The GDIP
integrates and produces National Intelligence for Defense and national Consumer’s. It represents the
national Defense Intelligence priorities for operational customers, national and Defense-wide collection
management, All-Source Analysis, HUMINT, MASINT, IT, and Special Activities. The GDIP is an
integrated capability, and the Director, DIA, serves as the Program Manager. The GDIP is part of the NIP,
as defined in EO 12333. The GDIP may include other NIP activities as agreed between the Secretary of
Defense and the DNI. (DoDI 5105.21, DIA, 18 Mar 2008) Also see National Intelligence Program.
The GDIP is the broadest-based NIP program within the Department Of Defense and the military
services. This program funds all national-level military intelligence units and activities that involve
something other than cryptology, counterintelligence, and certain types of specialized
reconnaissance, The GDIP funds intelligence production, collection, and infrastructure, which
includes all defense intelligence production, all national-level DoD Human Source Intelligence
(HUMINT), etc.
-- Adapted from Dan Elkins, Financial Management of Intelligence Resources: A Primer (3rd Edition),
May 1982, pp. 13-14
General Military Intelligence (GMI). Intelligence concerning the military capabilities of foreign countries or
organizations, or topics affecting potential United States or multinational military operations. (JP 2-0, Joint
Intelligence, 22 Oct 2013) Also see intelligence; military intelligence.
General Support (GS). That support which is given to the supported force as a whole and not to any
particular subdivision thereof. (JP 1-02) Also see direct support.
Geospatial Information. Information that identifies the geographic location and characteristics of natural
or constructed features and boundaries on the Earth, including: statistical data and information derived
from, among other things, remote sensing, mapping, and surveying technologies; and mapping, charting,
geodetic data and related products. (JP 2-03, GEOINT Support to Joint Operations, 22 Mar 2007)
See Congressional Research Report (CRS) R41825 (18 May 2011) for an unclassified primer on
geospatial data & geographic information systems: <http://www.fas.org/sgp/crs/misc/R41825.pdf>
Geospatial Information and Services (GI&S). The collection, information extraction, storage,
dissemination, and exploitation of geodetic, geomagnetic, imagery (both commercial and national
source), gravimetric, aeronautical, topographic, hydrographic, littoral, cultural, and toponymic data
accurately referenced to a precise location on the Earth’s surface. Geospatial services include tools that
enable users to access and manipulate data, and also include instruction, training, laboratory support,
and guidance for the use of geospatial data. (DoDD 5105.60, NGA, 29 Jul 2009 and JP 2-03, GEOINT
Support to Joint Operations, 22 Mar 2007)
Geospatial Intelligence (GEOINT). The exploitation and analysis of imagery and geospatial information
to describe, assess, and visually depict physical features and geographically referenced activities on the
Earth. Geospatial intelligence consists of imagery, imagery intelligence, and geospatial information.
(ICD 1, 1 May 2006; also JP 1-02 and JP 2-03, GEOINT Support to Joint Operations, 22 Mar 2007)
152
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, intelligence derived from the exploitation of imagery and geospatial information to describe,
assess, and visually depict physical features and geographically referenced activities on the earth.
(ODNI, U.S. National Intelligence - An Overview 2011)
The Intelligence Community refers to the use and analysis of geospatial information to assess
geographically referenced activities on Earth as geospatial intelligence (GEOINT). It is everything
you can see or know about the earth. GEOINT consists of: Imagery - a likeness of any natural or
man-made feature, as well as its location; Imagery Intelligence (IMINT) - information derived
through interpreting imagery; and Geospatial Information - information that identifies a natural or
constructed feature on Earth by its geographic location and other characteristics.
-- www.cia.gov (accessed 30 Nov 2010)
_________________________
GEOINT collection encompasses all aspects of: literal, infrared (IR), and synthetic aperture radar
(SAR) imagery; overhead persistent infrared capabilities; and geospatial information and services.
GEOINT includes the exploitation and analysis of electro-optical, IR, and radar imagery; and of
geospatial, spectral, laser, IR, radiometric, SAR phase history, polarimetric, spatial, and temporal
data. It employs all ancillary data, signature information, and fused data products, as necessary.
Integrated GEOINT products may also include data and information from collateral sources.
-- DoDD 5105.60, NGA, 29 Jul 2009
_________________________
GEOINT is typically gathered from commercial satellites, government satellites, reconnaissance
aircraft, or by other means such as maps, commercial databases, census information, GPS
waypoints, utility schematics, or any discrete data that have locations on earth. This data is utilized
to support our national security, which includes everything from assisting soldiers on the battlefield
to assisting humanitarian and disaster relief efforts.
-- www.intelligence.gov (accessed 13 Aug 2012)
Ghost Surveillance. Extremely discreet and seemingly omnipresent surveillance, working mostly out
of the view of the target. (CI Centre Glossary) Also see surveillance.
Global Information Grid (GIG). The globally interconnected, end-to-end set of information capabilities,
associated processes and personnel for collecting, processing, storing, disseminating, and managing
information on demand to warfighters, policy makers, and support personnel. The GIG includes owned
and leased communications and computing systems and services, software (including applications),
data, security services, other associated services and National Security Systems. (JP 1-02 and JP 6-0,
Joint Communications, 10 Jun 2010)
Global Force Management (GFM). The ability to align force apportionment, assignment, and allocation
methodologies in support of the National Defense Strategy and joint force availability requirements;
present comprehensive insights into global availability and operational readiness of U.S. military forces;
globally source joint force requirements; and provide senior decision-makers a vehicle to quickly and
accurately assess the impact and risk of proposed allocation, assignment, and apportionment changes.
(Joint Capability Areas Taxonomy & Lexicon, 15 Jan 2008)
Global Positioning System (GPS). A satellite-based radio navigation system operated by the Department
of Defense to provide all military, civil, and commercial users with precise positioning, navigation, and
timing. Also called GPS. (JP 1-02 and JP 3-14, Space Operations, 6 Jan 2009)
Goldwater-Nichols Act (GNA). The Goldwater-Nichols Department of Defense Reorganization Act of
1986 (PL 99-433), sponsored by Sen. Barry Goldwater and Rep. Bill Nichols, was a major reorganization
of U.S. defense institutions and processes. Operational authority was centralized through the Chairman of
the Joint Chiefs of Staff as opposed to the service chiefs. The Chairman was designated as the principal
military advisor to the President, National Security Council, and Secretary of Defense. The act
153
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
established the position of vice-chairman and streamlined the operational chain of command from the
President to the Secretary of Defense to the Unified Commanders.
For additional information see <http://www.ndu.edu/library/goldnich/goldnich.html>
Copy of PL 99-443 at <http://www.au.af.mil/au/awc/awcgate/congress/title_10.htm>
Gray Literature (aka Grey Literature). Material not well covered by conventional book trade channels.
Gray literature is intrinsically more difficult to identify, acquire, process, access, and otherwise handle
than conventional literature. Examples include but are not limited to conference papers, trade literature,
electronic bulletin boards, and foreign government reports. The information that grey literature contains is
not available in any kind of source. (Words of Intelligence, 2nd Edition, 2011)
Gray List. Contains the identities and locations of those personalities whose inclinations and attitudes
toward the political and military objectives of the United States are obscure. Regardless of their political
inclinations or attitudes, personalities may be listed on gray lists when they are known to possess
information or particular skills required by US forces. They may be individuals whose political motivations
require further exploration before they can be utilized effectively by US forces. (CI Community Lexicon)
Also see Black List; White List.
-- Also, a list of those foreign personalities of operational interest whose inclinations and attitudes
toward the political and military objectives of the United Sates are unknown. (HDI Lexicon, April 2008)
Regardless of their leanings, personalities may be on gray lists when known to possess information
or particular skills required by friendly forces. They may be individuals whose political motivations
require further exploration before they can be used effectively. Examples of individuals who may be
included in this category are:
1) Potential or actual defectors from the hostile cause whose credibility has not been established.
2) Individuals who have resisted, or are believed to have resisted the enemy government and
who may be willing to cooperate with friendly forces, but whose credibility has not been
established.
3) Nuclear, biological, chemical and other scientists and technicians suspected of having been
engaged in enemy weapons of mass destruction and other programs against their will.
-- USMC, MCWP 2-6 (previously 2-14), Counterintelligence, 5 Sep 2000
Graymail. Threat by a defendant in a trail to expose intelligence activities or other classified information
if prosecuted. (Spy Book) Also see Classified Information Procedures Act (CIPA).
“Graymail” colloquially refers to situations where a defendant may seek to introduce tangentially
related classified information solely to force the prosecution to dismiss the charges against him.
A criminal prosecution involving classified information may cause tension between the
government’s interest in protecting classified information and the criminal defendant’s right to a
constitutionally valid trial. In some cases, a defendant may threaten to disclose classified
information in an effort to gain leverage.
Concerns about this practice, referred to as “graymail,” led the 96th Congress to enact the
Classified Information Procedures Act (CIPA) to provide uniform procedures for prosecutions
involving classified information.
Green Door. Slang term for the metaphorical locked door behind which intelligence personnel are said to
hide their codeword secrets and important information not shared with consumers who need and should
get it. (Words of Intelligence, 2nd Edition, 2001)
Groupthink. A decision-making flaw that occurs when a group does not consider alternatives and desires
unanimity at the expense of quality decisions. Groupthink can lead to seeking out few alternative
solutions because there is an illusion of group invulnerability (“we all can’t be wrong’). Some symptoms of
groupthink are the absence of critical discussion of information, a sharing of stereotypes to guide
decisions, a strong moral climate, and the suppression of true feelings among the participants in the
group. (Words of Intelligence, 2nd Edition, 2011)
154
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
GRU. Glavnoye Razvedyvatel’noye Upravlenie (Chief Intelligence Directorate of the General Staff);
aka Russian Military Intelligence.
Russian military intelligence has a spy network abroad that is believed by
espionage experts to be several times bigger than that of Russia's Foreign
Intelligence Service.
-- Reuters, 24 Apr 2009
____________________
Also see Viktor Suvorov’s (alias for GRU defector Vladimir Bogdanovich
Rezun) books: Aquarium (Аквариум), 1985 and Inside Soviet Military
Intelligence, 1984.
Guerrilla Force. A group of irregular, predominantly indigenous personnel organized along military lines
to conduct military and paramilitary operations in enemy-held, hostile, or denied territory. (JP 1-02 and
JP 3-05, Special Operations, 18 Apr 2011)
155
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
H ==========================================
Hacker. Unauthorized user who attempts to or gains access to an information system. (CNSSI No. 4009,
National Information Assurance Glossary, 26 April 2010)
-- Also, a person who creates and modifies computer software and hardware, including computer
programming, administration, and security-related items. This can be done for either negative or positive
reasons. Criminal hackers create malware in order to commit crimes. (McAfee.com; accessed 15 Nov
2010)
In computer security usage, a term used for a person who accesses a computer system by
circumventing its security system.
Hacktivism. The nonviolent use of ambiguous digital tools in pursuit of political ends; these tools include
website defacements, redirects, denial-of-service attacks, information theft, website parodies, virtual sit-
ins, virtual sabotage, and software development. (<en.wikipedia.org/wiki/Hacktivists>; accessed 2 Apr
2009) Also see hacktivists.
Hacktivism is the use of cyber instruments for political or ideological purposes.
Hacktivism is a controversial term. Some argue it was coined to describe how electronic direct
action might work toward social change by combining programming skills with critical thinking.
Others use it as practically synonymous with malicious, destructive acts that undermine the
security of the Internet as a technical, economic, and political platform.
The term “hackitivism” first appeared in 1998, when members of a hacker group called the Cult of
the Dead Cow used it as they chatted online about hacking and political liberation while discussing
ideas to work with Chinese hackers following the Tiananmen Square protests.
For additional information see McAfee White Paper, “Cybercrime and Hacktivism” (undated),
available online at:
Hacktivists. Individuals who hack or attack Web sites and computer systems to communicate an
ideological, social, or political message and further their cause. (FBI, Nov 2012) Also see hacktivism.
