FM 2-22.2 (FM 34-60) Counterintelligence (October 2009)

Counterintelligence Program Administration

A-34. The Army may authorize agents to hand-carry, or physically take their CI badge and credentials

during reassignments for the purpose of eliminating the agent’s downtime at the gaining unit and to reduce

postal expenses across the Army. Hand-carry transfers must be formally coordinated in accordance with the

policies and procedures provided below. There are no “informally” coordinated hand-carry transfers.

CI special agents will not permanent change of station (PCS) with CI badge and credentials

without written authorization (email) from ITRADS.

Hand-carry transfers must be coordinated if the agent is being reassigned to a unit that has an

established CI badge and credentials account, and will be coordinated not earlier than 30 days

out from the day the agent physically departs the unit. Hand-carry transfers will not be

approved for agents who are being reassigned to a unit that does not appear on the account

custodian list, which means the unit does not have a CI badge and credentials account.

Agents do not have a choice whether they hand-carry their CI badge and credentials during

reassignment. The hand-carry decision will be made during coordination between the

custodians involved and ITRADS.

Note. If there are extenuating personal circumstances which may impact the agent’s hand-carry,

the unit custodian must bring it to the attention of ITRADS immediately. Depending on the

situation, ITRADS may direct the losing unit to ship the agent’s CI badge and credentials

directly to the gaining unit’s custodian.

Hand-carry transfers will not be approved for agents who are attending a school, or who are

going to be TDY en route.

The gaining unit is not authorized to initiate the hand-carry email process; only the losing

unit’s custodians may initiate the hand-carry email coordination process.

CI badge and credentials stay on the losing unit’s inventory until the gaining unit’s custodian

sends a receipt to the losing unit’s custodians and ITRADS. Therefore, if the losing unit sends

an inventory to ITRADS before receiving a receipt from the gaining unit for the hand-carried

CI badge and credentials, the hand-carried CI badge and credentials must still be included on

the losing unit’s inventory.

Agents will not hand-carry CI badge and credentials without written (email) authorization

from ITRADS.

When agents are not authorized to hand-carry their CI badge and credentials, or when they are

separated from Army service, the unit custodian is required to ship that agent’s CI badge and

credentials back to ITRADS as soon as the agent no longer needs his CI badge and credentials

(for example, when the agent out-processes through the custodian).

TRANSFERRING COUNTERINTELLIGENCE BADGE AND CREDENTIALS

A-35. CI badge and credentials materials will be retrieved by the unit custodian and returned to ITRADS

when the agent is being reassigned and not authorized to hand-carry. The custodian should retrieve these CI

badge and credentials during the agent’s out-processing and return them to ITRADS. Custodians will also

expeditiously return CI badge and credentials for agents who have had their clearance formally suspended

or revoked.

A-36. Custodians must include orders for all CI badge and credentials being returned to ITRADS. If CI

badge and credentials materials are returned for reasons or situations for which orders are not generated,

custodians will annotate on the return memorandum why the CI badge and credentials materials are being

returned.

A-37. Custodians are ultimately responsible for ensuring that CI badge and credentials materials are

shipped using one of the following postal services (Federal Express, registered, or Postal Express).

21 October 2009

FM 2-22.2

A-9

FOR OFFICIAL USE ONLY

Appendix A

Note. This is Army policy. Custodians must ensure their unit mailrooms understand this

requirement. Noncompliance with this requirement will be addressed to the unit’s account holder

for command involvement.

A-38. Custodians must include a receipt in all packages of CI badge and credentials shipped to ITRADS or

another unit. The receipt will be an itemized list of all items within the package.

A-39. Upon receiving the CI badge and credentials materials, ITRADS will normally send the custodian an

email receipt for the items. In the event ITRADS receives a large shipment of CI badge and credentials

materials, the hardcopy receipt may be Faxed back to the unit custodian.

LOSS OF COUNTERINTELLIGENCE BADGE AND CREDENTIALS

WARNING

Loss of CI badge and credentials can be a basis for disciplinary

action, removal of the CI MOS, or removal from CI duties.

A-40. In the event that CI badge and credentials are lost, the individual will immediately notify the account

holder, the unit custodian, and their chain of command. A search will be immediately initiated in the area

where the loss is suspected to have occurred.

A-41. If the CI badge and credentials are not recovered within 48 hours, the individual’s commander will—

Initiate an AR 15-6 investigation to ascertain the facts and circumstances surrounding the loss

of the CI badge and credentials.

Provide ITRADS with a memorandum formally reporting the loss of the CI badge and

credentials.

Notify local, state, and federal agencies in the area where the loss may have occurred and

request assistance in recovering the CI badge and credentials.

Upon completion of the AR 15-6 investigation, the account holder will provide ITRADS with

a copy of the final report of investigation (ROI). The report will include—

The identity of the person who lost the CI badge and credentials.

All the facts and circumstances concerning the loss.

The investigating officer’s determination as to whether the loss was the result of

negligence.

Any administrative or judicial actions taken because of the loss.

A request for relief of accountability if the CI badge and credentials were not recovered.

MISUSE OF COUNTERINTELLIGENCE BADGE AND CREDENTIALS

A-42. Individuals are issued CI badge and credentials for the purpose of identifying themselves as CI

special agents in an official capacity to other U.S. military and government agencies and HN agencies. CI

badge and credentials are never to be used for personal gain or any other situation that is not directly

associated with an official CI mission requirement. Misuse and/or abuse of CI badge and credentials can be

the basis for disciplinary action, removal of the CI MOS, or removal from CI duties.

A-10

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Program Administration

A-43. CI badge and credentials misuse and/or abuse include, but are not limited to—

Use or display of CI badge and credentials for any purpose other than official business or an

intelligence activity to support the unit’s mission.

Use or display of CI badge and credentials when another form of identification is appropriate

for the situation (for example, to gain admittance to an installation when a military or civilian

identification would be sufficient).

Any falsification, forgery, reproduction, alteration, or tampering with CI badge and

credentials, including copying the credential forms.

Storing anything other than the badge and credential forms in the carrying case (for example,

driver’s license, business cards, currency).

Transporting or removal of CI badge and credentials upon reassignment without prior

coordination with the unit custodian and ITRADS.

Any disregard for the policies and procedures specified in AR 381-20, this field manual, or

the CI badge and credentials guide listed in this manual.

COUNTERINTELLIGENCE PROBATIONARY PROGRAM

A-44. The nature of CI requires that Army CI special agents must possess the highest levels of competence,

maturity, and ethical and moral standards. The DOD Board of Investigations recognized this and mandated

Army MI establish a formal, centrally supervised probationary program for Army CI special agents.

Therefore, all newly trained CI special agent will participate in the CIPP for the first year in a CI

assignment (enlisted, warrant officers, officers, and Army civilians, including members of the Army

MICECP).

A-45. Following graduation from the CISAC, the CI special agent will be assigned to a CI position. The

newly certified CI special agent will complete a one-year probationary period. During this time the CI

special agent must demonstrate the technical competence and character traits to retain the 35L MOS. At the

end of the probationary period, the first lieutenant colonel (O-5) in the chain of command will notify the

USAHRC that the special agent has demonstrated the capability and competency to perform CI duties and

has successfully completed the CIPP, or that the person has not demonstrated the abilities for continued

service as a CI special agent and should not be retained in the MOS. At no time will the CIPP period

exceed 18 months for Regular Army Soldiers and 24 months for Army National Guard (ARNG) Soldiers.

A-46. Supervisors of government civilian CI special agents will incorporate a condition of employment into

the civilian job descriptions that requires satisfactory completion of the CIPP period within one year of

assignment to a CI position. The CIPP for civilian CI special agents is separate from the one-year probation

which is required of all newly hired Government civilian personnel.

A-47. The Government employment probation period is for the purpose of determining the person’s

suitability to work as a government civilian employee while the former is for the purpose of assessing the

capability and competency of the civilian to perform CI duties. Failure of the latter will result in removal

from government service. Failure of the former will allow the individual to apply for other government

employment.

A-48. The CIPP applies to warrant officers/351L who were not issued CI badge and credentials during their

previous enlisted or commissioned officer service.

A-49. The CIPP will assure the elimination, fairly and uniformly, of unsuitable personnel from the

professional ranks of the Army CI. Commanders should not recommend acceptance of probationary CI

special agents if they do not meet standards to perform as CI special agents.

A-50. ARNG organizations will require additional time for the CIPP period. The CIPP period will be a

minimum of 18 months and must include 2 annual training periods. If individuals are activated for a CI

special agent position, the CIPP period can be reduced to 12 months from their time of activation.

21 October 2009

FM 2-22.2

A-11

FOR OFFICIAL USE ONLY

Appendix A

A-51. DCS G-2 is the Executive Agent for the CIPP and will assign an Army CIPP program manager (PM)

for the implementation of the CIPP. The Army CIPP PM will—

Publish guidance to commanders of CI special agents implementing the CIPP. Guidance will

include the standards used to determine acceptance of individuals in the CIPP period.

For each individual graduating from the CISAC course, will forward a memorandum to the

first lieutenant colonel (O-5) in the individual’s chain of command that outlines evaluation

criteria, timeliness, and support available from the CIPP PM and USAIC&FH.

Coordinate with the DCS G-2, USAHRC, and USAIC&FH to establish standards that guide

commanders and unit CIPP managers in the evaluation of individuals in the CIPP.

Be collocated with the Army CI badge and credentials PM, USAIC&FH.

Coordinate with commanders’ assigned Army CI special agents to ensure compliance with

CIPP procedures and track professional and training development of individuals in the CIPP.

As necessary, conduct inspections of commands assigned CI special agents to ensure

compliance with procedures outlined in AR 381-20 and all applicable HRC regulatory

requirements.

A-52. Commanders of CI special agents (first lieutenant colonel [O-5] in the chain of command) will—

Comply with the guidance promulgated by AR 381-20, HRC guidance, and supplemental

guidance established by the CIPP PM.

Have at least 90 days to observe a CI special agent who is in the CIPP before evaluating and

recommending retention or removal from the CI Program. If the certifying official does not

meet this requirement, the CIPP period may be extended up to 15 months until the 90-day

requirement is met.

Ensure that all CI special agents in the CIPP are “partnered” with a senior CI special agent for

professional development.

Supervise the 12-month CIPP period, which requires enlisted, warrant officer, officer, and

government civilians in the gaining unit to evaluate the potential of the CIPP individuals to

perform the duties of a CI special agent. This evaluation includes periods of teaching,

mentoring, and coaching by experienced CI personnel. The evaluation is divided into three

areas: character, skills, and knowledge.

A-53. Character. Leaders will determine if the individual demonstrates responsibility, diligence, initiative,

innovation, and self-reliance. Additionally, the CIPP individual’s maturity, moral, and ethical attitudes

should be factors for considerations.