Hacktivists continue to target a wide range of companies and organizations in denial-of-service
attacks…. Most hacktivists use short-term denial-of-service operations or expose personally
identifiable information held by target companies, as forms of political protest. However, a more
radical group might form to inflict more systemic impacts—such as disrupting financial networks—
or accidentally trigger unintended consequences that could be misinterpreted as a state-sponsored
attack.
-- DNI, Worldwide Threat Assessment of the US Intelligence Community, SSCI, 12 March 2013
Handler. An intelligence officer or co-opted worker directly responsible for the operational activities of an
agent; also agent handler or case officer. (CI Community Lexicon) Also see agent handler; case officer.
-- Also, an intelligence collector directly responsible for the operational activities of an agent, source,
or asset. (HDI Lexicon, April 2008)
Hard Target. A person, nation, group, or technical system often hostile to the US or heavily protected,
with a well-honed counterintelligence capability that presents a potential threat to the US or its interests,
and provides significant difficulty for agent infiltration or penetration. (National HUMINT Glossary)
Harmony. The Intelligence Community’s centralized database for foreign military, technical and open-
source documents and their translations. Harmony is managed by the US Army’s National Ground
Intelligence Center (NGIC). Also see DOMEX; DOCEX.
156
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Hawala. The word comes originally from the Arabic language and means transfer or remittance.
(US Department of Treasury)
Hawala provides a fast and cost-effective method for worldwide remittance of money or value,
particularly for persons who may be outside the reach of the traditional financial sector. In some
nations hawala is illegal, in others the activity is considered a part of the “gray” economy. It is
therefore difficult to accurately measure the total volume of financial activity associated with the
system, however, it is estimated that the figures are in the tens of billions of dollars, at a minimum.
Officials in Pakistan, for example, estimate that more than $7 billion flow into the nation through
hawala channels each year. Other Alternative Remittance or Informal Value Transfer Systems
include “hundi,” “fei ch ‘ien,” “chit system,” “poey kuan” and the black market peso exchange.
-- US Department of Treasury web site, accessed 19 Nov 2012
<http://www.treasury.gov/resource-center/terrorist-illicit-finance/Pages/Hawala-and-Alternatives.aspx>
Hazard or Hazardous Condition. [In TSCM] a condition, either technical or physical, that could permit the
exfiltration and exploitation of information. (DoDI 5240.05, TSCM, 3 Apr 2014)
Hazards. [In critical infrastructure protection usage] non-hostile incidents such as accidents, natural
forces, and technological failure that cause loss or damage to infrastructure assets. (DoDD 3020.40,
DoD Policy and Responsibilities for Critical Infrastructure, 14 Jan 2010 w/ chg 2 dated 21 Sep 2012)
Hello Number. Tradecraft jargon for a cutout telephone where the speaker does not identify himself or
his/her location. This procedure is used by proprietaries, devised facilities or cover offices of clandestine
intelligence agencies for certain types of contacts with agents or affiliated personnel, usually in an
emergency, and only information given by the caller over the phone is a codeword or danger signal to be
relayed to the appropriate case officer for immediate call-back or other pre-arranged action. (Leo D. Carl,
The CIA Insider’s Dictionary, 1996)
Heuristics. Normal, intuitive mental shortcuts for processing information. They can be effective aids for
problem-solving, but can lead to biases and thus to analytic errors.
High-Payoff Target (HPT). A target whose loss to the enemy will significantly contribute to the success of
the friendly course of action. High-payoff targets are those high-value targets that must be acquired and
successfully attacked for the success of the friendly commander's mission. (JP 1-02 and JP 3-60, Joint
Targeting, 13 Apr 2007) Also see high-value target; target.
High-Risk Personnel (HRP). Personnel who, by their grade, assignment, symbolic value, or relative
isolation, are likely to be attractive or accessible terrorist targets. (JP 1-02 and JP 3-07.2, Antiterrorism,
24 Nov 2010)
High-Value Detainee Interrogation Group (HIG). The interagency body under the administrative control of
the Federal Bureau of Investigation that was established to assemble and dispatch mobile interrogation
teams to interrogate high-value detainees. (DoDD 3115.13, DoD Support to the High-Value Detainee
Interrogation Group, 9 Dec 2010 w/ chg 1 dated 15 Nov 2013)
-- Also, an interagency body that collects intelligence from key terror suspects to prevent attacks
In response to Task Force recommendations from Executive Order 13491, Ensuring Lawful
Interrogations, the High-Value Detainee Interrogation Group was created in 2009 to coordinate law
enforcement, military, and intelligence efforts in interrogating key terror suspects. The HIG is
housed in the FBI’s NSB [National Security Branch], and staffed with members from various IC
[Intelligence Community] agencies.
-- FBI web site at <http://www.fbi.gov/about-us/nsb/national-security-branch-brochure>
157
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
High-Value Target (HVT). A target the enemy commander requires for the successful completion of
the mission. The loss of high-value targets would be expected to seriously degrade important enemy
functions throughout the friendly commander's area of interest. (JP 1-02 and JP 3-60, Joint Targeting,
13 Apr 2007) Also see high-payoff target and target.
HOCNet. HUMINT Operational Communication Network (HOCNet) provides information technology,
communications, and desktop services for DoD HUMINT needs. (National Intelligence: A Consumer’s
Guide - 2009)
Homegrown Violent Extremist (HVE). A person of any citizenship who has lived and/or operated primarily
in the United States or its territories who advocates, is engaged in, or is preparing to engage in
ideologically-motivated terrorist activities (including providing support to terrorism) in furtherance of
political or social objectives promoted by a foreign terrorist organization, but is acting independently of
direction by a foreign terrorist organization. (FBI & DHS, cited in CRS Report R42536, 15 May 2012)
“HVEs are growing threat to the DoD, as evidenced by numerous disrupted plots targeting DoD
facilities, installations, and personnel since 2009. The majority of HVE plots are unsophisticated,
use readily available weapons, and target nearby facilities. While they are less likely to generate
spectacular, mass casualty attacks than transnational terror groups, HVE attacks are considerably
more difficult for law enforcement and intelligence agencies to detect and disrupt.”
-- LTG Michael Flynn, Director, DIA, Annual Threat Assessment [Unclassified], Statement before the
Senate Armed Services Committee, 18 April 2013, p.10
Homegrown Terrorist. As defined by the Congressional Research Service, homegrown describes terrorist
activity or plots perpetrated within the United States or abroad by American citizens, legal permanent
residents, or visitors radicalized largely within the United States. (CRS Report R41416, 23 Jan 2013)
American Jihadist Terrorism: Combating a Complex Threat, CRS Report R41416, 23 Jan 2013
available online at: <http://www.fas.org/sgp/crs/terror/R41416.pdf>
______________________
The term “homegrown terrorism” means the use, planned use, or threatened use, of force or
violence by a group or individual born, raised, or based and operating primarily within the United
States or any possession of the United States to intimidate or coerce the United States
government, the civilian population of the United States, or any segment thereof, in furtherance of
political or social objectives.
-- House Bill 1955, 110th Congress, 24 Oct 2007
______________________
[T]he long war on terrorism is far from over. Most disturbingly, an increasing number of Islamist-
inspired terrorist attacks are originating within America’s borders. The rise of homegrown
extremism is the next front in the fight against terrorism and should be taken seriously by the
Administration.
-- The Heritage Foundation, Special Report No. 137, 60 Terrorist Plots Since 9/11: Continued Lessons
in Domestic Counterterrorism, 22 July 2013
Homeland. The physical region that includes the continental United States, Alaska, Hawaii, United States
territories, and surrounding territorial waters and airspace. (JP 1-02 and JP 3-28, Defense Support of Civil
Authorities, 31 Jul 2013)
Homeland Defense (HD). The protection of United States sovereignty, territory, domestic population, and
critical infrastructure against external threats and aggression, or other threats as directed by the
President. (JP 1-02 and JP 3-27, Homeland Defense, 29 Jul 2013)
Homeland Security (HS). A concerted national effort to prevent terrorist attacks within the United States;
reduce America’s vulnerability to terrorism, major disasters, and other emergencies; and minimize the
damage and recover from attacks, major disasters, and other emergencies that occur. (JP 3-27,
Homeland Defense, 29 Jul 2013)
158
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, a concerted national effort to prevent terrorist attacks within the United Sates, reduce
America’s vulnerability to terrorism, and minimize the damage and recover from attacks that do occur.
(National Strategy for Homeland Security, Oct 2007).
-- Also, describes the intersection of evolving threats and hazards with traditional governmental and
civic responsibilities for civil defense, emergency response, law enforcement, customs, border control,
and immigration. (Quadrennial Homeland Security Review Report, Feb 2010)
-- Also, defensive efforts to counter terrorist threats. (National Strategy for Counterterrorism, 2011)
In the years since 9/11, homeland security has become commonly and broadly known as both a
term and as a Federal department.
Homeland security is a concerted effort to ensure a homeland that is safe, secure, and resilient
against terrorism and other hazards where American interests, aspirations, and way of life can
thrive. Ultimately, homeland security is about effectively managing risks to the Nation’s security.
-- Quadrennial Homeland Security Review Report, Feb 2010
The Quadrennial Homeland Security Review Report (Feb 2010) is available online at:
________________________
According a Jan 2013 Congressional Research Service (CRS) report, the U.S. government does
not have a single definition for “homeland security.” Currently, different strategic documents and
mission statements offer varying missions that are derived from different homeland security
definitions. The concept of homeland security has evolved over the last decade.
-- See CRS Report R42462, 8 Jan 2013 (accessed 9 Jan 2013)
copy available at: <http://www.fas.org/sgp/crs/homesec/R42462.pdf>
Homeland Security Information. Any information possessed by a Federal, State, or local agency that:
a) relates to the threat of terrorist activity; b) relates to the ability to prevent, interdict, or disrupt terrorist
activity; c) would improve the identification or investigation of a suspected terrorist organization; or d)
would improve the response to a terrorist act. (Homeland Security Act, § 891)
Honey Pot. A trap set to detect, deflect, or in some manner counteract attempts at unauthorized use of
information systems. Generally it consists of a computer, data, or a network site that appears to be part of
a network, but is actually isolated, (un)protected, and monitored, and which seems to contain information
or a resource of value to attackers. (JP 1-02 and JP 3-13.4, Military Deception)
-- Also, a system (e.g., a web server) or system resource (e.g., a file on a server) that is designed to
be attractive to potential crackers and intruders and has no authorized users other than its administrators.
(CNSSI No. 4009, National Information Assurance Glossary, 26 April 2010)
-- Also, in computer terminology, a trap set to detect, deflect, or in some manner counteract attempts
at unauthorized use of information systems. Generally it consists of a computer, data, or a network site
that appears to be part of a network but which is actually isolated, (un)protected, and monitored, and
which seems to contain information or a resource that would be of value to attackers. (Wikipedia;
accessed 18 Jan 2011)
Honey Trap. The term universally applied to operations undertaken to ensnare an unwary target in a
compromising sexual encounter that may leave the victim vulnerable to blackmail that might result in
espionage. (Historical Dictionary of Cold War Counterintelligence, 2007) .
-- Also, slang for use of men or women in sexual situations to intimidate or snare others. …[U]se of
sex to trap or blackmail an individual…. (Spy Book)
159
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, an often-used espionage technique wherein a person is deliberately targeted for sexual
entrapment. (Encyclopedia of the CIA, 2003)
Pravda (the Russian news organization) reported on the use of sexual blackmail by the KGB
(Soviet Foreign Intelligence Service), see “KGB Sex Espionage,” Pravda, 7 Aug 2002.
________________________
Honey Trap -- a strategy regularly adopted by the KGB’s Second Chief Directorate which routinely
attempted to entrap Western businessmen, foreign diplomats, and other visitors in Moscow, the
techniques included the deployment of attractive women, known as ‘‘Swallows,’’ and men, referred
to as ‘‘Romeos,’’ who homed in on vulnerable women, often lonely secretaries with access to
classified information.