A-54. Skills. The intent of the skills evaluation is to ensure an individual demonstrates those skills required

to be a successful CI special agent. For individuals not assigned to units with an investigative mission,

leaders will evaluate potential of the individual to be a professional CI special agent. In the latter situation,

leaders and experienced CI personnel will evaluate the individual’s ability to execute skills common to all

the CI functions. These skills include—

Interpersonal skills—the ability to relate to people and cause individuals to cooperate with

the CI special agent.

Elicitation—the ability to obtain information from people in a non-intrusive manner.

Questioning techniques—the ability to directly obtain information from targeted individuals.

Writing—the ability to accurately relate the information obtained.

A-55. Individuals that perform and satisfactorily demonstrate the above skills not only have the potential to

be a technically competent CI special agent but a technically competent investigator. Performance

evaluation and counseling every 90 days during the CIPP period is mandatory. The counseling should be

A-12

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Program Administration

done by the senior CI special agent in the person’s unit or higher headquarters who has direct access to

observe and evaluate the person’s training and performance. The performance evaluation and counseling

will NOT be conducted by someone who is in the CIPP or has less than two years of experience (not

including their CIPP participation) as a CI special agent. During any of the counseling sessions if the

individual’s performance is substandard, the details of the substandard performance must be given to the

CIPP individuals in writing along with a performance improvement program of how to correct the

deficiencies. It is incumbent upon the CI special agent’s parent unit to provide mentorship, training, and

materials to allow the person to successfully learn and demonstrate the ability to function as a CI special

agent.

A-56. Knowledge. During the month preceding the final month of the CIPP period, CIPP special agents

will be required to take a skills test to demonstrate their continued knowledge concerning specifics of the

doctrinal execution of CI tasks including, but not limited to, CI-related regulations, intelligence law, and

investigative procedures. The test will be administered by the installation education facility. The testing

facility will forward the results of the test to the CIPP individual’s chain of command and simultaneously to

the CIPP PM. CIPP individuals who fail the test may be given a second opportunity within six months

based upon a recommendation by the chain of command. The CIPP PM, with the USAIC&FH Training

Development and Support Directorate, will establish the testing packet and make training aids available

online.

A-57. Circumstances may arise that do not permit the CIPP period to be completed at the 12-month mark.

Extensions may be granted beyond the original requirement based upon the submitting lieutenant colonel’s

(O-5’s) time in position or due to deployment reasons. Request for extensions will be coordinated between

the CIPP individual’s parent unit and the CIPP PM on a case-by-case basis. At no time will the CIPP period

exceed 18 months for Active Army Soldiers or 24 months for ARNG Soldiers.

A-58. The commander will—

Appoint a unit CIPP PM in writing, in memorandum format, and forward a copy of the

appointment orders to the CIPP PM, Fort Huachuca, AZ. The unit CIPP PM will be a senior

warrant officer

(351L) or senior NCO E-7 or above, (35L) who can track the arrival,

departures of all CIPP individuals and coordinate with the unit plans and training element to

ensure appropriate and effective training is considered, scheduled, and executed. A unit CIPP

PM must have at least 2 years in the CI MOS (excluding his own CIPP period).

Forward a signed memorandum to the CIPP PM, Fort Huachuca, AZ, and USAHRC

concerning the results of the skills evaluation and a recommendation to retain or remove the

CIPP individual from the CI MOS. If the CIPP individual is recommended for retention in the

CI MOS, the 35L will be permanently awarded as the primary MOS. If removal from the CI

MOS is recommended, the recommender may advise on an alternative MOS or Area of

Concentration or duties in the recommendation packet. Failure to complete the CIPP period is

not, by itself, considered to be an adverse personnel action.

At the completion of the 12-month CIPP period, forward a recommendation packet to the

CIPP PM, Fort Huachuca, AZ, and to USAHRC concerning the results of the skills evaluation

and a recommendation to retain or remove government civilians in the CIPP from the CI

MOS. Civilian supervisors will determine if the individual should be retained in government

service.

A-59. DCS G-1 is responsible for—

Establishing personnel management policy for CI special agents in the CIPP.

Coordinating with the first O-5 in the CIPP individual’s chain of command and Army CIPP

PM that the CIPP individual has met the CIPP period, evaluation, and qualifications for

permanent awarding of the CI MOS.

21 October 2009

FM 2-22.2

A-13

FOR OFFICIAL USE ONLY

Appendix A

Coordinating with the first O-5 in the CIPP individual’s chain of command, the Army CIPP

PM, and USAHRC for individuals not meeting the requirements and not being recommended

for retention in the CI MOS.

Coordinating with USHRC for re-classification procedures and orders to the appropriate

training institution and follow-on assignment instructions.

Establishing policies for appealing and adjudication for individuals who unsuccessfully

complete the CIPP.

A-60. USAHRC is responsible for—

Administering and supervising the personnel management aspects of the Army CI Program in

accordance with DODR 5210.48 and 5240.5 and applicable Army regulations and personnel

policy including the formal establishment of the Army CIPP for all newly trained CI special

agents (enlisted, warrant officer, officer, and government civilians).

In conjunction with USAIC&FH and the Army CIPP PM, tracking and evaluating CI

candidates and assigned personnel whose applications or files indicate they may be unsuitable

for the Army CI Program and accordingly approve or disapprove their assignment or

continuation in the CI Program.

Notifying DCS G-2 and Army CIPP PM of the award or removal of the CI MOS for all CI

Program personnel and CIPP individuals.

Furnishing copies of assignment orders or instructions for CI personnel to the Army CIPP

PM.

In conjunction with DCS G-1 developing policy concerning removal or retention of special

bonuses or pay associated with unsuccessful completion of the CIPP and removal from the CI

Program.

A-61. USAIC&FH is responsible for—

Developing doctrinal literature and training materials for the Army CIPP including training

support packages to enable commander’s implementation of the CIPP.

Developing online training materials to enable the unit CIPP PM to monitor CIPP individuals’

aptitude and adjust unit training plans to effectively target areas that need more attention.

Conducting formal CI training for enlisted, warrant officer, officer, and government service

civilians accepted into the CI Program.

Developing and updating the CI MOS evaluation test required in the month before the final

month of the CIPP period.

Creating an individual development plan for all new CI special agents.

Developing a standard checklist for commanders, first-line supervisors and unit CIPP PMs

concerning the expectations of a CI special agent during the CIPP.

A-14

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Appendix B

Contractor Support to Counterintelligence Activities

Contractors are used increasingly to augment existing capabilities and bridge gaps in

the deployed force structure. With the increased use of contractors comes the need to

identify the doctrine and procedures affecting their employment. Leaders and those

working with contractors must understand that contractors are civilians authorized to

accompany the force in the field and should be provided with an identification (ID)

card as proof of their authorization.

B-1. CI is considered inherently governmental work due to the constitutional issues associated with

investigations, operations, and other activities of U.S. persons. The Army employs contractor personnel to

execute specific, Government-controlled and supervised tasks, such as CI screening of potential linguists

and staff work, but all operational actions are executed by Government personnel. Contractors cannot serve

as credentialed CI special agents in the continental United States (CONUS) or outside the continental

United States (OCONUS).

B-2. CI contractors may serve as screeners or debriefers, conducting personnel security investigations,

functioning as intelligence or command staff members, and even working as analysts, but none are on

Army CI “Investigative” status and will not be actively engaged in CI investigations or collection activities

and operations.

TYPES OF CONTRACT SUPPORT

B-3. The various types of contract support are discussed below:

External support contractor. Contract intelligence personnel fall into the category of

external support contractor. They work under contracts awarded by contracting officers

serving under the command and procurement authority of supporting headquarters outside the

theater. Their support augments the commander’s organic capability.

Contract CI staff member. A contract CI staff member is a contractor who is specifically

trained for, tasked with, and engages in normal staffing actions for Army commands, Army

Service component commands (ASCCs), and Department of the Army (DA) G-2, such as

coordinating regulations for publication and preparing memorandums for the commanding

general to sign giving his major subordinate commanders guidance on certain issues. Other

examples would include working staff officer positions in headquarter units at all levels

or serving as reports officers to coordinate intelligence reports for publication to the

intelligence community. Their operations must be conducted in accordance with all applicable

U.S. law, treaties and conventions, and Army policies and regulations.

Contract CI analyst. A contract CI analyst is a contractor who is specifically trained for,

tasked with, and engages in analytic efforts to support intelligence requirements and analysis.

They may also be tasked to search the Internet, Secure Internet Protocol Network (SIPRNET),

and Joint Worldwide Intelligence Communications System

(JWICS) to support CI

investigations and collection and organize large amounts of data to help the investigator make

sense of that information. Their operations must be conducted in accordance with all

applicable U.S. law, treaties and conventions, and Army policies and regulations.

Contract security investigator. A contract security investigator is a contractor who is

specifically trained for, tasked with, and engages solely in the conduct of personnel security

investigations. Their credentials are issued from the Office of Personnel Management (OPM)

21 October 2009

FM 2-22.2

B-1

FOR OFFICIAL USE ONLY

Appendix B

or the Defense Security Service (DSS) and do not grant them authority to conduct any type of

CI investigative actions.

CI contract screener or debriefer. A contract screener or debriefer is a contractor who is

specifically trained for, tasked with, and engages in the screening or debriefing of locally

employed personnel (LEP). There have been cases where contractors have been used in CI

screening roles for LEP, but this is more of a debriefing role than a CI-specific mission or

role. Their operations must be conducted in accordance with all applicable U.S. law, treaties

and conventions, and Army policies and regulations.

Contract linguist. A contract linguist is a contractor who is specifically trained for, tasked

with, and engages in interpreter or translation activities. Linguists or translators may be

employed, once properly hired and vetted by appropriate personnel for CI and criminal issues

at a minimum, under the direct supervision of an active duty or government person in

accordance with the terms and conditions of their contract. Their operations must be

conducted in accordance with all applicable U.S. law, treaties and conventions, and Army

policies and regulations.

CIVILIAN STATUS

B-4. Contract employees cannot be made to engage in any activity inconsistent with his civilian status,

such as serving as a crew member on a weapon system. Analysis and staff position responsibilities and

functions are presumptively consistent with civilian contractor status, but other tasks should be vetted with

the command’s legal advisor to ensure they are legally permissible. For further information, see FM 3

100.21.

B-2

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Appendix C

Interpreter Support to Counterintelligence Activities

The use of interpreters is a significant part of the counterintelligence

(CI)

investigative, operational, and collection efforts. Therefore, it is vital that the CI

special agent be provided access to a qualified pool of interpreters. These can be

Army linguists, contract linguists, or properly screened and vetted local national

employees. Use of an interpreter is time consuming and potentially confusing;

therefore it is vital that sufficient time is allowed for familiarization and mission

briefs between the agent and the supporting interpreter.

C-1. Proper use and control of an interpreter is a skill that must be learned and practiced to maximize the

potential of CI collection. It is also vital for the CI special agent to confirm that the interpreter he intends to

use actually holds the required clearance for the level of information that will be discussed or potentially

collected, and is authorized access to either the facility, compound, subject or suspect, or source.