-- Nigel West, Historical Dictionary of Cold War Counterintelligence, 2007, p. 155
______________________
The use of sex is “a common practice among intelligence services all over the world. This is a tough
dirty business. We have used that technique against the Soviets. They have used it against us.”
-- Former Assistant FBI Director William C. Sullivan
Testimony before the Church Committee, United States Senate, 1 November 1975
Horizontal Identification. [Proposed DoD definition] consistent determination of CPI across two or more
RDA programs as a result of a former CPI identification process. (Draft 5200.39 CPI Identification and
Protection within RDA Programs)
Horizontal Integration. Processes and capabilities to acquire, synchronize, correlate, and deliver National
Security Community data with responsiveness to ensure success across all policy and operational
missions. (CJCSI 3340.02, Horizontal Integration of Warfighter Intelligence, 23 Dec 2005)
Horizontal Protection. The process which ensures that critical program information (CPI) associated with
two or more acquisition programs is protected to the same degree by all responsible DoD agencies.
(AR 381-20, Army CI Program, 25 May 2010) Also see critical program information.
-- Also, [proposed DoD definition] application of a consistent level of protection to similar CPI
associated with more than one RDA program, including inherited CPI. (Draft DoDI 5200.39, CPI
Identification and Protection within RDA Programs)
Horizontal Protection Analysis. The process that determines if critical Defense technologies, to include
CPI [critical program information], associated with more than one RDA [research, development &
acquisition] program are protected to the same degree by all involved DoD activities. (DoDI 5200.39, CPI
Protection within DoD, 16 Jul 2008 with change 1 dated 28 Dec 2010)
Horizontal protection within DoD is focused on ensuring that research, development and
acquisition (RDA) information associated with more than one research and technology activity
or acquisition program is protected to the same degree by all DoD activities, or is adequately
protected based on the impact of an aggregation of the correlated information.
Host Country. A nation which permits, either by written agreement or official invitation, government
representatives and/or agencies of another nation to operate, under specified conditions, within its
borders. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 chg 1 dated 26 Aug
2011)
Host Nation (HN). A nation that receives the forces and/or supplies of allied nations, coalition partners,
and/or NATO organizations to be located on, to operate in, or to transit through its territory. (JP 1-02)
Host-Nation Support (HNS). Civil and/or military assistance rendered by a nation to foreign forces within
its territory during peacetime, crises or emergencies, or war based on agreements mutually concluded
between nations. (JP 1-02 and JP 4-0, Joint Logistics, 18 Jul 2008)
160
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Hostage Rescue (HR). A personnel recovery method used to recover isolated personnel who are
specifically designated as hostages. (JP 1-02 and JP 3-50, Personnel Recovery, 5 Jan 2007)
Hostile Act. An attack or other use of force against the United States, United States forces, or other
designated persons or property to preclude or impede the mission and/or duties of United States forces,
including the recovery of United States personnel or vital United States Government property. (JP 1-02
and JP 3-28, Defense Support of Civil Authorities, 31 Jul 2013)
Hostile Environment. Operational environment in which hostile forces have control as well as the intent
and capability to effectively oppose or react to the operations a unit intends to conduct. (JP 1-02)
Hostile Intent. The threat of imminent use of force against the United States, United States forces, or
other designated persons or property. (JP 1-02 and JP 3-01, Countering Air and Missile Threats, 23 Mar
2012)
HotR. DoD acronym for HUMINT On-Line Tasking and Reporting System. HotR is a web-based software
application that supports DoD HUMINT, as well as DoD Counterintelligence.
House Permanent Select Committee on Intelligence (HPSCI). A committee of the US House of
Representatives, established by House Resolution 658 on July 14, 1977. It is the primary committee in
the U.S. House of Representatives charged with the oversight of the US Intelligence Community and
intelligence-related activities of all other government organizations. Also see Senate Select Committee
on Intelligence.
The 1980 Intelligence Oversight Act charged the Senate Select Committee on Intelligence and
HPSCI with authorizing the programs of US intelligence agencies and overseeing their activities.
It is IC policy that IC elements shall, in a timely manner, keep the Congressional intelligence
committees fully informed, in writing, of all significant anticipated intelligence activities, significant
intelligence failures, significant intelligence activities, and illegal activities.
-- ICD 112, Congressional Notification, 16 Nov 2011
Human Derived Information (HDI). Activities related to the conduct of the collection of intelligence
information by or through humans. It includes the following forms of information: FI, CI, Force Protection,
Research and Technology Protection, and Law Enforcement. (SECNAVINST S3821.1, 19 Nov 2008)
Human Domain. The presence, activities, social structure or organization, networks and relationships,
motivation, intent, vulnerabilities and capabilities of individuals or groups.
The human domain encompasses the totality of the physical, cultural, and social environments that
influence human behavior. Success in the human domain will depend upon understanding the
human terrain and establishing trust with those humans who occupy that space.
-- Navy Adm. William H. McRaven, Commander, US Special Operations Command, 5 June 2013
____________________
The Human Domain, or Human Dimension, which is a vital and integral part of ABI [Activity Based
Intelligence], is defined as the presence, activities (including transactions - both physical and
virtual), culture, social structure/organization, networks and relationships, motivation, intent,
vulnerabilities, and capabilities of humans (single or groups) across all domains of the operational
environment (Space, Air, Maritime, Ground, and Cyber).
-- Mark Phillips, “A Brief Overview of Activity Based Intelligence and Human Domain Analytics,” (Sep 2012);
161
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Human Enabled Information (HEI). Activities designed to spot, assess and develop platforms which
facilitate information collection and other assigned operations. (SECNAVINST S3821.1, 19 Nov 2008)
Human Factors. The physical, cultural, psychological, and behavioral attributes of an individual or group
that influence perceptions, understanding, and interactions. (JP 2-0, Joint Intelligence, 22 Oct 2013) Also
see human domain.
Human Intelligence (HUMINT). A category of intelligence derived from information collected and provided
by human sources [includes HUMINT enabling]. (ICD 1, 1 May 2006; JP 1-02; JP 2-0, Joint Intelligence,
22 Oct 2013; and DoDD S-5200.37, Management and Execution of Defense HUMINT, 9 Feb 2009)
-- Also, a category of intelligence derived from information collected by USG civilian employees or
military personnel. Who are trained and certified HUMINT collectors, and assigned to an organization with
the mission and authority to collect foreign intelligence from human sources in response to validated
intelligence requirements. (DHE-M 3301.002, Vol II Collection Operations, 23 Nov 2010)
-- Also, intelligence derived from information collected and provided by human sources. This
intelligence includes overt data collected by personnel in diplomatic and consular posts, as well as
otherwise unobtainable information collected via clandestine sources of information, debriefings of foreign
nationals and U.S. citizens who travel abroad, official contacts with foreign governments, and direct
observation. (National Intelligence: A Consumer’s Guide - 2009)
-- Also, [from CIA perspective] vital information from human sources acquired by Core Collectors of
the National Clandestine Service in response to national intelligence requirements. (www.cia.gov, posted
23 Mar 2009) Also see national clandestine service.
-- Also, the collection by a trained human intelligence collector of foreign information from people and
multimedia to identify elements, intentions, composition, strength, dispositions, tactics, equipment, and
capabilities. (Army FM 2-0, Intelligence 23 Mar 2010 and FM 2-22.2, CI, Oct 2009)
-- Also, consists of information obtained from individuals who know or have access to sensitive
foreign information that has implications for U.S. security interests. (WMD Report, 31 Mar 2005)
-- Also, a category of intelligence, that which is reported by a government information collector, who
has obtained it either directly or indirectly from a human source. (IC21, HPSCI Staff Study, 9 Apr 1996)
HUMINT collection is a science and an art.
-- Army FM 2-22.3, Human Intelligence Collector Operations
HUMINT - espionage - is the heart of the spy business
Core Mission: Collect foreign intelligence through human sources to fill critical intelligence gaps.
Human Intelligence (HUMINT) is intelligence derived from human beings who may act as both
sources and collectors, and where the human is the primary collection instrument. It is a foreign
intelligence (FI) collection discipline. HUMINT collectors focus on acquiring information from
individuals with access to vital intelligence on the full range of national security issues.
There are two basic types of HUMINT: overt and clandestine. Overt HUMINT methods include,
but are not limited to, debriefing, interrogation, elicitation, and observation. Clandestine HUMINT,
sometimes referred to as Clan HUMINT, involves intelligence activity using human sources
directed towards the acquisition of information through clandestine means, i.e., espionage.
“In overt collection, the collector meets openly with sources as a declared U.S. Government
representative.
…Clandestine collection is conducted in secret. …After the source is
recruited, contact is usually strictly controlled in an effort to elude discovery. The recruitment
of a clandestine human source can take months or years, but the leak of a source’s
information may immediately eliminate access to that source.”
-- U.S. National Intelligence - An Overview 2011, p, 54
162
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
The Director CIA serves as the National HUMINT Manager for the Intelligence Community (IC)
with the authority to coordinate, deconflict, and evaluate HUMINT operations across the IC;
authorities for clandestine HUMINT delegated to the Director of the National Clandestine Service
(NCS); see ICD 300 and ICD 304.
The Director DIA serves as the Defense HUMINT Manager responsible for providing centralized
management of DoD HUMINT.
U.S. FI collection priorities are driven by the National Intelligence Priorities Framework (NIPF);
see NSPD 26 and ICD 204. For DoD HUMINT policy see DoDD S-5200.37, Management and
Execution of Defense Human Intelligence (HUMINT) (U), 9 Feb 2009 with chg 2.
___________________________
Foreign intelligence entities worldwide, as well as a variety of non-state actors, commercial
enterprises, and regional organizations) use clandestine human intelligence collection to “acquire
information” (aka conduct espionage). Typically intelligence entities rely upon specially trained or
designated employees, often referred to as “case officers” or “agent handlers” (aka operations
officers within CIA) to spot, access, develop, and recruit agents who can provide information that
is not publicly available.
Within CIA, Operations Officers (OOs) are certified Core Collectors who collect human intelligence
of concern to the U.S. President, policymakers, and military by recruiting and handling clandestine
human sources in a secure manner. OOs clandestinely spot, assess, develop, recruit and handle
human sources with access to vital intelligence.
-- See <https://www.cia.gov/offices-of-cia/clandestine-service/careers/careers-operations-officer.html>
___________________________
Human-Source Intelligence (HUMINT). The oldest method for collecting information, this is
intelligence derived from human sources. Collection includes clandestine acquisition of
photography, documents, and other material; overt collection by personnel in diplomatic and
consular posts; debriefing of foreign nationals and US citizens who travel abroad; and official
contacts with foreign governments. To the public, HUMINT is synonymous with espionage and
clandestine activities. However, most of it is accumulated by overt collectors such as diplomats and
military attaches.
The CIA, working closely with the Office of the Director of National Intelligence (ODNI) established
the National Clandestine Service (NCS) to improve HUMINT throughout the IC. The NCS serves as
the national authority for coordination, de-confliction, and evaluation of clandestine HUMINT
operations, both abroad and inside the United States. While the ODNI establishes policy related to
clandestine HUMINT, the NCS executes and implements that policy across the Intelligence
Community (IC).
___________________________
Human Intelligence is derived from the analysis of foreign positive information collected by a
trained HUMINT Collector from people and multimedia to identify elements, intentions, composition,
strength, dispositions, tactics, equipment, personnel, and capabilities. It uses human contacts and
informants as a tool, and a variety of collection methods to gather information that satisfies the
commander’s critical information requirements (CCIR) and cues other collection resources.
-- Colonel Jerry W. Jones (USA Retired), "CI and HUMINT or HUMINT and CI or CI/HUMINT or TAC
HUMINT," Military Intelligence Professional Bulletin, vol. 28, no. 2 (April 2002), p 29.
___________________________
HUMINT is the oldest collection discipline and a key contributor to the all-source picture of the
battlefield. HUMINT is the intelligence, to include adversary intentions, derived from information
collected from people and related documents. It uses human sources acquired both passively and
actively to gather information to answer intelligence requirements and to cross-cue other
intelligence disciplines. HUMINT is produced from the collection on a wide range of requirements
with the purpose of identifying adversary capabilities and intentions.
-- U.S. Army ST 2-22.7, Tactical Human Intelligence and Counterintelligence Operations, April 2002, p. 7-4.
___________________________
163
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
The U.S. will continue to need the capabilities to collect HUMINT, especially as a major insight into
intentions and plans of hostile states or groups, and to carry out covert action.
-- IC 21: HPSCI Staff Study, 9 Apr 1996 (Finding, p.18)
___________________________
As George Kisevalter, a CIA case officer who handled defector Col. Oleg Penkovsky, stressed,
HUMINT was as much an art as a science, and that “common sense, and the ability to analyze
charter quickly and decisively, were the intelligence officer’s greatest assets.” So too, the mastery
of intelligence tradecraft is imperative for success.
-- Julie Anderson, “The HUMINT Offensive from Putin’s Chekist State,” International Journal of Intelligence
and Counterintelligence, Vol 20 No 2 (Summer 2007), p. 274
Note: Mr. Kisevalter handled both Major Pyotr Popov, the first Soviet GRU officer run by the CIA, as well as
Colonel Oleg Penkovsky. See Clarence Ashley. CIA SpyMaster (2004) for the inside story on a CIA legend. .
___________________________
Counterintelligence (CI) is often mistaken as part of or a subset of HUMINT. Although HUMINT
and CI are partners in the Human Domain -- both are intelligence activities that operate in the
human domain -- they are distinctly different…different missions, different authorities, each
focused on different content, as well as outcomes. FI collection values the information above
all, whereas CI insists on acting on that information--a totally different operational dynamic. See
counterintelligence.
Human Intelligence Collector. See HUMINT Collector.
Human Intelligence Source. People who provide intelligence directly; individuals associated with
organizations (such as foreign government entities and intelligence services) who willingly share
intelligence information with the United States; individuals and organizations who facilitate the
placement or service of technical collection means that could not succeed without their support; and
foreign citizens who are identified as of an intelligence interest to the United States with a reasonable
expectation that they will provide information or services in the future. Information that may reveal the
identities of people upon whom the United States relies for information, access to information, or
cooperation leading to obtaining information is considered to potentially reveal human intelligence
sources. (DoD Manual 5200.01-Vol 1, DoD Information Security Program, 24 Feb 2012) Also see
Human Source, Source.
Human Source. A person who wittingly or unwittingly conveys by any means information of potential
intelligence value. (ICS Glossary) Also see Human Intelligence Source; Source.
-- Also, a person from whom information can be obtained. (Army FM 2-22.3, HUMINT Collector
Operations, 6 Sep 2006)
“Every person—friendly, hostile, or neutral—is a potential source of information. The HUMINT
information collection system uses various methods to collect information from a number of
sources.”
-- U.S. Army ST 2-22.7, Tactical Human Intelligence and Counterintelligence Operations, Apr 2002
_______________________
“[H]uman sources collect the smallest volume of intelligence but generally it is the most difficult to
obtain and the most useful when we do get it. It is in this area that the best information is acquired
on the all-important subject of intentions.”
-- General Veron Walters (Former DCI), Silent Missions (1978)
164
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Human Source Contact Operations (SCO). HUMINT collection activity directed toward the establishment
of human sources who have agreed to meet and cooperate with HUMINT collectors for the purpose of
providing information. (Army FM 2-22.3, HUMINT Collector Operations, 6 Sep 2006)
SCO sources include: one-time contacts, continuous contacts, and formal contacts from
debriefings, liaison, and contact operations. The basic goal of all levels of contact is to collect
information in response to collection tasking.
--
Army FM 2-22.3, Human Intelligence Collector Operations (2006)
Human-Source Intelligence. Intelligence obtained from human sources. See Human Intelligence.
Human Terrain Analysis. A multidisciplinary approach to describe and predict geospatial and temporal
patterns of human behavior by analyzing the attributes, actions, reactions, and interactions of groups or
individuals in the context of their environment. (DoDD 3600.01, Information Operations, 14 Aug 2006 with
chg 1, 23 May 2011)
HUMINT. See Human Intelligence.
HUMINT Collection Activities. Categories include: tactical questioning; screening, interrogation;
debriefing; liaison; human source contact operations (SCOs), documents exploitation (DOCEX); and
captured enemy equipment (CEE) operations. (Army FM 2-22.3, HUMINT Collector Operations, 6 Sep
2006)
DoDD S-5200.37 provides overarching policy for all Defense HUMINT collection operations. Also
see: DHE-M 3301.001, Vol I, Collection Requirements, Reporting, and Evaluation Procedures (U);
DHE-M 3301.002, Vol II, Collection Operations (U); and Army FM 2-22.3, Human Intelligence
Collector Operations.
HUMINT Collection Requirement (HCR). A long-term, DoD validated HUMINT collection requirement
which supports DoD or IC operational planning, policy- and decision making, intelligence production, and
intelligence databases. (DHE-M 3301.001, DIA HUMINT Manual, Vol I, 30 Jan 2009 w/ chg 2)
HUMINT Collection Methods. There are two HUMINT collection methods authorized for use within DoD:
overt and clandestine. (JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug
2011)
HUMINT Collection Requirement (HCR). A long-term DoD-wide HUMINT collection requirement which
supports DoD operational planning, policy- and decision-making, intelligence production, and intelligence
databases. (Defense HUMINT Enterprise Manual 3301.002, Vol II Collection Operations, 23 Nov 2010)
HUMINT Collection Team (HCT). Element that collects information from human sources. (Army FM
2-22.3, HUMINT Collector Operations, 6 Sep 2006)
HUMINT Collector. A person who is specifically trained and certified for, tasked with, and engages in the
collection of information from HUMINT sources for the purposes of answering intelligence information
requirements. (DHE-M 3301.001, Vol I: Collection Requirement, Reporting, and Evaluation Procedures,
30 Jan 2009, w/ chg 2 dated 1 Feb 2012)
-- Also, a person who is specifically trained and certified for, tasked with, and engages in the
collection of information from individuals (HUMINT sources) for the purpose of answering intelligence
information requirements. (Army FM 2-22.3, HUMINT Collector Operations, Sep 2006)
Within DoD, appropriately trained and certified individuals are the only personnel authorized to
conduct HUMINT operations beyond tactical questioning.
165
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
HUMINT Enabling. An operational support function in which non-HUMINT intelligence collection
operations are facilitated by HUMINT collection platforms.
HUMINT Operations. Intelligence activities, including military source operations, the primary purpose of
which is to obtain foreign intelligence information collected and provided by human sources. (DoDD
S-3325.09, Oversight, Management, and Execution of Defense Clandestine Source Operations, 9 Jan
2013, with chg 1 dated 13 Jun 2013) Also see human intelligence.
DoD HUMINT operations are conducted in response to DoD or national requirements based on the
needs of the originator.
HUMINT Operations Cell (HOC). Assigned under the J/G2X to track all HUMINT activities in the area
of intelligence responsibility. It provides technical support to all HUMINT collection operations and
deconflicts HUMINT collection operations in the AO. (Term previously defined in Army FM 2-0,
Intelligence, May 2004)
For additional information on the HOC see: JP 2-01.2, CI & HUMINT in Joint Operations (U),
16 Mar 2011 (w/ chg 1 dated 26 Aug 2011), p. II-8 (para 3c).
HUMINT Source. A person from which services or intelligence information are obtained. The source may
possess either first or second-hand knowledge normally obtained through sight or hearing and may be
witting or unwitting. (DHE-M 3301.002, Vol II Collection Operations, 23 Nov 2010) Also see human
source; source.
-- Also, a person from whom information can be obtained. (Army FM 2-22.3, HUMINT Collector
Operations, 6 Sep 2006)
HUMINT Support Element (HSE). A DIA representative or staff element assigned to support a COCOM.
An HSE provides liaison and assists the COCOM with HUMINT planning, coordination, collection
management, training, and operations. (DHE-M 3301.002, Vol II Collection Operations, 23 Nov 2010)
HUMINT Targeting. The integration of all-source intelligence and systemic analytic methodologies to
identify and develop relevant HUMINT leads in direct support of HUMINT collection operations.
(DHE-M 3301.002, Vol II Collection Operations, 23 Nov 2010)
HUMINT Tasks. Include but not limited to: conducting source operations; liaising with host nation officials
and allied counterparts; eliciting information from select sources; debriefing US and allied forces and
civilian personnel including refugees, displaced persons, third-country nationals, and local inhabitants;
interrogating enemy prisoners of war and other detainees; and initially exploiting documents, media, and
material. (Army FM 2-22.3, HUMINT Collector Operations, 6 Sep 2006)
HUMINT Training. Instruction and applied exercises for acquiring and retaining skills and knowledge
required in the acquisition of foreign intelligence derived from the collection discipline that uses human
beings as both sources and collectors. (DoDI 3305.15, DoD HUMINT Training, 25 Feb 2008)
HUMINT Training Joint Center of Excellence (HT-JCOE). An advanced joint HUMINT training activity that
supports HUMINT activities within the DCHE [Defense CI and HUMINT Enterprise]. The HT-JCOE is
comprised of HT-JCOE West and HT-JCOE East. The HT-JCOE West operates with the Department of
the Army. The JT-JCOE East operates within the [Defense Intelligence Agency]. (DoDI O-5109.95,
HT-JCOE, 18 Apr 2012)
166
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Hybrid Threats. Hybrid threats refer to the ability of adversaries—lone attackers, criminal, transnational
terrorist organizations, even nation-states—to employ combinations of tactics, technologies, and
capabilities to gin an asymmetric advantage. (Quadrennial Homeland Security Review Report, Feb 2010)
-- Also, the diverse and dynamic combination of regular forces, irregular forces, terrorist forces,
and/or criminal elements unified to achieve mutually benefitting effects. (ADRP 3-0, Unified Land
Operations, May 2012)
Hyperspectral Imagery (HSI). Term used to describe the imagery derived from subdividing the
electromagnetic spectrum into very narrow bandwidths. These narrow bandwidths may be combined with
or subtracted from each other in various ways to form images useful in precise terrain or target analysis.
(JP 1-02 and JP 2-03, Geospatial Intelligence Support to Joint Operations, 31 Oct 2012).
167
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
I ==========================================
i-Space (Integrated Space): a U.S. Intelligence Community (IC) social networking and collaboration
service hosted on JWICS; intended to foster and facilitate collaboration between IC members. Previously
known as “A-Space,” the transformation to i-Space broadens membership from analyst only to virtually
any intelligence professional with access and a mission need. (Intellipedia, accessed 1 Nov 2013)
ICE-mail. Email between organizations over JWICS network. Also referred to as ICE-mail or JWICS
email. (National Intelligence: A Consumer’s Guide - 2009)
ICON. See Investigations, Collections and Operations Nexus.
Identity. The distinguishing characteristics or personality of an individual or facility. (DoDI S-5105.63,
Implementation of DoD Cover and Cover Support Activities, 20 Jun 2013)
Identity Intelligence (I2). The intelligence resulting from the processing of identity attributes concerning
individuals, groups, networks, or populations of interest. (JP 2-0, Joint Intelligence, 22 Oct 2013)
Ideology. Commitment to a competing political or economic system such as Communism. (PERSEREC
1992) Also see divided loyalties, MICE.
IDSRS. See Integrated Defense Source Registry System.
Illegal. An officer, employee, or agent of an intelligence organization who is dispatched abroad and who
has no overt relationship with the intelligence service with which he/she is connected or with the
government operations that intelligence service. Term is derived from the fact that the individual is in the
host country illegally. (CI Community Lexicon)
-- Also, an intelligence officer or a recruited agent who operates in a foreign country in the guise of a
private person, and is often present under false identity. (FBI -- Affidavit: USA vs. Robert Philip Hanssen,
16 Feb 2001)
-- Also, Illegal Intelligence Officers (IIO) - individuals who enter a country either by circumventing
border controls or by using false documentation. False documents permit the IIO to remain within the
country for a long time while being able to withstand extensive background checks and leave the country
with minimum official scrutiny. The very nature of the IIO’s covert activity makes it extremely difficult for
counterintelligence agencies to identify or accurately assess their total strength and potential impact on
national security. (AFOSI Manual 71-144, Vol 5, CI Program, 15 May 2009)
“Illegals” have no “easily” detectable contacts with their parent intelligence service. They pose as
legitimate residents of the target country and operate without benefits of diplomatic cover.