C-2. This chapter deals strictly with the use of interpreters to support CI investigations, operations, and

collections and is not intended to be applied to more routine uses of interpreters to support administrative,

logistic, or other operational requirements.

ADVANTAGES

C-3. Interpreters are often a necessary aid to successful CI investigations, operations, or collection

activities conducted outside the continental United States (OCONUS). There are certain advantages to

using an interpreter; the most obvious is that without an interpreter, a CI special agent without the proper

language or necessary proficiency in the target language is severely limited. Furthermore, if properly

trained, briefed, and prepared, the interpreter can provide invaluable assistance to the CI special agent

during the conduct of his mission. This is frequently the case because the interpreter—

Likely has a greater knowledge of the local culture and language usage than could be

developed by the CI special agent.

Can identify language and culturally based clues that will help the CI special agent confirm or

refute the veracity of the source’s statements.

Can interpret not only the literal meaning of a statement but also the intent and emotion of a

sentence as well as periods of silence and other nonverbal clues.

DISADVANTAGES

C-4. There are several significant disadvantages to using interpreters; for example:

There is a significant increase in time to conduct the activity. Since the interpreter must repeat

each phrase, the time for an interview session, liaison, or meeting can be easily doubled.

The potential for confusion or misunderstanding increases significantly when there is a third

person in the communications loop. This is especially true when the interpreter is deficient in

his command of either the target language (based on dialect or education level) or English.

The establishment of rapport and the use of effective elicitation or questioning techniques are

made difficult or even impossible when working through an interpreter based on

unwillingness to use them or a lack of familiarity and appreciation of the subtleties and

nuances required to employ them effectively.

21 October 2009

FM 2-22.2

C-1

FOR OFFICIAL USE ONLY

Appendix C

The ability of the CI special agent to interpret the source’s veracity through the analysis of

word usage, nuances of speech, and body language is curtailed.

Interpreters will have their own set of biases that could influence the manner in which the

dialogue is interpreted and reported back to the CI special agent.

The source may be culturally biased against the interpreter. This is especially possible if the

interpreter was locally hired and is of a different ethnic, social, or religious group than the

source.

There may be mission or subject matter problems involved as the interpreter may not be

familiar or conversant in some of the more technical aspect of the subject area.

PRECAUTIONS

C-5. CI special agents should be cautious of making seemingly innocuous comments in the presence of

interpreters and always remember that the interpreter is not a friend or even an ally. Interpreters are being

paid to perform a service and although they have been vetted, agents can never completely trust the

interpreter. CI special agents must create a thorough interview plan with the help of the interpreter, but

agents must still only share needed information so the interpreter functions effectively. Need-to-know

concerns apply everywhere to everyone but especially to the interpreter.

C-6. The exchange of information regarding the basic interrogatives (who, what, where, when, and why)

of each meeting must be discussed with the interpreter only to the point of understanding the mission. The

real “why” is likely none of the interpreter’s business. CI special agents may be meeting with a source or

contact because the commander believes this individual has lied. The real purpose (the why) of the meeting

is to pose control questions and to determine whether the source or contact lied in the past or whether there

was simply a miscommunication. Special agents may have suspicions regarding the very interpreter they

are working with, and this is an attempt to ascertain the interpreter’s veracity. As with all CI activities, a

healthy dose of skepticism is required to maintain an advantage against the adversary.

C-7. Be careful of sensitive or personal conversations when the interpreter is in the area. This applies to

conversations en route to or from meetings, conversations over lunch or dinner in the operational area, and

conversations in the team area. It is easy to become accustomed to the presence and usefulness of an

interpreter and to overlook the interpreter’s presence. Interpreters are often a necessary tool but they are

only lightly screened for the sensitive access they have. If the interpreter turned out to be working for the

other side, what information beyond “the necessary” could the interpreter provide?

METHODS OF INTERACTION

C-8. There are two methods of interaction between the CI special agent and the interpreter: basic and

advanced. As the CI special agent and the interpreter become experienced at working together and gain

confidence in each other’s abilities, they may use more advanced interactive techniques. It is the CI special

agent’s decision whether or not to use more advanced techniques.

BASIC INTERACTION METHOD

C-9. The basic method of interaction is used when—

The interpreter and CI special agents have not worked together extensively.

The interpreter has language skills but no interpreter training or experience.

The interpreter’s skill in English or the target language is suspect.

The CI special agent has limited experience using an interpreter.

The interpreter’s capabilities, loyalty, or cultural knowledge are not known or suspect.

C-2

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Interpreter Support to Counterintelligence Activities

C-10. Using the basic method, the interpreter is used solely as an interpretation device. When initial contact

is made, the interpreter instructs the source to maintain eye contact with the CI special agent. The

interpreter is briefed on the general course of the interview or collection activity but is usually not informed

of the specific purpose or collection goals. While the interpreter will be instructed to reflect the attitude,

behavior, and tone of voice of both the CI special agent and the source, the interpreter is told not to

interpose comments or personal opinions in the conversation at any time during the operation. Likewise,

the interpreter should have been informed not to stray from the topic, to ask the questions exactly as asked,

and to report exactly as the source reports.

C-11. The questioning phase is conducted in the same manner as if no interpreter were used, with the

obvious increase in time due to the interpretation. The interpreter uses the same person and tense as the CI

special agent or source and does not add or subtract anything from the dialogue. The interpreter tries to fade

into the background. The CI special agent should ensure that questions are focused on the source not to the

interpreter. The source should likewise answer to the CI special agent, not to the interpreter. When reports

are written, the interpreter will only be asked questions based on the actual translation of the dialogue.

ADVANCED INTERACTION METHOD

C-12. The advanced method of interaction requires additional training on the part of the CI special agent

and the interpreter, extensive experience working together, and a rapport between the CI special agent and

the interpreter. The CI special agent must trust both the capabilities and the judgment of the interpreter. At

this level of interaction, the interpreter becomes a more active participant in the interview. The CI special

agent remains in charge and it is made it clear to the interpreter that the CI special agent is responsible for

the substance and direction of the questioning. The interpreter may be briefed as to the specific goals of the

collection as this will aid greatly in the thoroughness of the questioning and the interpreters ability to ferret

out and exploit the seemingly innocuous details and nuances that may have been otherwise overlooked.

C-13. The interpreter becomes a more active participant in the approach and termination phases to the point

of even making planned comments to the source supportive of the CI special agent’s approach. For

example, if the CI special agent is using an incentive approach, the interpreter in an aside to the source can

tell him that the CI special agent always keeps promises. This type of technique should only be used if both

planned and rehearsed.

C-14. During the questioning phase, the interpreter supports the special agent by not only translating the

word of the source but also cueing the CI special agent when there are language or culturally based nuances

to what the source is saying that might add credence or doubt as to the veracity of the statements. For

example:

The interpreter could point out that although the source claims to be a factory worker, but the

language the source uses indicates that the source has a university education.

The interpreter could indicate that the dialect or pronunciation that the source is using does

not match the area that the source claims to be from. During report writing, the interpreter

supports the CI special agent by not only answering questions on the literal interpretation but

also by adding, when appropriate, comments on the significance of both what was said and

how it was said.

C-15. There are almost never sufficient interpreters to meet all mission requirements, considering

interpreters used to support CI investigations, operations, or collection activities will require additional

screening, a security clearance, and functional knowledge of the operational situation before employment.

While a qualified interpreter can be used to support CI missions, the CI special agent can maximize the

potential return on any mission if the interpreter has received specific training, is afforded the opportunity

to work with the same CI special agent or team on a regular basis, and is treated with proper respect and

courtesy.

C-16. The number of interpreters needed to support a CI collection mission is driven by the mission,

enemy, terrain and weather, troops and support available, time available, and civil considerations

(METT-TC) factors based primarily on the number of CI special agents, the dispersion of the CI special

21 October 2009

FM 2-22.2

C-3

FOR OFFICIAL USE ONLY

Appendix C

agents or CI teams in the area of intelligence responsibility, and the number of interview, investigations,

and missions to be accomplished. Normally one interpreter for every two nonlanguage qualified CI special

agents is sufficient; however, in situations where a large number of high-value sources must be questioned

in a limited time, a ratio of one-to-one may be required.

MILITARY INTERPRETERS

C-17. There are many Soldiers who have native language capabilities due to their heritage, culture,

background, or upbringing. Ideally, their parent unit will have identified this special ability and sought to

maximize their Soldier’s potential by referring them for language testing, advanced training, or

reclassification into a language-dependent or supporting MOS. Or these Soldiers will have volunteered

their abilities when a contingency arises. The Army National Guard (ARNG) and U.S. Army Reserve

(USAR) also have trained translators and interpreters, who may be deployed to serve as interpreters for the

CI collection effort.

CIVILIAN INTERPRETERS

C-18. Civilian corporations may be contracted by the military to provide interpreters for an operation.

These interpreters are divided into three categories:

CAT I linguists. CAT 1 linguists are locally hired personnel with an understanding of the

English language. They undergo a limited screening, are hired in-theater, do not possess a

security clearance, and are used for unclassified work. During most operations, CAT I

linguists are required to be re-screened on a scheduled basis. CAT I linguists should not be

used for CI collection operations.

CAT II linguists. CAT II linguists are U.S. citizens who have native command of the target

language and near-native command of the English language. They undergo a screening

process, which includes a national agency check (NAC). Upon favorable findings, these

personnel are granted a secret collateral clearance. CAT II linguists are the most used by CI

special agents.

CAT III linguists. CAT III linguists are U.S. citizens who have native command of the target

language and native command of the English language. They undergo a screening process that

includes a special background investigation (SBI) and a polygraph. Upon favorable findings,

CAT III linguists are granted a top secret (TS) clearance and an equivalent of a TS clearance.

CAT III linguists are used mostly for high-ranking official meetings and by strategic CI

special agents.

INTERPRETATION TECHNIQUES

C-19. During the planning and preparation phase of the CI collection, the CI special agent, in collaboration

with the interpreter, selects a method of interpretation. There are two primary methods:

Alternate interpretation. The interpreter listens to the entire phrase, sentence, or paragraph.

The interpreter then translates it during natural pauses in speech.

Simultaneous interpretation. The interpreter listens to the source and translates what he

says, just a phrase or a few words behind. The CI special agent should select the simultaneous

method only if all the following criteria are met:

The sentence structure of the target language is parallel to English.

The interpreter can understand and speak English as well as the target language with

ease.

The interpreter has special vocabulary skills for the topics to be covered.

C-4

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Interpreter Support to Counterintelligence Activities

The interpreter can easily imitate the CI special agent’s tone of voice and attitude for the

approaches and questioning technique selected.

Neither the special agent nor the interpreter tends to get confused when using the

simultaneous method of interpretation.

C-20. If any of the above-mentioned criteria in the simultaneous method cannot be met, the CI special

agent should use the alternate method. The alternate method should also be used when a high degree of

precision is required.

TRAINING AND BRIEFING THE INTERPRETER

C-21. The CI special agent will need to train an individual who has no interpreter experience as well as

remind a trained interpreter of the basic interpreter requirements:

Statements made by the interpreter and the source should be interpreted in the first person,

using the same content, tone of voice, inflection, and intent. The interpreter must not interject

his own personality, ideas, or questions into the interview.