_________________________
“In intelligence parlance, an ‘illegal’ is a spy operating without benefit of diplomatic cover. If caught,
an illegal can be prosecuted, imprisoned, or even executed; by contrast, a diplomat can only be
declared persona non grata and expelled by the host country.”
-- David Wise, Tiger Trap: America’s Secret War with China (2011), p. 208
_________________________
168
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
“The illegal is a highly trained specialist in espionage tradecraft. He may be a [foreign] national
and/or a professional intelligence officer dispatched to the United States under a false identity.”
-- FBI as cited in Senate Report # 94-755 (aka Church Committee Report), Book I, 26 April 1976, p.164
_________________________
“Illegal agents—that is, operatives for whom an alias identity has been systemically developed
which enables them to live in the United States as America citizens or resident aliens without our
knowledge of their true origins.”
-- Rockefeller Committee Report, June 1975, p. 8
Illegal Net. An intelligence gathering unit operating under the control of an illegal residency. (AFOSI
Manual 71-142, OFCO, 9 Jun 2000 and FBI FCI Terms)
Operation GHOST STORIES -- FBI investigation of a network of Russian sleeper agents under
non-official cover in the United States. July 2010, the FBI arrest of 10 Russian “illegals” which
provided a chilling reminder that espionage on U.S. soil did not disappear when the Cold War
ended. The FBI case against the Russian Intelligence operatives went on for more than a decade.
The FBI released dozens of still images, surveillance video clips, and documents related to the
investigation, see <http://www.fbi.gov/news/stories/2011/october/russian_103111/russian_103111>
Illegal Residency. An intelligence apparatus established in a foreign country and composed of one or
more intelligence officers, which has no apparent connection with the sponsoring intelligence organization
or with the government of the country operating the intelligence organization. (ICS Glossary)
Illegal Support Officer. An intelligence officer assigned to a legal residency whose primary function is to
support illegal agents by supplying anything needed. A secondary function is the gathering of information
and documents that will serve as guidance and models for documentation of future illegal agents. (AFOSI
Manual 71-142, OFCO, 9 Jun 2000)
Imagery. A likeness or presentation of any natural or man-made feature or related object or activity, and
the positional data acquired at the same time the likeness or representation was acquired, including:
products produced by space-based national intelligence reconnaissance systems; and likeness and
presentations produced by satellites, airborne platforms, unmanned aerial vehicles, or other similar
means (except that such term does not include handheld or clandestine photography taken by or on
behalf of human intelligence collection organizations). (JP 1-02 and JP 2-03, GEOINT Support to Joint
Operations, 22 Mar 2007)
-- Also, representations of objects reproduced electronically or by optical means on film, electronic display
devices, or other media. (Senate Report 94-755, Book I - Glossary, 26 Apr 1976)
Imagery Exploitation. The cycle of processing, using, interpreting, mensuration and/or manipulating
imagery, and any assembly or consolidation of the results for dissemination. (JP 1-02.and JP 2-03,
GEOINT Support to Joint Operations, 31 Oct 2012)
Imagery Intelligence (IMINT). The technical, geographic, and intelligence information derived through the
interpretation or analysis of imagery and collateral materials. (JP 1-02 and JP 2-03, GEOINT Support to
Joint Operations, 31 Oct 2012) Also see geospatial intelligence.
-- Also, IMINT is derived from the exploitation of imagery collected by visual photography, infrared
sensors, lasers, multispectral sensors, and radar. These sensors produce images of objects optically,
electronically, or digitally on film, electronic display devices, or other media. (Army FM 2-0, Intelligence,
23 Mar 2010)
169
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, intelligence that includes representations of objects reproduced electronically or by optical
means on film, electronic display devices, or other media. Imagery can be derived from visual
photography, radar sensors, infrared sensors, lasers, and electro-optics. (ODNI, U.S. National Intelligence
- An Overview 2011)
Imagery Intelligence (IMINT): The National Geospatial-Intelligence Agency (NGA) manages all
IMINT activities, both classified and unclassified, within the US Government . This includes
requirements, collection, processing, exploitation, dissemination, archiving, and retrieval.
-- www.intelligence.gov (accessed 13 Aug 2012)
_____________________
There are two general types of imagery collection platforms:
+ Satellites—compromised of national technical means [NTM] and commercial platforms.
+ Airborne Systems—compromised of national, commercial, theater, and tactical.
There are two general types of imagery sensors:
+ Electro-optical: panchromatic (visible); infrared; special (multispectral & hyperspectral);
and polarmetric.
+ Radar: synthetic aperture radar systems that collect and display data either as
representations of fixed targets or as moving target indicators.
-- Army FM 2-0, Intelligence, 23 Mar 2010, pp. 9-2 & 9-3
Immigration and Customs Enforcement (ICE). The principal investigative arm of the U.S. Department
Homeland Security (DHS). Created in 2003 through a merger of the investigative and interior enforcement
elements of the U.S. Customs Service and the Immigration and Naturalization Service,
ICE's primary mission is to promote homeland security and public safety through the criminal and
civil enforcement of federal laws governing border control, customs, trade and immigration. ICE’s
two principal operating components are Homeland Security Investigations (HSI) and Enforcement
and Removal Operations (ERO).
See ICE website at: <http://www.ice.gov/index.htm>
Impersonal Communication. Communications between a handler and asset which do not involve direct
contact. (HDI Lexicon, April 2008)
-- Also, secret communication techniques used between a case officer and a human intelligence
asset when no physical contact is possible or desired. (CI Centre Glossary)
Impersonal Communications…
[C]landestine techniques to avoid risky face-to-face contact that often employed methods such as
dead drops and elaborate systems of signaling readiness to send and receive those caches of
information. This system had been used successfully by intelligence services for centuries.
-- Michael J. Sulick, American Spies: Espionage Against the United States from the Cold War to
the Present, 2013, p. 10
Implant. Electronic device or electronic equipment modification designed to gain unauthorized
interception of information-bearing emanations. (CNSSI No. 4009, National Information Assurance
Glossary, 26 April 2010)
Implied Task. In the context of joint operation planning, a task derived during mission analysis that an
organization must perform or prepare to perform to accomplish a specified task or the mission, but which
is not stated in the higher headquarters order. (JP 5-0, Joint Operation Planning, 11 Aug 2011) Also see
essential task; specified task.
170
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Improvised Explosive Device (IED). A device placed or fabricated in an improvised manner incorporating
destructive, lethal, noxious, pyrotechnic, or incendiary chemicals and designed to destroy, incapacitate,
harass, or distract. It may incorporate military stores, but is normally devised from nonmilitary
components. (JP 1-02)
In the Gap. [Tradecraft jargon] Surveillance-free for a few seconds but not as long as a minute. (Spy
Dust)
Inadvertent Disclosure. Type of incident involving accidental exposure of information to an individual not
authorized access. (CNSS Instruction No. 4009)
-- Also, a set of circumstances or a security incident in which a person has had involuntary access to
classified information to which the individual was or is not normally authorized. (DoD 5220.22.22-M-Sup
1, NISPOM Supplement, Feb 1995)
Indication and Warning. Within DoD, term changed to “warning.” See warning.
Indications. In intelligence usage, information in various degrees of evaluation, all of which bear on the
intention of a potential enemy to adopt or reject a course of action. (JP 2-0, Joint Intelligence, 22 Oct
2013)
Indicator. In intelligence usage, an item of information which reflects the intention or capability of a
potential enemy to adopt or reject a course of action. (JP 1-02 and JP 2-0, Joint Intelligence, 22 Oct
2013) Also see espionage indicator.
-- Also, data derived from friendly detectable actions and open-source information that adversaries
can interpret and piece together to reach conclusions or estimates of critical or classified information
concerning friendly intentions, capabilities, or activities. (DoD 5205.02-M, DoD OPSEC Program Manual,
3 Nov 2008)
-- Also, “Threat Indicator” any observable action that suggests violent behavior, abnormal
disgruntlement, radicalization, or an extreme religious or other ideological worldview. (US Army Tactical
Reference Guide, Radicalization into Violent Extremism: A Guide for Military Leaders, Aug 2011) Also
see radicalization, terrorism, violent radicalization.
Indirect Access. Descriptor used for sources who do not have firsthand access to the information
provided and who have come upon it through one or more sub-sources. (DoDI S-5200.42, Defense
HUMINT and Related Activities (U), 8 Dec 2009) Also see direct access.
Indoctrination (or read-on). An initial indoctrination and/or instruction provided each individual approved
to a SAP prior to his exposure concerning the unique nature of program information and the policies,
procedures, and practices for its handling. (DoD 5220.22.22-M-Sup 1, NISPOM Supplement, Feb 1995)
Induced Defection. Tradecraft jargon for developing and encouraging a foreign official’s defection from
his country. (Leo D. Carl, The CIA Insider’s Dictionary, 1996)
“Inducement” is the jargon used for persuading somebody to defect to you.
-- William R. Johnson, Thwarting Enemies at Home and Abroad (2009)
Induced Operation. An operation in which a source or agent is established in such a manner as to induce
the opposition to recruit him as its agent. (CI Community Lexicon)
171
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Induction.
[One of the four basic types of reasoning applied to intelligence analysis, it is the process] of
discovering relationships among the phenomena under study. …[it draws] generalizations on the basis of
observations or other evidence. (DIA, Intelligence Essentials for Everyone, June 1999) Also see
abduction; deduction; scientific method.
For additional information see Knowledge Management in the Intelligence Enterprise by Edward
Waltz (2003) and Critical Thinking and Intelligence Analysis by David Moore, JMIC Press (2006).
Industrial Espionage. The knowing misappropriation of trade secrets related to, or included in, a product
that is made for or placed in interstate or foreign commerce to the economic benefit of anyone other than
the owner, with the knowledge or intent that the offense will injure the owner of that trade secret.
-- Also, the act of seeking a competitive, commercial advantage by obtaining a competitor’s trade
secrets and/or logistics. The acquisition of industrial information through clandestine operations. (DSS
Glossary)
Industrial espionage is criminalized under the Economic Espionage Act of 1996, PL 104-294.
Industrial espionage, or theft of trade secrets, occurs when an actor, intending or knowing that his
or her offense will injure the owner of a trade secret of a product produced for or placed in
interstate or foreign commerce, acts with the intent to convert that trade secret to the economic
benefit of anyone other than the owner by: (1) stealing, or without authorization appropriating,
carrying away, concealing, or obtaining by deception or fraud information related to that secret;
(2) copying, duplicating, reproducing, destroying, uploading, downloading, or otherwise transmitting
that information without authorization; or (3) receiving that information knowing that that information
had been stolen, appropriated, obtained or converted without authorization (Section 101 of the
EEA, 18 USC § 1832).
Industrial Security. That portion of information security which is concerned with the protection of
classified information in the custody of U.S. industry. (DoD 5220.22-M, NISPOM, 28 Feb 2006) Also
see Defense Security Service (DSS); National Industrial Security Program (NISP).
-- Also, a mutli-disciplinary security program concerned with the protection of classified information
developed by or entrusted to U.S. industry. (IC Standard 700-1, 4 Apr 2008 and DoDD 5200.43,
Management of the Defense Security Enterprise, 1 Oct 2012 w/ chg 1 dated 24 Apr 2013)
Infiltrate. Tradecraft jargon for the act of penetrating a country or organization. (Leo D. Carl, The CIA
Insider’s Dictionary, 1996)
Infiltration. In intelligence usage, placing an agent or other person in a target area in hostile territory.