The interpreter should inform the CI special agent if there are any inconsistencies in the

language used by the source. The CI special agent will use this information in the assessment

of the source.

The interpreter needs to assist with the preparation of reports and administrative documents

relevant to the source and meeting.

C-22. Once the CI special agent has chosen a method of interpretation, the agent must brief the interpreter.

This briefing must cover:

The current situation.

Background information on the source as available.

The administrative particulars of the meeting such as where it will be held, the room set up,

how long it will last.

The specific positioning of the interpreter, the special agent, and the source being interviewed.

The general or—if advanced method of interaction is being used—the specific collection

objectives.

Any special topic or technical language that is anticipated. If time allows, the interpreter

should research any anticipated technical vocabulary with which he is unfamiliar.

C-23. Throughout the briefing, the CI special agent should fully and clearly answer any pertinent questions

that the interpreter may have. Again, this is done with the operations security (OPSEC) and the principles

of security and need to know firmly in hand. This helps ensure the interpreter completely understands his

role in the CI collection process. With a more advanced interaction plan, the CI special agent and the

interpreter should war-game their plan, consider alternatives routes to the same answer, and consider any

likely contingency situations that may arise. Rehearse as time and circumstances allows.

PLACEMENT OF THE INTERPRETER

C-24. The interpreter should be placed in a position that enhances the mood or general impression that the

CI special agent wants to establish. When dealing with persons of CI interest, sources, or subjects of

investigations, the CI special agent should establish a dominant position, maintain a direct relationship with

the source, and increase or at least maintain the current anxiety level of the source. For example:

21 October 2009

FM 2-22.2

C-5

FOR OFFICIAL USE ONLY

Appendix C

Having the CI special agent and the source facing each other with the interpreter located

behind the source normally facilitates this. It also allows the CI special agent to maximize

control of both the source and interpreter.

If desired, having the interpreter enter the room after the source, so the source never sees the

interpreter, can further heighten the anxiety of the source.

Having the interpreters sit to the side of the CI special agent creates a more relaxed

atmosphere and is the preferred position when conducting debriefings and official meetings.

Having the interpreter at his side also facilities “off line” exchanges between the CI special

agent and the interpreter.

The special agent should avoid having the interpreter sit beside the source since this has a

tendency of establishing a stronger bond between the source and the interpreter and makes

“off line” comments between the special agent and the interpreter more difficult to execute.

C-25. When conducting source meetings in a public setting, a more natural appearance is desirable. The

seating needs to conform to the norm at the location where the meeting is taking place. For example, if

meeting at a restaurant, the CI special agent, interpreter, and source will sit naturally around the table.

INTERACTIONS WITH AND CORRECTION OF THE INTERPRETER

C-26. The CI special agent must control the interpreter at all times. The agent must be professional but firm

and establish who is in charge. This is best accomplished before the conduct of the actual mission. During a

questioning session, the CI special agent corrects the interpreter if violations of any standards, covered in

the premission briefing, occur. For example, if the interpreter interjects ideas into the meeting, the

interpreter must be corrected. Corrections should be made in a low-key manner as to not alienate the

interpreter, interrupt the flow of the questioning, or give the source the impression that there is an

exploitable difference of opinion between the CI special agent and the interpreter. At no time should the CI

special agent rebuke the interpreter sternly or loudly while they are with the source.

C-27. The special agent should never argue with the interpreter in the presence of the source. If a major

correction must be made, the CI special agent should temporarily terminate the meeting and leave the site

temporarily to make the correction. The CI special agent needs to document any difficulties as part of his

interpreter evaluation. The CI special agent must always ensure that the conduct and actions of the

interpreter are within the bounds of all other governing agreements, regulations, laws, and guidelines.

C-28. The CI special agent must be alert for any signs that the interpreter is not performing as required. The

following are some indicators of possible problems:

Long-to-short. If the CI special agent takes 20 seconds to express a statement or question,

and the interpreter reduces it to a 3-second translation, it may indicate that something has

been omitted. The agent should not proceed until the issue has been resolved There is nothing

wrong with stating that the interpreter is to translate everything that was just expressed. If the

interpreter is properly trained, this should not be an issue. If this issue arises, despite the

interpreter’s training, then it has significance and must not be ignored.

Short-to-long. If the CI special agent takes five seconds to express a statement or question,

and the interpreter expands it to a 30-second translation, it may indicate that something has

been added. The agent should not proceed until the issue has been resolved.

Body-language shift. If the interpreter’s body language suddenly and significantly shifts

from normal behavior, the CI special agent should determine the reason. It is advisable for the

agent to determine a baseline of behavior for the interpreter to facilitate recognition of

changes. Perhaps the interpreter is reluctant to translate what the agent said. Be aware that the

body shift indicates something is happening—find out what it means.

C-6

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Interpreter Support to Counterintelligence Activities

Unusual pauses. Look for a longer delay than usual before the translation begins. Unless it is

a vocabulary or concept issue, the long delay means that the interpreter is “thinking” before

translating. Any thinking beyond what is needed to translate, as closely as possible, what was

just said represents a potential problem. Again, the CI special agent should establish a

baseline of behavior for the interpreter in order to recognize these unusual pauses.

Inappropriate reactions. If the CI special agent says something humorous that should

provoke a positive response from the source, and after the translation, the agent does not get

that response, then the agent should wonder if the message got through. If the source becomes

upset in response to something said positively, then the agent should begin to wonder what

message was passed by the interpreter—did the agent fail to communicate clearly, or was it an

accidental or deliberate mistranslation?

INTERPRETER SUPPORT IN REPORT WRITING

C-29. The interpreter assists the CI special agent in preparing all required reports. The interpreter may be

able to fill gaps and clarify unclear details in the CI special agent’s case notes. The interpreter may also

assist in transliterating, translating, and explaining foreign terms.

EVALUATING THE INTERPRETER

C-30. After submitting all reports, the CI special agent evaluates the performance of the interpreter. This

should be done in writing, and copies should be given to the interpreter and placed on file with the

individual managing the CI collection portion of the interpreter program. The interpreter program manager

needs to develop a standard evaluation format for inclusion in the unit standing operating procedure (SOP).

The evaluation should note, at a minimum, the following points:

Administrative data (date, time, interpreter’s name).

Language proficiency.

Strengths and weaknesses of the interpreter with any problems and corrective actions taken.

Type of interpretation used (simultaneous or alternate).

Type of CI activity the interpretation was supporting (that is, an investigation, interview,

debriefing, liaison meeting).

Ability or lack of ability of the interpreter to use specific technical language that may have

been required.

Name of the CI special agent conducting both the interview and the evaluation.

C-31. The interpreter program manager uses the above formats to decide on future use of the interpreters, to

develop training programs for the interpreters, and to assign interpreters to make maximum use of their

specific capabilities. The CI special agent should also review interpreter personnel files before using an

unfamiliar interpreter.

INTERPRETER SECURITY ASSESSMENT

C-32. Interpreter support is crucial to successfully executing CI operations in many foreign and

contingency operations locations. CI operations require that all supporting interpreters be assessed to

ensure they are reliable and can be trusted with classified and sensitive information concerning intelligence

information and CI methods of operations. Most CI operations will employ CAT II linguists who are U.S.

citizens and have a secret clearance. However, the interpreter may volunteer or be forced to cooperate with

hostile or adversarial elements which may compromise CI operations and endanger the physical safety of

the CI special agent.

C-33. In some instances interpreters may have cultural, ideological, political, or religious beliefs which

they sympathize and identify with. This may motivate the interpreter to voluntarily cooperate with

21 October 2009

FM 2-22.2

C-7

FOR OFFICIAL USE ONLY

Appendix C

segments of the host-nation (HN) government, populace, or elements hostile to the presence of U.S. forces.

In other cases the interpreter may still have family, friend, and business associations in the area of

operations (AO). In this case, the interpreters may be coerced or forced to cooperate with these groups or

people due to threats against their family. Regardless of the motivating factors, all interpreters supporting

CI operations should be thoroughly and continuously assessed to ensure they are not compromising CI

operations purposefully or through negligent actions.

C-34. Security assessments of interpreters should be planned and compartmented to avoid alerting the

interpreter or other interpreters. Security assessments should be conducted to ensure the interpreter is

accurate, non-biased, not falsifying information obtained from a source and not relating untruthful

statements from the CI special agent to the source during CI operations.

C-35. Assessments should be conducted to identify any CI flags or indicators that the interpreter is not

credible, loyal, or may be working at the behest of another organization. If the assessment indicates any

negative character or reliability issues, the CI element should take steps to unobtrusively restrict access

while assessing whether the interpreter could be used in a CI operation to exploit the situation or whether to

neutralize the threat through employment termination or prosecution. There are numerous ways interpreters

can be assessed. Regardless of what type of assessment is used, the CI element should consult their staff

judge advocate (SJA) for legal and contractual considerations that may affect or prohibit this type of

assessment. The following examples of interpreter assessments are not all inclusive:

Monitoring. The actions and conversations of an interpreter may be video or tape recorded

during CI operational activity (interviews, debriefings, screenings, and elicitation) and later

reviewed by a credible interpreter, ideally a CI special agent who is thoroughly proficient in

the target language. This allows for a very discreet assessment and may also allow the CI

element to have multiple assessments by different linguists to refute, mitigate, or corroborate

the findings.

Polygraph. CI elements can request polygraph support through their CI coordinating activity

(CICA) to conduct counterintelligence scope polygraph examinations (CSPEs) to assess the

credibility of an interpreter. CSPEs need to be compartmented until the time of the

examination to ensure the interpreters do not attempt to avoid or make excuses for taking the

examination or cause any hostility among other interpreters that may impact the assessment

process.

Concealed evaluation. Concealed evaluation is using another CI special agent who is

thoroughly proficient in the target language to pose as a non-linguist to evaluate the

interpreter during CI operations. The CI element should use a CI special agent from another

unit who is unknown to the interpreter and who does not know the interpreter. This affords the

CI element to portray the CI special agent as a newly arrived Soldier; it also allows the CI

special agent to evaluate interpreters without any bias while at the same time not alerting the

interpreters that they are being evaluated.

MANAGING AN INTERPRETER PROGRAM

C-36. Units requiring interpretation support need to identify an individual or individuals to manage the

interpreter program. In most units, this will be someone in the G-2/S-2 section. The functions of the

interpreter program manager (PM) include but are not limited to—

Consolidating and prioritizing interpreter requirements.

Coordinating with the G-1/S-1 to identify personnel in the unit with language skills who can

be used as interpreters.

Coordinating with the G-1/S-1 and G-5 to obtain qualified interpreters.

Coordinating with G-2/S-2 for clearances, screening, and vetting of interpreters and potential

interpreters.

C-8

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Appendix D

FBI Delimitations Agreement

This appendix provides the content of the agreement governing the conduct of the

Department of Defense (DOD) counterintelligence (CI) activities with the Federal

Bureau of Investigation (FBI).