Usually involves crossing a frontier or other guarded line. Methods of infiltration are: black (clandestine);
grey (through legal crossing point but under false documentation); and white (legal). (JP 1-02 and
JP 3-05.1, Joint Special Operations Task Force Operations, 26 Apr 2007)
Inform and Influence Activities. The integration of designated information-related capabilities in order to
synchronize themes, messages, and actions with operations to inform United States and global
audiences, influence foreign audiences, and affect adversary and enemy decisionmaking. (Army
FM 3-13, Inform and Influence Activities, Jan 2013)
Informant. A person who, wittingly or unwittingly, provides information to an agent, a clandestine service,
or the police. (ICS Glossary and Senate Report 94-755, Book I - Glossary, 26 Apr 1976)
Information. Facts, data, or instructions in any medium or form. The meaning that a human assigns to
data by means of the known conventions used in their representation. (JP 3-13.1, Electronic Warfare,
25 Jan 2007)
172
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Information and Communications Technology (ICT). Includes but is not limited to information technology
as defined in section 11101 of title 40, U.S.C.. The term reflects the convergence of information
technology and communications. ICT includes all categories of ubiquitous technology used for gathering,
storing, transmitting, retrieving, or processing information (e.g., computing systems, software, mobile
telephony, satellite communications, and networks. (DoDI O-5240.24, CI Activities Supporting RDA,
8 Jun 2011 with change 1 dated 15 Oct 2013)
Information Assurance (IA). Measures that protect and defend information and information systems by
ensuring their availability, integrity, authentication, confidentiality, and nonrepudiation. This includes
providing for restoration of information systems by incorporating protection, detection, and reaction
capabilities. (DoDD 8500.01E, Information Assurance and CNSSI-4009) Also see Information Operations.
-- Also, actions that protect and defend information systems by ensuring availability, integrity,
authentication, confidentiality, and nonrepudiation. (JP 1-02 and JP 3-12, Cyberspace Operations,
5 Feb 2013)
-- Also, protecting information’s confidentiality, integrity, and availability. (National Intelligence: A
Consumer’s Guide - 2009).
-- Also, the protection of systems and information in storage, processing, or transit from unauthorized
access or modification; denial of service to unauthorized users; or the provision of service to authorized
users. It also includes those measures necessary to detect, document, and counter such threats.
Measures that protect and defend information and information systems by ensuring their availability,
integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of
information systems by incorporating protection, detection, and reaction capabilities. IA is a security
discipline that encompasses COMSEC, INFOSEC, and control of compromising emanations (TEMPEST).
(AR 25-2, Information Assurance, 3 Aug 2007)
Information Collection. An activity that synchronizes and integrates the planning and employment of
sensors and assets as well as the processing, exploitation, and dissemination of systems in direct support
of current and future operations. (Army FM 3-55, Information Collection, April 2012)
Information Environment. The aggregate of individuals, organizations, and systems that collect, process,
disseminate, or act on information. (JP 1-02 and JP 3-13, Information Operations, 13 Feb 2006)
-- RAND Graphic
173
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Information Fratricide. The result of employing information-related capabilities in a way that causes
effects in the information environment that impede the conduct of friendly operations or adversely affect
friendly forces. (Army FM 3-13, Inform and Influence Activities, Jan 2013)
Information Protection. Active or passive measures used to safeguard and defend friendly information
and information systems. (ADRP 6-0, Mission Command, May 2012)
Information Operations (IO). The integrated employment, during military operations, of information-
related capabilities in concert with other lines of operations to influence, disrupt, corrupt, or usurp the
decision-making of adversaries and potential adversaries, while protecting our own. (JP 3-13, Information
Operation, 27 Nov 2012; approved for inclusion in update to JP 1-02)
For DoD policy see DoDD 3600.01, Information Operations, 2 May 2013
Counterintelligence investigations, operations, collection, analysis, production, and dynamic
functional CI services are employed in support of appropriate IO activities to detect and mitigate
foreign intelligence, hacker, and insider threats to DoD information and information systems.
______________________
IO will be the principal mechanism used during military operations to integrate, synchronize,
employ, and assess a wide variety of information-related capabilities (IRCs) in concert with other
lines of operations to effect adversaries’ or potential adversaries’ decision-making while protecting
our own.
- DoDD 3600.01, Information Operations, 2 May 2013
Information Related Capability (IRC). A capability that is a tool, technique, or activity employed within a
dimension(s) of the information environment that can be used to achieve a specific end(s). (DoDD
3600.01, Information Operations, 2 May 2013) Also see information operations.
Information Requirements. In intelligence usage, those items of information regarding the adversary and
other relevant aspects of the operational environment that need to be collected and processed in order to
meet the intelligence requirements of a commander. (JP 2-0, Joint Intelligence, 22 Oct 2013) Also see
intelligence requirement; collection requirement.
The requirements process has traditionally been one of the
most vexing aspects of intelligence management.
-- IC 21: HPSCI Staff Study, 6 Apr 1996
Information Security. The security discipline concerned with implementation of a system of administrative
policies and procedures for identifying, controlling, and protecting from unauthorized disclosure
information that is authorized protection by Executive order, statute, or regulation. Information security
includes protection of classified, controlled unclassified, and sensitive compartmented information. (DoDD
5200.43, Management of the Defense Security Enterprise, 1 Oct 2012, w/ chg 1 dated 24 Apr 2013)
-- Also, INFOSEC the system of policies, procedures, and requirements established in accordance
with Executive Order 13526 to protect information that, if subjected to unauthorized disclosure, could
reasonably be expected to cause damage to national security. The term also applies to policies,
procedures, and requirements established to protect unclassified information that may be withheld from
release to the public pursuant to Executive Order, statute or regulation. (DoD Manual 5200.01-Vol 1, DoD
Information Security Program, 24 Feb 2012) Also see computer security; cyber security.
174
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, protecting information’s confidentiality, integrity, and availability. (National Intelligence: A
Consumer’s Guide - 2009)
To be withdrawn from JP 1-02 per JP 3-13, 27 Nov 2012; previously defined as: the protection of
information and information systems against unauthorized access or modification of information,
whether in storage, processing, or transit, and against denial of service to authorized users.
INFOSEC includes those measures necessary to detect, document, and counter such threats.
INFOSEC is composed of computer security and communications security.
-- JP 3-13, Information Operations, 13 Feb 2006
_________________________
INFOSEC plays a vital role in national security and in the Critical Infrastructure
The goal of INFOSEC is to ensure that the National Security Community has reliable and secure
networks to originate, store, manipulate, and make information available to those who need it and
are authorized to have it.
-- Joint Security Commission II Report, 24 Aug 1999, p. 18
Information Security Oversight Office (ISOO). US Government office that is responsible to the President
for policy and oversight of the Government-wide security classification system and the National Industrial
Security Program.
The ISOO is responsible to the President for policy and oversight of the Government-wide security
classification system and the National Industrial Security Program. The ISOO is also responsible
for implementing and overseeing the National Industrial Security Program (NISP) under Executive
Order 12829, as amended, issued in 1993.
ISSO web site at: <http://www.archives.gov/isoo/>
Information Superiority. The operational advantage derived from the ability to collect, process, and
disseminate an uninterrupted flow of information while exploiting or denying an adversary’s ability to do
the same. (JP 1-02 and JP 3-13, Information Operations, 27 Nov 2012) Also see information operations.
Informer. One who intentionally discloses information about other persons or activities to police or a security
service (such as the FBI), usually for a financial reward. (Senate Report 94-755, Book I - Glossary, 26 Apr
1976)
Infrared Imagery. That imagery produced as a result of sensing electromagnetic radiations emitted or
reflected from a given target surface in the infrared position of the electromagnetic spectrum
(approximately 0.72 to 1,000 microns). (JP 1-02 and JP 2-03, Geospatial Intelligence Support to Joint
Operations, 31 October 2012)
InfraGard. A partnership between the FBI and the private sector. InfraGard is an association of
individuals, academic institutions, state and local law enforcement agencies, and other participants
dedicated to sharing information and intelligence to prevent hostile acts against the United States.
InfraGard Chapters are geographically linked with FBI Field Office territories. (FBI)
Infragard a collaboration for infrastructure protection. For more information see
Infrastructure. The framework of interdependent physical and cyber-based systems comprising
identifiable industries, institutions (including people and procedures), and distribution capabilities that
provide a reliable flow of products and services essential to the defense and economic security of the
United States, to the smooth functioning of government at all levels, and to society as a whole.
(DoDD 3020.40, DoD Policy and Responsibilities for Critical Infrastructure, 14 Jan 2010 w/ chg 2 dated
21 Sep 2012)
175
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Inherited CPI. [Proposed DoD definition] CPI that is owned and generated by one RDA program,
subsystem, or project that is incorporated into and used by another RDA program. (Draft DoDI 5200.39,
CPI Identification and Protection within RDA Programs)
Initial Contact Point (ICP). A physical location where an intelligence officer makes an initial contact or
brush pass with his source or asset. (AFOSI Manual 71-142, OFCO, 9 Jun 2000)
Insider.
[Within DoD,] anyone who has authorized access to DoD resources by virtue of employment,
volunteer activities, or contractual relationship with DoD. (DoDI 5240.26, Countering Espionage,
International Terrorism, and Counterintelligence Insider Threat, 4 May 2012 with change 1 dated 15 Oct
2013) Also see insider threat, CI insider threat.
-- Also, any person with authorized access to any U.S. Government (USG) resource, to include
personnel, facilities, information, equipment, networks, or systems. (U.S. Government Threat Detection
Guide - 2011)
-- Also, anyone with access, privilege, or knowledge of information systems or services. Malicious
insider is [a person] motivated to intentionally adversely impact an organization’s mission (e.g., deny,
damage, degrade, destroy). (Rand Study, Understanding the Insider Threat, March 2004)
Insider Threat (InT). A person with authorized access, who uses that access, wittingly or unwittingly, to
harm national security interests or national security through unauthorized disclosure, data modification,
espionage, terrorism, or kinetic actions resulting in loss or degradation of resources or capabilities.
(DoDI 5240.26, Countering Espionage, International Terrorism, and Counterintelligence Insider Threat,
4 May 2012 w/ chg 1 dated 15 Oct 2013 and DoDD 5200.43, Management of the Defense Security
Enterprise, 1 Oct 2012 w/ chg 1 dated 24 Apr 2013) Also see insider, CI insider threat.
-- Also, a person, known or suspected, who uses their authorized access to Department of Defense
facilities, systems, equipment, information or infrastructure to damage, disrupt operations, commit
espionage on behalf of a foreign intelligence entity or support international terrorist organizations.
(JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated 26 Aug 2011)
-- Also, the threat that an insider will use their authorized access to harm the security of the United
States. This threat can include damage to the US through espionage, terrorism, unauthorized disclosure
of information, or through the loss or degradation of departmental resources or capabilities [sabotage].
(U.S. Government Threat Detection Guide - 2011 and IC Standard 700-2, 2 June 2011)
-- Also, activities conducted by a person with placement and access that intentionally or
unintentionally compromise an agency’s ability to accomplish its mission, including but not limited to
espionage, other criminal activity, unauthorized disclosure of information and loss or degradation of
departmental resources or capabilities. (National CI Strategy Operating Plan 2008-2010, 9 Aug 2007)
-- Also, the ability of a trusted insider to bypass or defeat security safeguards or otherwise adversely
affect the national security. (IC Standard 700-1, 4 Apr 2008)
-- Also, an entity with authorized access (i.e., within the security domain) that has the potential to
harm an information system or enterprise through destruction, disclosure, modification of data, and/or
denial of service. (CNSSI No. 4009, National Information Assurance Glossary, 26 April 2010)
-- Also, a person with placement and access who intentionally or unintentionally causes loss or
degradation of resources or capabilities and compromises the ability of an organization to accomplish its
mission through espionage, providing support to international terrorism, other criminal activity, or
unauthorized release or disclosure of information. (AR 381-20, Army CI Program, 25 May 2010)
176
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, any insider with legitimate access to government information, personnel, and facilities may
intentionally or unintentionally pose a threat. (NSA CI Awareness Pamphlet on Insider Threat, undated)
-- Also, the insider threat to critical infrastructure is one or more individuals with the access and/or
inside knowledge of a company, organization, or enterprise that would allow them to exploit the
vulnerabilities of that entity’s security, systems, services, products, or facilities with the intent to cause
harm. (National Infrastructure Advisory Council’s Report, The Insider Threat to Critical Infrastructures,
8 April 2008)
Trusted insiders with means, motive, and opportunity pose a major threat
“Countering insider threats are coordinated CI, security, information assurance (IA), law
enforcement (LE), and antiterrorism & force protection (AT/FP) activities…”
-- DoDI 5240.26, Countering Espionage, International Terrorism, and the CI Insider Threats, 4 May 2012
______________________
"Insider threats remain the top counterintelligence challenge to our community."