(U) SECTION 1.

(U) PURPOSE:

(U) The purpose of this memorandum is to establish jurisdictional boundaries and operational

procedures to govern the conduct of counterintelligence (CI) activities by the military CI

services of the Department of Defense (DOD) with the Federal Bureau of Investigation (FBI).

It implements Executive Order (EO) 12036 § 1-1104, requiring procedures to govern the

coordination of military CI activities within the United States; and supersedes the

Delimitations Agreement of 1949, as amended.

(U) SECTION 2.

(U) DEFENSE COMPONTENTS AUTHORIZED TO CONDUCT CI ACTIVITES:

(U) Within the DOD, each of the military departments is authorized by EO 12036 to conduct

CI activities within the United States in coordination with the FBI and abroad in coordination

with the Central Intelligence Agency (CIA). Within the military departments, the Army

Intelligence and Security Command (INSCOM), the Naval Investigative Service, and the Air

Force Office of Special Investigations (AFOSI) are authorized by departmental regulation to

conduct such activities. The term “military counterintelligence service” or “military CI service,”

as used herein, refers to these components.

(U) SECTION 3.

(U) FEDERAL BUREAU OF INVESTIGATION COORDINATION WITH THE DEPARTMENT

OF DEFENSE:

A. (U) Policy matters affecting DOD CI components will be coordinated with the Office of

the Under Secretary of Defense for Policy.

B. (U) When a CI activity of the FBI involves DOD military or civilian personnel of the DOD,

the FBI shall coordinate with the DOD (EO 12036 § 1-1104) for DOD personnel

involvement. For other civilian personnel of the DOD, coordination shall be effected with the

Office of the Under Secretary of Defense for Policy.

C. (U) It is contemplated those representatives of the field elements of the FBI and military

CI services will maintain close personal liaison and will meet frequently and routinely for the

purpose of ensuring close cooperation in carrying out their CI activities.

Figure D-1. FBI delimitations agreement contents

21 October 2009

FM 2-22.2

D-1

FOR OFFICIAL USE ONLY

Appendix D

(U) SECTION 4.

(U) DEFINITIONS:

A. (U) The term “coordination” means the process of eliciting objections and comments

prior to undertaking a proposed action. As used here, the term implies that no such action

will be taken so long as the party with whom the action in question is raised continues to

have objections that cannot be resolved.

B. (U) The term “counterintelligence” is included in the term “counterintelligence,” as

defined in EO 12036 § 4-202, and refers to the systematic collection of information

regarding a person or group which is, or may be, engaged in espionage or other

clandestine intelligence activity, sabotage, international terrorist activities, or

assassinations, conducted for, or on behalf of, foreign powers, organizations, or persons.

C. (U) The term “counterintelligence operations” is included in the term

“counterintelligence,” as defined in EO 12036 § 4-202, and refers to actions taken against

hostile intelligence services to counterespionage and other clandestine intelligence

activities damaging to the national security.

D. (U) The term “DOD civilian personnel” includes all U.S. citizen officers and employees

of the DOD not on active military duty and all foreign nationals employed by the DOD.

E. (U) The term “security service” refers to that entity or component of a foreign

government charged with responsibility for counterespionage or internal security functions

of such government.

F. (U) The term “United States” includes the 50 States, the District of Columbia, the

Commonwealth of Puerto Rico, and all territories, possessions, or protectorates under

U.S. sovereignty or control; but does not include occupied territory governed under the

President’s authority as Commander in Chief.

(U) SECTION 5.

(U) POLICY:

A. (U) The responsibilities of each military CI service and the FBI for the conduct of CI

investigations and operations shall be governed by relevant statutes, EO 12036, and this

agreement.

B. (U) Each military department is responsible for protecting its personnel and installations

for physical threats and for ensuring that its programs and activities which involve the

national security are not compromised to hostile intelligence agencies.

C. (U) Within the United States, the FBI conducts CI and coordinates the CI activities of

other agencies.

D. (U) Under combat conditions or other circumstances wherein a military commander is

assigned responsibility by the President for U.S. Government operations in a particular

geographic area, he shall have the authority to coordinate all CI activities within such

area, notwithstanding the provisions of this memorandum, subject to such direction as he

may receive from the Secretary of Defense.

E. (U) The military CI Services and the FBI are mutually responsible to ensure that there

is a continuing and complete exchange of all CI information and operations data relevant

to the particular concerns of each operating agency.

Figure D-1. FBI delimitations agreement contents (continued)

D-2

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

FBI Delimitations Agreement

F. (U) Policy issues arising in the course of CI activities which cannot be resolved at the FBI,

military CI service local or headquarters level shall be jointly referred to the Attorney General

and the Secretary of Defense for resolution, or referred to the Special Coordination Committee

(Counterintelligence) of the National Security Council in accordance with Special Coordination

Committee guidelines.

(U) SECTION 6.

(U) DELINEATION OF RESPONSIBILITY FOR COUNTERINTELLIGENCE

INVESTIGATIONS:

(U) Responsibility for CI investigations shall be appointed between the FBI and the military CI

services of the DOD as follows:

A. (U) All investigations of violations of the Atomic Energy Act of 1946, which might

constitute a CI investigation as defined herein, shall be the responsibility of the FBI

regardless of the status or location of the subjects of such investigations.

B. (U) Except as provided by paragraph C(2) below, all CI investigations of foreign

nationals undertaken within the United States shall be the responsibility of the FBI.

C. (U) CI investigations within the United States shall be conducted in accordance with the

following jurisdictional guidelines:

1. (U) Except as provided herein, investigations of all civilians, including DOD civilian

personnel, shall be the responsibility of the FBI.

2. (U) Investigations of U.S. military personnel on active duty shall be the responsibility

of the CI service of the appropriate military department.

3. (U) Investigations of retired military personnel, active and inactive reservists, and

National Guard members shall be the responsibility of the FBI; provided, however, that

investigations of actions which took place while the subject of the investigation was, or

is, on active military duty shall be conducted by the CI service of the appropriate

military department.

4. (U) Investigations of private contractors of the DOD, and their employees, shall be

the responsibility of the FBI. Provided, however, that nothing contained in this

paragraph shall prevent the military CI services of the DOD, in a manner consistent

with applicable Law and Executive Branch policy, from undertaking:

(a) (U) In those cases where the FBI chooses to waive investigative jurisdiction,

investigative actions which are necessary to establish or refute the factual basis

required or an authorized administrative action, to protect the security of its

personnel, information, activities, and installations; or

(b) (U) To provide assistance to the FBI to support any CI investigation for which

the FBI is herein assigned responsibility.

D. (U) CI investigations outside the United States shall be conducted in accordance with

the following guidelines:

1. (U) Investigations of military personnel on active duty shall be the responsibility of

the military counterintelligence services of the Department of Defense.

Figure D-1. FBI delimitations agreement contents (continued)

21 October 2009

FM 2-22.2

D-3

FOR OFFICIAL USE ONLY

Appendix D

2. (U) Investigations of current civilian employees, their dependents, and the civilian

dependents of active duty military personnel shall be the responsibility of the military CI

services, unless such responsibility is otherwise assigned pursuant to agreement with

the host government, U.S. law, or executive directive.

3. (U) Investigations of retired military personnel, active and inactive reservists,

National Guard members, private contractors and their employees, and other U.S.

persons, who permanently reside in such locations shall be undertaken in consultation

with the FBI, CIA, and host government as appropriate.

4. (U) Provided, however, that nothing contained in this paragraph shall prevent the

military CI services of the DOD, in a manner consistent with applicable law and

executive branch policy from undertaking:

(a) (U) Investigative actions which are necessary to establish or refute the factual

basis required for an authorized administrative action, to protect the security of its

personnel, information, activities, and installations.

(b) (U) To provide assistance to the FBI or security service of a host government to

support CI investigations outside the United States for which DOD is not herein

assigned investigative responsibility.

(U) SECTION 7.

(U) COORDINATION OF COUNTERINTELLIGENCE OPERATIONS:

(U) (The procedures governing the coordination of CI operations within the United States by

the military CI service with the FBI are contained in the classified annex to the

memorandum.)

A. (U) The policy and procedures set forth herein shall be implemented in the regulations

of the affected agencies.

B. (U) The provisions of this memorandum, and the classified annex made a part hereof,

shall be effective immediately upon execution by the Attorney General and Secretary of

Defense.

(original signed)

(ORIGINAL SIGNED)

Attorney General of the United States

Secretary of Defense

Date: 4/5/79

Date: 9 February 1979

Figure D-1. FBI delimitations agreement contents (continued)

D-4

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Appendix E

Counterintelligence Investigative Report Writing Guide

E-1. Appendix E provides guidance on CI investigative report writing principles. The following are

documents commonly used in CI investigative report writing:

Table E-1. Personal data.

Table E-2. Military ranks and civilian titles.

Table E-3. Physical description.

Figure E-1. CI incident report.

Figure E-2. Investigative memorandum for record (IMFR)—interview.

Figure E-3. Investigative memorandum for record—personnel files checks.

Figure E-4. Investigative memorandum for record—records checks.

Figure E-5. Investigative memorandum for record—intelligence files checks.

Figure E-6. Investigative memorandum for record—law enforcement records checks.

Figure E-7. Transmittal letter for report of investigation (ROI).

Figure E-8. Report of investigation.

Figure E-9. Summary of information (SOI).

Figure E-10. Privacy Act of 1974 Advisement Statement.

Figure E-11. Perjury warning.

Figure E-12. Secrecy affirmation statement.

FORMAT RULES

E-2. Font/Pitch. Type all reports in Arial font, font size 12. CI special agents must write all investigative

reports in a narrative format using third person, simple past tense, and active voice (Jones secured the

document in the security container.). The only exceptions to this are the mandatory sentences adopted for

use Army-wide in CI investigative reports, when quoting the source, indicating a state of mind or condition,

or when describing attachments.

E-3. Wording. Do not use slang expressions, colloquialisms, vulgarisms, technical or trade terms, unless

in a direct quote. Have the interviewee explain any technical concepts in non-technical language.

E-4. Identifying persons. Identify all persons mentioned in an investigative report to the fullest extent

possible. The data listed below is in a vertical format, but you list it horizontally in all investigative reports.

Semicolons will separate major areas and commas will separate elements within an area. Table E-1 (page

E-2) shows the breakout for describing personal data.