-- Robert “Bear” Bryant, National Counterintelligence Executive
______________________
“The problem of insider spies has bedeviled intelligence services from time immemorial.”
-- David L. Charney. M.D., “True Psychology of the Insider Spy,” in Intelligencer: Journal of U.S.
Intelligence Studies (Fall/Winter 2010), p. 47.
______________________
“[H]istory teaches us to expect spies among us and to anticipate that some of those spies will be
us…. [W]e cannot eliminate espionage… [but we must] minimize the harm that those who betray
us can do to our national security and minimize the time between their defection and detection.”
-- Webster Commission Report (A Review of FBI Security Programs), March 2002, pp. 17-18.
______________________
“The Insider Threat is the single-most pervasive and damaging security risk facing global
organizations and governments today.”
______________________
“Malicious insiders may exploit their access at the behest of foreign governments, terrorists groups,
criminal elements, unscrupulous associates, or on their own initiative. Whether malicious insiders
are committing espionage, making a political statement, or expressing personal disgruntlement,
the consequences for DoD, and national security, can be devastating.”
-- DoD Strategy for Operating in Cyberspace, July 2011
____________________
“…the threat lies in the potential that a trusted employee may betray their obligations and
allegiances to their employer and conduct sabotage or espionage against them. Insider betrayals
cover a broad range of actions, from secretive acts of theft or subtle forms of sabotage to more
aggressive and overt forms of vengeance, sabotage, and even workplace violence. The threat
posed by insiders is one most owner-operators neither understand nor appreciate.”
-- T. Noonan and E. Archuleta, The Insider Threat to Critical Infrastructures , The National
Infrastructure Advisory Council, April 6, 2008, p. 32.
____________________
“WikiLeaks represents a somewhat different kind of threat. It’s an insider threat, as opposed to a
remote threat where someone is trying to come across the networks at you.”
-- William Lynn, US Deputy Defense Secretary, Interview reported in DefenseNews, 18 July 2011
____________________
177
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
“In addition to threats by foreign intelligence entities, insider threats will also pose a persistent
challenge. Trusted insiders with the intent to do harm can exploit their access to compromise vast
amounts of sensitive and classified information as part of a personal ideology or at the direction of
a foreign government. The unauthorized disclosure of this information to state adversaries,
nonstate activists, or other entities will continue to pose a critical threat.”
-- DNI, Worldwide Threat Assessment of the US Intelligence Community, SSCI, 29 January 2014
____________________
See ONCIX classified report, U.S. Government Insider Threat Detection Guide - 2011 (U).
See Army Directive 2013-18, Army Insider Threat Program, 31 Jul 2013; copy available at:
See SECNAV Instruction 5510.37, Department of the Navy Insider Threat Program, 8 Aug 2013;
copy available at: <http://www.fas.org/irp/doddir/navy/secnavinst/5510_37.pdf>
See NCIS CI & Insider Threat Awareness and Reporting Brief - Briefers Handbook, March 2013
with DVD (a professionally produced briefing tool for NCIS Agents)
Also see “True Psychology of the Insider Spy,” in AFIO Intelligencer: Journal of U.S. Intelligence
Studies (Fall/Winter 2010), p. 47 -- copy available at < http://www.ncix.gov/issues/ithreat/Charney-
PsychologyofInsiderSpyAFIO-INTEL_Fall-Winter2010.pdf >
Additional open source information on insider threat issues at <http://www.cert.org/insider_threat/>
“A nation can survive its fools and even the ambitious.
But it cannot survive treason from within.”
-- Cicero (106-43 B.C.)
Speech in the Roman Senate - circa 58 BC
Instruments of National Power. All of the means available to the government in its pursuit of national
objectives. They are expressed as diplomatic, economic, informational and military. (JP 1, Doctrine for the
Armed Forces of the United States, 25 Mar 2013 and JP 1-02)
Insurgency. The organized use of subversion and violence to seize, nullify, or challenge political control
of a region. Insurgency can also refer to the group itself. (JP 3-24, Counterinsurgency, 22 Nov 2013)
-- Also, the organized use of subversion and violence to seize, nullify, or challenge political control of
a region. (Army FM 3-24, Insurgencies and Countering Insurgencies, May 2014)
According to FM 3-24, insurgency in the most basic form is a struggle for control and influence,
generally from a position of relative weakness, outside existing state institutions. Insurgencies can
exist apart from or before, during, or after a conventional conflict.
Insurgent. See insurgency.
Integrated Defense Source Registration System (IDSRS). A DoD-level system to enable the sharing
of HUMINT source information, meant to ensure Deconfliction of DoD-wide HUMINT sources.
(Defense HUMINT Enterprise Manual, Vol II, 23 Nov 2010)
See USD(I) Memo, 13 August 2005 and IDSRS website on SIPRNet at: <http://dh.dia.smil/idsr/>
INTELINK. INTELINK is the classified, worldwide intranet for the U.S. Intelligence Community. At its
most secure level, INTELINK utilizes the Joint Worldwide Intelligence Communications System (JWICS)
as its communication vehicle. JWICS is a 24 hour a day network designed to meet the requirements for
secure multi-media intelligence communications worldwide up to the Top Secret/SCI level.
INTELINK-S. INTELINK-S is similar to INTELINK except that it is accessed through the Secret Internet
Protocol Router Network (SIPRNet). It is a 24 hour a day network designed to meet the requirements
for secure multi-media intelligence communications worldwide at the Secret level and below.
178
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Intelligence. 1) The product resulting from the collection, processing, integration, evaluation, analysis,
and interpretation of available information concerning foreign nations, hostile or potentially hostile forces
or elements, or areas of actual or potential operations. 2) The activities that result in the product. 3) The
organizations engaged in such activities. (JP 2-0, Joint Intelligence, 22 Oct 2013) Also see foreign
intelligence; counterintelligence.
“Intelligence deals with all things which should be known
in advance of initiating a course of action”
-- Task Force on Intelligence Activities (Hoover Commission) - 1955
The term “intelligence” includes foreign intelligence and counterintelligence.
-- National Security Act of 1947 (as amended), 50 USC §401a, and EO 12333 (as amended 30 Jul 2008)
The main methods of collecting foreign intelligence (FI), collectively referred to as "intelligence
collection disciplines" or the "INTs," are: human intelligence (HUMINT); signals intelligence
(SIGINT); geospatial intelligence (GEOINT), including imagery intelligence (IMINT); measurement
& signatures intelligence (MASINT); and open source intelligence (OSINT).
Recommended: Mark Lowenthal, PhD, Intelligence: From Secrets to Policy (2011, 5th edition)
-- Also, a body of evidence and the conclusions drawn there from that is acquired and furnished in
response to the known or perceived requirements of Consumer’s. It is often derived from information
that is concealed or not intended to be available for use by the acquirer. (ODNI website www.dni.gov)
-- Also, information that has been analyzed and refined so that it is useful to policymakers in making
decisions—specifically, decisions about potential threats to our national security. (FBI at
-- Also, the product resulting from the collection, processing, integration, analysis, evaluation, and
interpretation of available information concerning foreign countries or areas. Information and knowledge
about an adversary obtained through observation, investigation, analysis, or understanding. (TRADOC
Pam 525-2-1, US Army Functional Concept for Intelligence, 13 Oct 10)
-- Also, secret, state activity to understand or influence foreign entities. (Michael Warner, “Wanted:
A definition of Intelligence,” Studies in Intelligence, 46: 3, 2002, pp.15-22)
A plethora of definitions for intelligence
Sherman Kent, former Chairman of CIA’s Office of National Estimates asserted that intelligence
can be thought of as a process, a product, as well as an organization. His point is valid, as
organizations that make up the US Intelligence Community use the term "intelligence" in three
different ways—product, process, and organization:
1) Intelligence is a product that consists of information that has been refined to meet the
needs of policymakers/decision makers;
2) Intelligence is also a process through which that information is identified, collected,
Analyzed, and disseminated; and
3) Intelligence refers to both the individual organizations that shape raw data into a finished
intelligence product for the benefit of decision makers and the larger community of these
organizations collected referred to as the Intelligence Community or IC.
___________________________
A word of caution about the term “intelligence” is in order. Too often it is used synonymously or
interchangeably with “information.” This is inaccurate and quite misleading. Information until may
be interesting, amusing, or hitherto unknown to the person receiving it, but by and in itself it is
inappropriate to call it intelligence.
-- William R. Corson, The Armies of Ignorance: The Rise of the American Intelligence Empire (1977)
___________________________
179
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Intelligence is the process by which specific types of information important to national security
are requested, collected, analyzed, and provided to policymakers; the products of that process;
the safeguarding of these processes and this information by counterintelligence activities; and
the carrying out of operations as requested by lawful authorities.
-- Mark M. Lowenthal, Intelligence: From Secrets to Policy. 4th Edition (2009), p. 8
___________________________
[Intelligence is] mainly secret activities---targeting, collection, analysis, dissemination and action—
intended to enhance security and/or maintain power relative to competitors by forewarning of
threats and opportunities.
-- P. Gill, “Theories of Intelligence: Where Are We, Where Should We Go and How Might We Proceed?”
in Intelligence Theory: Key Questions and Debates, 2009, p. 214
________________________
[I]ntelligence in general can be thought of as the complex process of understanding meaning in
available information. A typical goal of intelligence is to establish facts and then to develop precise,
reliable, and valid inferences (hypotheses, estimations, conclusions, or predictions) for use in
strategic decisionmaking or operational planning.
-- Robert M. Clark, Intelligence Analysis: A Target-Centric Approach (2004), p. 13
___________________________
By definition, intelligence deals with the unclear, the unknown the deliberately hidden…. In the
intelligence business, you are almost never completely wrong or completely right.
-- George J. Tenet, Director CIA (5 Feb 2004)
___________________________
For intelligence to have any real value, it must be acted on, sometimes quite promptly and
decisively; otherwise, it can be about as useful as warm spit, regardless how romantic or
dramatic it may sound.
-- LTG Samuel Wilson (Retired), Former Director DIA, April 2009
___________________________
“The truth is that there is never enough good intelligence.”
-- R. Jack Smith (Former DDI CIA), The Unknown CIA (1989)
“Timely intelligence is a critical component of preserving our national security.”
-- Ambassador John D. Negroponte (12 April 2005)
Intelligence Activities. All activities that elements of the Intelligence Community are authorized to conduct
pursuant to Executive Order 12333. (EO 12333, as amended 30 Jul 2008) Also see intelligence.
-- Also, all activities that agencies within the Intelligence Community are authorized to conduct
pursuant to Executive Order 12333. (DoD 5240.1-R, Procedures Governing the Activities of DoD
Intelligence Components that Affect Unites States Persons, Dec 1982)
-- Also, the collection, production and dissemination of foreign intelligence and counterintelligence
pursuant to DoDD 5143.01 and EO 12333. (DoDD 5240.01, DoD Intelligence Activities, 27 Aug 2007 w/
chg 1 dated 27 Aug 2013)
Note: Executive Order 12333 (United States Intelligence Activities) specifically defines the term
intelligence as including foreign intelligence (FI) and counterintelligence (CI).
Intelligence Analysis. The process by which collected information is evaluated and integrated with
existing information to facilitate intelligence production. (ADRP 2-0, Intelligence, Aug 2012) Also see
analysis.