21 October 2009

FM 2-22.2

E-1

FOR OFFICIAL USE ONLY

Appendix E

Table E-1. Personal data

Major areas

Format

Last, First, Middle (CI incident report)/First, Middle, Last

NAME:

(IMFR)

RANK/TITLE:

PFC, SFC, 1LT, MAJ, GS-12, WG-7

COMPONENT: (Block 7 of the Sworn Statement only)

RA, USAR, NG, Army Civilian, CIV, CON

SSN:

123-45-6789

DPOB:

DPOB: 9 July 1963, Indio, Iowa

If Place is Unknown:

DOB: 9 July 1963/July 1963

If Date is Unknown:

POB: Indio, IA

DUTY POSITION:

Security Specialist (If unknown, list MOS)

S-2, HQ, 503d MP Bn, 10th MP Bde, Fort Huachuca, AZ

DUTY LOCATION:

85613

UNIT OF ASSIGNMENT:

HHC, 503d MP Bn, Fort Huachuca, AZ

Room 8, Bldg 62702, HHC, 503d MP Bn Barracks, Fort

RESIDENCE:

Huachuca, AZ

PCS OR DEROS:

PCS: 29 March 2007/DEROS: 29 March 2007

TEMPORARY DUTY: (Do not list—for information

Upcoming dates and locations

purposes only.)

ETS:

ETS: 25 July 2009/Indefinite

SECURITY CLEARANCE:

TOP SECRET/SECRET/NONE

LEVEL OF DAILY ACCESS TO CLASSIFIED

TOP SECRET/SECRET/CONFIDENTIAL/NONE

INFORMATION:

SPECIAL ACCESS:

SCI (List only if applicable.)

1LT—first lieutenant

MOS—military occupational specialty

Bde—brigade

MP—military police

Bn—battalion

NG—National Guard

DEROS—date of return from overseas

PCS—permanent change of station

DOB—date of birth

PFC—private first class

DPOB—date and place of birth

POB—place of birth

ETS—expiration term of service

RA—Regular Army

GS—general schedule

SCI—sensitive compartmented information

HHC—headquarters and headquarters company

SFC—sergeant first class

HQ—headquarters

SSN—social security number

IMFR—investigative memorandum for record

USAR—U.S. Army Reserve

MAJ—major

WG—wage grade

Note 1. Write all security clearance information in capital letters.

Note 2. If source does not know a piece of information, do not list. Never address information as

being unknown.

Jones, Robert Lee; SFC; SSN: 123-45-6789; DPOB: 9 July 1963, Indio, Iowa; Security Specialist, S-2, HQ, 503d MP

Bn, 10th MP Bde, FH, Arizona; assigned to HHC, 503d MP Bn, FH; residing at Rm 8, Bldg 62702, HHC, 503d MP

Barracks, FH; PCS: 29 March 2007; ETS: Indefinite; Security Clearance: TS, with daily access to TS.

E-2

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-5.

Qualifiers for names of persons:

First name unknown (FNU). If source does not know the first name of an individual, use the

acronym “FNU.” This acronym is always capitalized, used in its abbreviated form, and is

never placed in parentheses. When using the term “FNU,” or when the first name can be

either male or female, ensure you indicate the gender of the individual. This may be through

the use of an honorific title (Mr., Miss, Mrs., Ms., Dr.), a gender-specific pronoun (he, she), a

specific reference to the gender (FNU Smith, a male,) or by other means that leave no doubt

as to the gender of the individual. If the honorific title is used, place a period after the title

(Mr., Mrs., Ms., Dr.).

CI incident report: Smith, FNU, a male

Smith, Mr. FNU

IMFR: FNU Smith, a male

Mr. FNU Smith

Middle name unknown (MNU). If source does not know the middle name of an individual,

the acronym “MNU” is used. If source knows the middle initial, do not use the acronym

“MNU.” In such cases, use the middle initial by itself followed by a period. This acronym is

always capitalized, used in its abbreviated form, and is never placed in parentheses.

CI incident report: Smith, John MNU

Smith, John J.

IMFR: Jane MNU Jones

Jane M. Jones

Last name unknown (LNU). If source does not know the last name of an individual, the

acronym “LNU” is used. This acronym is always capitalized, used in its abbreviated form,

and is never placed in parentheses.

CI incident report: LNU, John

IMFR: Jane LNU

Note. Do not use more than one personal name qualifier (FNU, MNU, LNU) in combination for

the same person. In most cases, if you know only one of the components of the name (for

example, only the first or last) simply omit MNU (for example, John LNU; or FNU Jones).

Refer to an individual characterized as FNU, MNU, LNU, as an “Unidentified Individual.”

No middle name (NMN). If source knows an individual has no middle name, use (NMN).

Always capitalize this acronym, use in its abbreviated form, and place in parentheses.

CI incident report: Smith, Jane (NMN)

IMFR: John (NMN) Jones

Initial only (IO). When source knows that an individual’s middle name is an initial only, the

acronym “(IO)” is used. Always capitalize the acronym “(IO),” use it in its abbreviated form,

and place it in parentheses after the initial.

CI incident report: Truman, Harry S (IO)

IMFR: Harry S (IO) Truman

Nicknames or alias. If source identifies a person by a nickname or alias, place it in quotation

marks.

Jones, John “Bubba”

E-6.

Military ranks and civilian titles. When using a military rank as part of a person’s title, or when

listing a person’s rank during initial identification in a CI report, express the rank using the standard

Service abbreviation (see table E-2 [page E-4]). When referring to ranks and civilian titles or as part of a

duty description, spell the rank out completely.

21 October 2009

FM 2-22.2

E-3

FOR OFFICIAL USE ONLY

Appendix E

Table E-2. Military ranks and civilian titles

U.S. Army ranks

Other Service ranks

Civilian titles

PVT, PV2, PFC, SPC, CPL, SGT, SSG,

Use the appropriate

Service

• For DOD civilians, use the

SFC, MSG, 1SG, SGM, CSM, WO1, CW2,

abbreviation and include the standard

appropriate civilian designation

CW3, CW4, CW5, 2LT, 1LT, CPT, MAJ,

abbreviation for the Service, for

(for example, DAC for Army

LTC, COL, BG, MG, LTG, GEN.

example, MSgt/USAF, LtJG/USN,

Civilians; DAFC for Air Force

Note. Do not use periods with rank

GySgt/USMC.

Civilians).

abbreviations.

• The combination of a civilian grade

(for example, WG-5, WG-7, GS

12, GG-13, SES1, SES3) with a

DOD civilian designation looks

like—GG-13/DAC, WG-5/DAC,

GS-12/DAFC.

• For contract civilians, use the

abbreviation CON.

• For all non-DOD affiliated civilians,

use CIV.

1, 2LT—first, second lieutenant

DOD—Department of Defense

PFC—private first class

1SG—first sergeant

GEN—general

PV2—private, E-2PVT—private

BG—brigadier general

GG—general schedule, excepted

SES—Senior Executive Service

CIV—civilian

service

SFC—sergeant first class

COL—colonel

GS—general schedule, competitive

SGM—sergeant major

CON—contractor

service

SGT—sergeant

CPL—corporal

GySgt—gunnery sergeant

SPC—specialist

CPT—captain

LTC—lieutenant colonel

SSG—staff sergeant

CSM—command sergeant major

LTG—lieutenant general

USAF—U.S. Air Force

CW2,3,4,5—chief warrant officer, W-2, 3,

LtJG—lieutenant junior grade

USMC—U.S. Marine Corps

4, 5

MAJ—major

USN—U.S. Navy

DAC—Department of the Army civilian

MG—major general

WG—wage grade

DAFC—Department of the Air Force

MSG——master sergeant

WO—warrant officer

civilian

MSgt—master sergeant

E-7. Physical descriptions. If the name, with a unit of assignment or place of duty, is unknown, obtain

and report the physical description of the individual. The data below is in a vertical format, but in all

reports, list the information horizontally with semicolons separating major areas and commas separating the

elements within an area. Table E-3 shows the breakout for describing physical descriptions.

Table E-3. Physical description

Major areas

Format

SEX:

Male, Female

RACE:

Caucasian, Black, Asian

SKIN COLOR:

Dark, Tan, White

SKIN COMPLEXION:

Smooth, Pock-marked

AGE:

Within a five-year range

HEIGHT:

Within a two-inch range

WEIGHT:

Within a ten-pound range

BUILD/POSTURE:

Small, Medium and stooped

HAIR:

Black, Brown, Gray, Blonde, Red, Bald

EYES:

Black, Brown, Blue Gray, Green

Headwear, upper to lower body wear, footwear, jewelry

DRESS:

(top to bottom).

Physical handicap, tattoos, body piercing, scars,

DISTINGUISHING CHARACTERISTICS:

birthmarks, moles (If no distinguishing characteristics, put

“None.”)

E-4

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

Note. If your source does not know an item, do not list. Never address an item as being

unknown.

SUBJECT: SEX: Male; RACE: Caucasian; SKIN COLOR: WHITE; SKIN COMPLEXION: Fair complexion; AGE: 35-40;

HEIGHT: 5’ 8”-5’ 10”; WEIGHT: 165-175 pounds; BUILD: Medium; HAIR: Brown, to the top of the collar; EYES: Brown;

DRESS: Blue, short sleeve polo shirt, blue jeans, white tennis shoes; DISTINGUISHING CHARACTERISTICS: Mole

above the left eye; NFI.

E-8. Referring to SUBJECT:

Always refer to a subject of an investigation, once initially identified, as SUBJECT. Always

write the term “SUBJECT” in capital letters. The term “SUBJECT” replaces the surname,

thus the article “the” never precedes the term.

When using any pronoun in place of SUBJECT, write the pronoun in capital letters (for

example, HE, SHE, HIS, HER).

When there is more than one SUBJECT, identify each by placing a number after the word

SUBJECT (for example, SUBJECT 1 and SUBJECT 2). Number subjects sequentially as they

appear in the report. List subjects in the following order: Military personnel subject to the

UCMJ, known U.S. persons, any known persons, and any unidentified persons. There are two

ways to address multiple subjects. The first is “SUBJECT 1 and SUBJECT 2.” The second is

“SUBJECT 1 and 2.” Either way is acceptable; however, you must be consistent throughout

the report.

When using any plural pronouns to refer to two or more subjects, the pronoun will be written

in capitalized letters (for example, THEY, THEIR); when using a plural pronoun referring to

a SUBJECT and another person, the pronoun will be written using normal capitalization (for

example, they, their).

SUBJECT 1 and SUBJECT 2 walked to THEIR car.

Jones first met SUBJECT when they attended the Officer Basic Course.

In CI reports, always write SUBJECT’s surname with capital letters.

E-9. Referring to source. A source is always the person who provides the information in the report. For

the CI incident report, the source is the Walk-in; for subsequent IMFR, the person interviewed is the

source.

Refer to the source of the investigation, once initially identified, by their surname in the CI

incident report, but as source in the IMFR.

CI incident report: Jones entered the vehicle.

IMFR: Source entered the vehicle.

When you refer to an individual as source in the IMFR, always write the word source in title

case. The term “source” replaces source’s surname in the IMFR, thus the article “the” never

precedes the term in a report.

When using any pronoun in place of source, the pronoun is always in title case (He, She, His,

Her).

Since source provided all the information contained in the report, do not state in the body of

the report “Source said…” unless source is relating something He/She said to another person

involved. Otherwise, if the information is contained in the report, it is implied source told the

CI special agent the information.

If source provides an opinion, you must identify it as such and provide a reason for the

formulation of the opinion.

CI incident report: Smith believed SUBJECT did not like HIS commander because HE consistently made statements.

21 October 2009

FM 2-22.2

E-5

FOR OFFICIAL USE ONLY

Appendix E

against him.

IMFR: Source believed SUBJECT did not like HIS commander because HE consistently made statements against him.

E-10. Referring to other people. When referring to any person in a report other than source or SUBJECT,

address them by their surname and use lower case pronouns.

Source saw Jackson sitting at the bar by himself.

E-11. Referring to source, SUBJECT, and other people in the same sentence. When referring to source,

SUBJECT, and other people in the same sentence, place source first, then follow with SUBJECT, and then

all other people. Maintain this order no matter what combination of the above is involved.

Source, SUBJECT, and Jackson left the store together.

Source and Jackson left the bar together.

SUBJECT and Jackson drove away in the black car.

E-12. Qualifiers. These are abbreviations used to inform the reader that you asked additional

developmental and clarifying questions, but source did not know the answer. Do not use these as a crutch

for failing to fully develop all required information during an interview.

E-13. Not further identified (NFI). This qualifier applies to all persons, except source, identified in

paragraph 4 of the CI incident report or paragraph 1 of the IMFR. Use this when source does not know

complete identifying information concerning an individual. If you do not know at least one element of

required identifying data, then use the term “Not Further Identified.” Completely spell out the phrase “Not

Further Identified” the first time it is used and follow it with its short title in parentheses (for example, Not

Further Identified [NFI]) if you will use it again. Thereafter, only the short title “NFI” is used. Regardless

of the way you write it, you must be consistent. Whenever using “NFI,” whether spelled out or short-titled,

you will precede it with a semicolon.

1SG Jones, First Sergeant, B Co, 309th MI Bn; NFI.

Note. Never use the term “NFI” for source since source will always know their identifying data.

If source refuses to provide personal data, indicate the refusal in your report as the last entry in

source’s personal data block (for example, source refused to provide His SSN).

E-14. Qualifying statement. Enter a qualifying statement when a significant change of time, a location, or

event occurs. Only use these statements when the source cannot provide specific details concerning

significant details concerning the incident or SUBJECT of the investigation which Army Theater

Counterintelligence Coordinating Authority (ATCICA), Army Counterintelligence Coordinating Authority

(ACICA), or staff judge advocate (SJA) personnel would want to know to better guide the investigative

process.

Jones (CI incident report) or source (IMFR) could provide no further pertinent information

concerning SUBJECT 1’s travel to Mexico to meet SUBJECT 2.

E-15. Quotations. Only use direct quotes if the exact wording is necessary for the reader to gain a

complete understanding of what someone said or to emphasize the importance of the statement (for

example, threats, confessions, direct statements). Place quotes in quotation marks and transcribe them

verbatim. However, if source said “didn’t” and the CI special agent writes “do not,” the content of the

statement did not change and will be acceptable. Do not use abbreviations or short titles in quotes unless

the person quoted used them. If you must add your own parenthetical comments to a quote, place them in

brackets, not parentheses. Brackets indicate an editorial comment from the agent. Place other items (for

example, slang terms; colloquialisms; technical terms or military jargon; nicknames) in quotation marks as

well.

SUBJECT 1 told SUBJECT 2, “I am going to the SCI.”

E-6

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-16. Numerals. In general, spell out numbers from one to ten and write numbers above ten as a number.

Exceptions to this rule are as follows:

Use numerals, when associated with money.

$.05 (U.S.)

$5 (U.S.)

1,200 dinar (Iraq)

10,000 lira (Italian)

1,000 won (South Korea)

Note. Always identify the currency in lower case letters (not used for U.S. currency) and the

country (use this for U.S. currency), in parentheses, associated with the currency.

Use numerals when part of an address.

Room 5, Building 62702, Headquarters and Headquarters Company,

309th MI Bn Barracks, Fort Huachuca, AZ

Apartment 3, 766 North 7th Street, Sierra Vista, AZ

Use numerals when expressing weights and measures.

5 pounds

3 feet

2 inches

1 kilometer

45 degrees Celsius

Use numerals when expressing dates and times: Always use the

24-hour clock when

expressing time. Do not follow the time with the word hours. If the date is a single digit, do

not place a “0” in front. If source cannot provide an exact date, list what you have and follow

up with “exact” date unknown.”

At approximately 2245, 10 January 2008…

At approximately 0730, 1 January 2008…

In early March 2008, exact date unknown…

Use numerals when identifying military units below corps. For a corps level unit, use Roman

numerals.

Below Corps: B Company, 309th MI Bn, 111th MI Bde, Fort Huachuca

Corps Level: Headquarters, V Corps

Spell out armies.

Third Army

Use numerals when identifying telephone numbers, license plate numbers, and other numbers

typically expressed by a number.

(520) 551-1212

AZ license plate number: ALO55Y

SSN: 012-34-5678

Use numerals when expressing a percent. You will always spell out the word percent

following the number.

5 percent

20 percent

21 October 2009

FM 2-22.2

E-7

FOR OFFICIAL USE ONLY

Appendix E

Use numerals when expressing a fraction that is part of a mixed-number; otherwise, spell out

the fraction. If you use a fraction with other numbers, you will use the fraction. When

describing an item which combines spelled-out numbers and numbers in written form, you

will write out all numbers.

8 1/2

12 2/3

three-fifths

one-half

8 1/2 inches tall by 1/2 inch thick

8 cars and 15 trucks

Avoid beginning a sentence with a number. It is often easy to reword a sentence to avoid this.

If you cannot avoid beginning a sentence with a number, spell out the number.

WRONG: 15 minutes later, SUBJECT left.

RIGHT: Fifteen minutes later, SUBJECT left.

BETTER: SUBJECT left 15 minutes later.

BEST: At approximately (time), SUBJECT left.

E-17. Unknown spelling of a word. Spell out phonetically words whose spellings are unknown to either

the CI special agent or source, with the word “phonetic” placed in parentheses immediately after the

spelling. You do not need to put the word (phonetic) after subsequent uses of the name or word.

John MNU Sipowitz (phonetic)

E-18. Foreign words. Whenever you use a foreign word in a CI report, the foreign word will be underlined

every time it is used. You will exclude surnames, company or organization names, and the names of

foreign cities from this rule. If you know the English translation, place it in parentheses immediately

following the foreign word the first time it is used.

Paregam (friend)

SUBJECT met Gomez at the Tankaran (museum).

E-19. Underlining. You will underline titles of publications, plays, magazines, web addresses, or titles of

ships and you will include them exactly as written (regardless of whether words or phrases were previously

abbreviated or short-titled).

SUBJECT carried a copy of The Catcher in the Rye, the book by author J.D. Salinger.

SUBJECT accessed www.us.army.mil on a daily basis.

While assigned to the S3, HQ, 309th MI Bn, SUBJECT obtained a copy of the document entitled 111th Military

Intelligence Brigade General Defense Plan 06-01 (U), classified SECRET, dated 3 February 2008

Note. Do not underline the classification of a document title unless it is part of the title (see third

example above).

E-20. Contractions. Do not use contractions in CI reports. The only exception is if the contraction is part

of a direct quote or the title of a publication.

Correct:

cannot, they are, did not

Incorrect:

can’t, they’re, didn’t

E-8

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-21. Abbreviations.

Abbreviate words having commonly used military abbreviations if used more than once in the

report. Completely spell out the word the first time it is used, and place the abbreviation in

parentheses immediately following the word. Thereafter, use only the abbreviation (without

the parentheses).

Department of the Army (DA) Form 2823

DA Form 3881

Army Regulation (AR) 381-10

AR 381-20

Do not abbreviate the names of foreign countries. Spell out the country name in full the first

time it is mentioned. Thereafter, use the two-letter DI country code.

Seoul, Republic of South Korea

Taegu, KS

Do not abbreviate military ranks when used as a duty position or when referring to the rank in

general terms (for example, not as part of a person’s title).

SFC John Smith is assigned to B Co, 309th MI Bn.

He is a Platoon Sergeant in B Co, 309th MI Bn.

Abbreviate civilian titles preceding surnames. Abbreviations for junior (Jr.) and senior (Sr.)

will be abbreviated when used as part of the name. A period will follow both titles and name

designators.

Dr. John Smith

John Smith Sr.

Do not abbreviate months or years. Completely spell out months, and years will always

contain all four digits.

9 July 1963

10 October 2008

U.S. is the only authorized abbreviation that does not have to be spelled out before its

subsequent use. Write US without periods. Use this in all reports and the sworn statement.

E-22. Short titles. Short titles are similar to abbreviations, but you use them for titles (such as military

branches, organizations). As with abbreviations, you use them only if you use the word to be short-titled

more than once in the report. To form a short title, completely spell out the title the first time it is used.

Take the first letter of each proper noun in the title (do not use the first letters of articles and prepositions in

the short title) and place the short title in parentheses after the title. Thereafter, use only the short title

without the parentheses. Short titles are not required in a report; however, whether abbreviated or not,

consistency throughout the report is required.

First time used: Headquarters and Headquarters Company (HHC)

Subsequent use: HHC

Note 1. Do not use short titles if the short title might be confused with a commonly used short

title or abbreviation. For example, if you use Michigan/MI for several addresses, and then

mention Michigan later in your narrative, you cannot use MI in the sentence because MI is

normally military intelligence; the same applies for Fort Lewis

(FL); FL is the postal

abbreviation for Florida.

Note 2. Try to avoid using short titles at any time on the Sworn Statement (DA Form 2823),

unless part of a quote or title.

21 October 2009

FM 2-22.2

E-9

FOR OFFICIAL USE ONLY

Appendix E

E-23. U.S. states. When referencing to U.S. states, spell out the state completely the first time it is used.

Thereafter, use only the two-letter U.S. Postal Service abbreviation. Do not place the postal abbreviation in

parentheses after spelling out the state. This is because the postal abbreviations are commonly accepted

abbreviations. After a state is mentioned in the report, abbreviate the state when referred to alone. If a city

is mentioned a second time, the state does not have to be placed after. If a new city is mentioned in the

state, then the postal abbreviation is used.

First time used: Sierra Vista, Arizona

Second time used: Sierra Vista

New city: Tucson, AZ

Second time used: Tucson

E-24. Smallest to largest rule. Whenever referring to items with multiple components, list the smallest

component first in succession to the largest component.

Times/Dates: Time/Day/Month/Year (At 0900, 12 February 2005)

Addresses: House number, street, city, state or country (123 Main Street, Sierra Vista, Arizona)

Military units: Company, Battalion, Brigade, Installation, State/Country

E-25. Lowest common denominator. The lowest common denominator technique is a method of

expressing multiple elements of the same larger element without redundancy. For example, in a single

report, there may be multiple companies mentioned that all belong to the same battalion. Applying the

lowest common denominator rule, we need only identify subsequent elements up to the point that they

share a common element (lowest common denominator) with a previously fully identified element. As a

rule, at least two elements must be included, and the lowest common denominator must be unique. Thus, B

company cannot be a lowest common denominator because there are many B companies in the Army;

however, 309th MI Battalion is the lowest common denominator because there is only one 309th MI

Battalion in the Army. The lowest common denominator technique is not required; however, whether used

or not, consistency throughout the report is required.