Intelligence analysis is an intellectual process.
-- Mark Lowenthal, PhD
180
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Intelligence Analyst. A professional intelligence officer who is responsible for performing, coordinating,
or supervising the collection, analysis, and dissemination of intelligence. (ODNI, U.S. National Intelligence
- An Overview 2011)
Intelligence analysts use critical and creative thinking to conduct intelligence analysis and produce
timely, predictive intelligence.
-- ADRP 2-0, Intelligence, August 2012
Intelligence Asset. Any resource utilized by an intelligence organization for an operational support role.
(JP 2-0, Joint Intelligence, 22 Oct 2013) Also see asset.
Intelligence Collection. The acquisition of information or intelligence information and the provision of it to
processing and/or production elements. (CI Community Lexicon) Also see counterintelligence collection;
clandestine intelligence collection; intelligence collection.
The main methods of collecting foreign intelligence (FI), collectively referred to as "intelligence
collection disciplines" or the "INTs," are: human intelligence (HUMINT); signals intelligence
(SIGINT); geospatial intelligence (GEOINT), including imagery intelligence (IMINT); measurement
& signatures intelligence (MASINT); and open source intelligence (OSINT).
_______________________
[I]ntelligence collection is an imperfect process and will rarely be able to provide analysts with
everything they need to know.
-- Mark Lowenthal, PhD, “Intelligence Analysis Guide to its Study,” The Intelligencer: Journal of U.S.
Intelligence Studies, Vol 18, No. 4, Summer/Fall 2011, p. 61
Intelligence Collection Activities. The collection of foreign intelligence and counterintelligence information.
(Title 10 USC §431)
Intelligence Collection Plan. A plan for gathering information from all available sources to meet an
intelligence requirement. Specifically, a logical plan for transforming the essential elements of information
into orders or requests to sources within a required time limit. (JP 1-02)
Intelligence Collector. A phrase sometimes used to refer to an individual, system, organization or agency
that engages in the collection step of the intelligence cycle. (ICS Glossary)
Intelligence Community (IC). All departments or agencies of a government that are concerned with
intelligence activity, either in an oversight, managerial, support, or participatory role. (JP 2-0, Joint
Intelligence, 22 Oct 2013 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dated
26 Aug 2011)
-- Also, the federal agencies and departments that have a legal mandate to collect, analyze, and
disseminate intelligence. Executive Order 12333 specifically identifies members of the IC. (CI Community
Lexicon)
-- Also, a federation of Executive Branch agencies and organizations that work separately and
together to conduct intelligence activities necessary for the conduct of foreign relations and the protection
of U.S. national security. (ODNI, U.S. National Intelligence - An Overview 2011)
181
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
U.S. Intelligence Community (50 USC §401a and EO 12333)
-- Office of the Director of National Intelligence
-- Central Intelligence Agency
-- National Security Agency
-- Defense Intelligence Agency
-- National Geospatial-Intelligence Agency
-- National Reconnaissance Office
-- Intelligence & CI components of the U.S. Army, Navy, Marines, and Air Force
-- Federal Bureau of Investigation (National Security Branch)
-- Department of Energy (Office of Intelligence & Counterintelligence)
-- Drug Enforcement Administration (Office of National Security Intelligence)
-- Department of Homeland Security (Office of Intelligence & Analysis)
-- Department of State (Bureau of Intelligence & Research)
-- Department of Treasury (Office of Intelligence & Analysis)
-- Intelligence & CI components of the Coast Guard
For additional information see “An Overview of the United States Intelligence Community”
_______________________
Also see Jeffrey T. Richelson, The US Intelligence Community (2012, 5th Edition)
Intelligence Community Directives (ICDs). Principal issuances through which the Director of National
Intelligence (DNI) provides policy direction to the Intelligence Community (IC). (ICD 1, 1 May 2006)
ICDs are overarching policy documents of the Intelligence Community signed by the DNI and are
replacing the legacy Director of Central Intelligence Directives (DCIDs).
Intelligence Contingency Funds (ICF). Appropriated funds to be used for intelligence activities when the
use of other funds is not applicable or would either jeopardize or impede the mission of the intelligence
unit. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1 dtd 26 Aug 2011)
Intelligence Cycle. The process by which information is acquired, converted into intelligence, and made
available to policymakers and Consumer’s. (National HUMINT Glossary) Also see intelligence process.
182
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, the steps through which information is converted into intelligence and made available to
users. The cycle typically includes six steps: planning and direction, collection, processing and
exploitation, analysis and production, dissemination, and evaluation. (ODNI, U.S. National Intelligence -
An Overview 2011)
[Note: “evaluation” recently added as the sixth step in the cycle.]
INTELLIGENCE CYCLE
Source: CIA
(Note: The sixth step - evaluation - is not captured in the above diagram)
The Intelligence Cycle is customarily illustrated as a repeating process consisting of [see graphic
above].
[1] Planning and direction encompasses the management of the entire effort and involves, in
particular, determining collection requirements based on customer requests.
[2] Collection refers to the gathering of raw data to meet the collection requirements. These data
can be derived from any number and type of open and secret sources.
[3] Processing refers to the conversion of raw data into a format analysts can use.
[4] Analysis and production describes the process of evaluating data for reliability, validity, and
relevance; integrating and analyzing it; and converting the product of this effort into a meaningful
whole, which includes assessments of events and implications of the information collected.
[5] [Dissemination] the product is disseminated to its intended audience.
-- Judith Meister Johnston and Rob Johnston., Chapter Four - “Testing the Intelligence Cycle Through
Systems Modeling and Simulation,” in Analytic Culture in the U.S. Intelligence Community, The Center
for the Study of Intelligence, CIA, 2005, pp 45-46.
-- Also, the process of developing unrefined data into polished intelligence for the use of policymakers
The “Intelligence” Cycle
[The intelligence cycle is] a series of feedback loops, with analyst at the center. Initial problem
definition may come from either a policymaker request or an analyst’s assessment that an issue
merits analytic attention. The analyst then looks at the data available and ideally may engage in a
series of interactions with collectors, a series of feedback loops. While in the collection phase, the
analyst should be simultaneously engaging with policymakers or the war fighters, as appropriate, to
refine questions as conditions change. When a finished intelligence product is produced, it should
generate further questions from the consumer, and the feedback loops continue. The process
operates on a continuum, as opposed to a discrete series of events with a defined beginning and
end.
-- VADM J.M. (Mike) McConnell, USN (Ret) in CISSM, The Future of Intelligence Analysis,
Volume I Final Report, 10 March 2006
(CISSM = Center for International and Security Studies at Maryland, University of Maryland)
183
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
-- Also, an iterative process in which collection requirements based on national security threats are
developed, and intelligence is collected, analyzed, and disseminated to a broad range of customers.
Consumers sometimes provide feedback on finished intelligence products, which can be used to refine
any part of the intelligence cycle to ensure consumers are getting the intelligence they need to make
informed decisions and/or take appropriate actions. (Congressional Research Service (CRS) Report
RL33616, 14 Jan 2009)
The Intelligence Cycle - An Iterative Process
Source: www.intelligence.gov (accessed 27 Jul 2012)
Intelligence shapes national security policies…
The successful intelligence process converts acquired information into clear, comprehensible
intelligence and delivers it to the President, policymakers, and military commanders in a form they
can utilize to make educated policy decisions. Generating reliable, accurate intelligence is an
active, never-ending process commonly referred to as the intelligence cycle.
The process begins with identifying the issues in which policy makers are interested and defining
the answers they need to make educated decisions regarding those issues. We then lay out a plan
for acquiring that information and go about collecting it. Once we have the proper intelligence, we
sort through it, analyze what it means, and prepare summary reports and recommendations, which
we deliver to national security policy makers. The answers our reports supply often reveal other
areas of concern, which lead to more questions. In this way, the end of one cycle effectively leads
to the start of the next.
-- Intelligence.Gov - How Intelligence Works (accessed 28 April 2011)
Dynamic Process Fueling Dynamic Solutions
________________________
Intelligence Cycle… still valid????
According to Kristan J. Wheaton, Assistant Professor of Intelligence Studies at Mercyhurst
University, “Intelligence professionals have long known that the traditional way of describing the
intelligence process, the so called ‘intelligence cycle,’ is flawed.” He concludes the intelligence cycle
fails on three counts:
“We cannot define what it is and what it isn’t, it does not match the way
intelligence actually works in the 21st Century, and it does not help us explain our processes to the
decision-makers we support. Efforts to fix these flaws have not worked and, furthermore, this is all
widely recognized by those who have studied the role and impact of the cycle.”
-- See Kristan J. Wheaton, “Let’s Kill the Intelligence Cycle,” Competitive Intelligence, Vol 15 No 2,
April/June 2012, pp. 9-24. See article at <http://mciis.org/files/Wheaton_LetsKillTheIntelligenceCycle.pdf>
184
Counterintelligence Glossary -- Terms & Definitions of Interest for CI Professionals (9 June 2014)
__________________________________________________________________________________________________
Intelligence Database. The sum of holdings of intelligence data and finished intelligence products at a
given organization. (JP 1-02 and 2-01, Joint and National Intelligence Support to Military Operations,
5 January 2012)
Intelligence Discipline. A well-defined area of intelligence planning, collection, processing, exploitation,
analysis, and reporting using a specific category of technical or human resources. (JP 2-0, Joint
Intelligence, 22 Oct 2013) Also see human intelligence (HUMINT); geospatial intelligence (GEOINT);
measurement and signature intelligence MASINT); signals intelligence (SIGINT); open-source intelligence
(OSINT); technical intelligence (TECHINT); counterintelligence (CI).
Intelligence Enterprise. The sum total of the intelligence efforts of the entire U.S. intelligence community.
(ADRP 2-0, Intelligence, Aug 2012, p. 2-6)
Intelligence Estimate. The appraisal, expressed in writing or orally, of available intelligence relating to
a specific situation or condition with a view to determining the courses of action open to the enemy or
adversary and the order of probability of their adoption. (JP 1-02 and JP 2-0, Joint Intelligence, 22 Oct
2013)
Intelligence Federation. A formal agreement in which a combatant command joint intelligence center
receives preplanned intelligence support from other joint intelligence centers, Service intelligence
organizations, Reserve organizations, and national agencies during crisis or contingency operations.
(JP 1-02 and JP 2-01, Joint and National Intelligence Support to Military Operations, 5 Jan 2012)
Intelligence Gap. Information that is needed to inform intelligence analysis but is absent from reporting—
what we know we don’t know.
-- Also, a missing element that, if found, allows one to choose among alternatives with greater
confidence. (Robert M. Clark, Intelligence Analysis: A Target Centric Approach, 2004)
Identifying [intelligence] gaps is a continuous and iterative process…
-- Robert M. Clark, Intelligence Analysis: A Target Centric Approach (2004), p. 143
Intelligence Information Need. A need, expressed by users of intelligence, for information necessary to
support their mission. (Intellipedia)
Intelligence Information Report (IIR). The primary vehicle used to provide HUMINT information to the
consumer. It utilizes a message format structure that supports automated data entry into the Intelligence
Community databases. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011 w/ chg 1
dated 26 Aug 2011)
IIRs contain raw intelligence—unevaluated intelligence information, generally from a single source,
that has not been fully evaluated, integrated with other information, or interpreted and analyzed.
-- Also, a report used to provide information collected via HUMINT to DoD and IC customers. The IIR
utilizes a message format to support automated data entry into IC databases. (DHE-M 3301.001, Vol I:
Collection Requirement, Reporting, and Evaluation Procedures, 30 Jan 2009, w/ chg 2 dated 1 Feb 2012)
Intelligence Interrogation. The systematic process of using approved interrogation approaches to
question a captured or detained person to obtain reliable information to satisfy intelligence requirements,
consistent with applicable law. (JP 1-02 and JP 2-01.2, CI & HUMINT in Joint Operations, 16 Mar 2011
w/ chg 1 dated 26 Aug 2011) Also see educing information; elicitation; debriefing; interrogation;
intelligence interviewing; interview.
185