First time identified: B Company (Co), 309th Military Intelligence (MI) Battalion (Bn), 111th MI Brigade (Bde), Fort

Huachuca (FH), Arizona.

Subsequent mention of first unit: B Co, 309th MI Bn.

Different unit identified: D Co, 309th MI Bn, FH.

Subsequent mention of unit: D Co, 309th MI Bn.

COUNTERINTELLIGENCE INCIDENT REPORT

E-26. All CI incident reports will be prepared in the prescribed format written in Arial font, font size 12.

Specific examples for CI incident reports are provided in this section. The following is a step-by-step

explanation of the format shown in figure E-1 (page E-16).

E-27. Overall classification. The overall classification will be marked on the top and bottom of each page

in bold. The font for this will be Arial font, font size 14. You will classify your reports based on the CI

category, and will at a minimum be classified CONFIDENTIAL.

UNCLASSIFIED

CONFIDENTIAL

SECRET

TOP SECRET

E-10

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-28. Portion markings. Each paragraph will be marked with the appropriate portion marking placed in

parentheses at the beginning of the paragraph between the paragraph number and the beginning of the text.

The portion markings will have two spaces before and two spaces after the parentheses.

(U) PERSONS INVOLVED:

(X//XX) SUBJECT: SMITH, John A.; SSG…

(U) PERSONS INVOLVED:

(U) SUBJECTS:

(X//XX) SUBJECT 1: SMITH, John A.;…

(X//XX) SUBJECT 2: JONES, John B.;…

E-29. Classification/Declassification authority. These will appear on the bottom left hand side of the first

page, two spaces from last line of text. For all reports, classification authority and declassification

instructions are as follows:

DERIVED FROM: Sec 2-2, Chapter 2

INSCOM SCG 380-2

DECLASSIFY ON: X1

DATE OF SOURCE: 6 Dec 96

E-30. Heading, office symbol, and date. All reports will begin with appropriate DA letterhead, office

symbol, and date.

DEPARTMENT OF THE ARMY

307th MILITARY INTELLIGENCE BATTALION

902d MILITARY INTELLIGENCE GROUP

FORT HUACHUCA, ARIZONA 85613

ATZS-TPQ-A

(report date)

E-31. Memorandum for. Triple space the MEMORANDUM FOR line below the office symbol. For

training purposes, list it as follows:

MEMORANDUM FOR

ARMY CI COORDINATING AUTHORITY, ATTN: DAMI-CH-CCO, FORT MEADE, MD 20755-5955

COMMANDER, 902D MI GROUP, ATTN: IAMG-OP-ATCICA, FORT MEADE, MD 20755-5955

COMMANDER, FOREIGN CI ACTIVITY, ATTN: IAFC-FCA, FORT MEADE, MD 20755-5955

E-32. Subject block. Double spaced below the last address in the MEMORANDUM FOR line is the

subject block. This block is a four-line entry which you may write, depending on the information known, as

a personal or impersonal subject block.

E-33. Personal subject block. You will use Line 1 when there is only one SUBJECT and you know the

identity of SUBJECT. This incorporates last name, first name, and middle initial (if known). Line 2 will

contain the rank and SSN (if known). If you know the identity of SUBJECT, but you are missing some of

the information needed for inclusion in the subject title, report the information known (for example, CIV,

ARMY). Line 3 will contain the DPOB. If you know the identity of SUBJECT, but information needed for

inclusion is incomplete, you will list the known information. The classification covering the first three lines

will follow. The classification will normally be CONFIDENTIAL. Line 4 will contain the local case

control number (LCCN). The format for the LCCN will list the field element brevity code, the last two

numbers of the fiscal year, and the sequence number. The classification for line

4 will always be

UNCLASSIFIED and represented by a “(U).”

21 October 2009

FM 2-22.2

E-11

FOR OFFICIAL USE ONLY

Appendix E

SUBJECT: SMITH, John J.

2LT; 123-45-6789

9 July 1963, Sierra Vista, Arizona (X//XX)

LCCN: TFO-06-005 (U)

SUBJECT: SMITH, John

U.S. ARMY

1963, Arizona (X//XX)

LCCN: TFO-06-005 (U)

E-34. Impersonal subject block. You will use Line 1 when the identity of SUBJECT is unknown or when

there is more than one SUBJECT. This incorporates the city and state where the incident took place. Line 2

will consist of the appropriate CI Investigative Case Category. Line 3 will contain the date of incident as

specific as possible (for example, 1 January 2008); if source reports dates in a sequential order (for

example, 14-16 January 2008), you will list them as such. If multiple dates are given, but are not in a

sequential order, the student will use the earliest date. The classification of the first three lines will follow.

The classification will normally be CONFIDENTIAL. Line 4 will contain the LCCN. The format for the

LCCN will list the field element brevity code, the last two numbers of the fiscal year, and the sequence

number. The classification for line 4 will always be UNCLASSIFIED and represented by a “(U).”

SUBJECT: Fort Huachuca, Arizona

Espionage

9 July 2008 (X//XX)

LCCN: TFO-06-005 (U)

SUBJECT: Fort Huachuca, Arizona

Espionage

14-16 January 2008 (X//XX)

LCCN: TFO-06-005 (U)

E-35. Paragraph 1 (SUMMARY). The summary must be clearly written to show an incident within CI

jurisdiction occurred and the significance of that incident. The summary should answer the six

interrogatives. You will address all U.S. military persons involved by service, rank, and unit (lowest

common denominator) (for example, An Army Staff Sergeant assigned to the 309th MI Battalion). You

will address foreign military members by their nationality, component, and rank (for example, A Republic

of South Korea Navy Captain). Address Army Civilians as such (for example, A Department of the Army

Civilian). You will address all other civilians by nationality and title or status (for example, A U.S.

Contractor; a Republic of South Korea Local Hire Employee; or an unidentified foreign national). Items

such as a title of a classified document may be nice-to-know information, but you may refer to them

generically due to space constraints. The summary of information (SOI) can exceed five lines but should

not be a paragraph that takes up half the page. If you use short titles in the report, then you may start them

in this paragraph. If you do not start short titles in this paragraph, they will start in paragraph 3. The

summary paragraph should also include the Army command and technology involved in the incident.

(X//XX) SUMMARY: An Army Staff Sergeant at the 309th Military Intelligence (MI) Battalion (Bn) reported that He

observed a U.S. Army Lieutenant Colonel assigned to the 309th MI Bn make unauthorized copies of a classified

document, place them in HIS battle dress uniform and leave the sensitive compartmented information facility (SCIF). A

U.S. Army Major assigned to the 309th MI Bn was present and may have observed the incident. Army Command:

TRADOC; Technology Involved: Unknown.

E-36. Paragraph 2 (DATE OF INCIDENT). This date must always match the date provided in line 3 of

the subject block. If the incident consists of a time period, then the entire period is shown here. The subject

block will have only the earliest date. See subject block examples for examples of how to list the date of

incident. This will only apply when using an impersonal subject block.

E-12

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-37. Paragraph 3 (LOCATION OF INCIDENT). This is the complete address where the incident took

place. In a city, this will include the number, street, city, and state. On a military installation, this will

include room, building, unit, installation, and state. When using an impersonal subject block, the location in

line 1 of the subject block will contain the city and state or city and country for OCONUS of the incident. If

elements of the location are missing, use the statement: “Source could provide no further pertinent

information concerning the location.”

(X//XX) LOCATION OF INCIDENT: Building (Bldg) 2587, Headquarters (HQ), 309th Military Battalion, Fort

Huachuca, Arizona. Source could provide no further pertinent information concerning the location.

(X/XX) LOCATION OF INCIDENT: City Lights Restaurant, 1234 Pratt Street, Baltimore, Maryland.

E-38. Paragraph 4 (PERSONS INVOLVED). Provide all known identifying data for SUBJECT(S),

source, Witness(es), and Others Knowledgeable, in that order. If you do not have a name and unit of

assignment or duty location on an individual, include a physical description in narrative format. When you

report personal data or physical descriptions, include only known information. If source told you SUBJECT

has no security clearance, you just received a positive response. You would list security clearance in the

identifying data and follow it with the word “NONE.” If source told you they do not know the individual’s

security clearance, you did not receive a positive response. You will omit the security clearance

information from the identifying data paragraph.

(U) PERSONS INVOLVED:

(X//XX) SUBJECT (S):

(1)

(X//XX) SUBJECT 1: MILLER, Susan Lynn; LTC; SSN: 111-22-3333; DPOB: 23 June 1965, Shawmutt,

Pennsylvania; Commander, 309th Military Intelligence (MI) Battalion (Bn), Fort Huachuca (FH), Arizona; ETS:

Indefinite; Security Clearance: TOP SECRET, with access to NONE; Not Further Identified (NFI).

(2)

(X//XX) SUBJECT 2: GENDER: Male; RACE: Caucasian; SKIN COLOR: Tan; SKIN COMPLEXION: Smooth;

AGE: 35 - 40; HEIGHT: 5’ 8” - 5’ 10”; WEIGHT: 165 - 175 pounds; BUILD: Medium; HAIR: Brown, to the top of the

collar; EYES: Brown; DRESS: Blue short, sleeve polo shirt, blue jeans, white tennis shoes; DISTINGUISHING

CHARACTERISTICS: Mole above the left eye; NFI.

E-39. Privacy Act Caveat. Before the start of paragraph 5, the appropriate Privacy Act Caveat is listed

three spaces below the subject block, three spaces above paragraph 5, and centered.

E-40. Paragraph 5 (NARRATIVE). Paragraph 5 is the incident information as told by source. Paragraph

5a starts the incident information. Use as many subparagraphs as necessary to relay the incident

information. Generally, short subparagraphs are easier to read than long ones. Remember, in formal

writing, a paragraph consists of no more than 10 lines of text.

AUSTIN HAD NO OBJECTION TO HIS IDENTITY BEING RELEASED

(U) NARRATIVE:

(X//XX) On 15 August 2005, Davis had dinner with Witnesses at Wagon Wheel, Sierra Vista, AZ. Davis and

Witnesses generally go out to eat together once per week in the Sierra Vista area. Davis saw SUBJECT 1 on several

occasions eating in various restaurants, but this was the first time Davis witnessed SUBJECT 1 meeting with

SUBJECT 2.

E-41. Period of association. After fully listing the incident information, identify source’s association with

SUBJECT. List the information in the following order: the type of contact SUBJECT and source have

(professional and social); when source first met SUBJECT and the circumstances of that meeting; and

frequency of the contact. This will incorporate all periods of contact; if there are breaks in contact, address

professional or social contact for each period. It is possible for source to have no period of association if

source and SUBJECT have never met.

E-42. Counterespionage

(CE) indicators. CE indicators are signs generally exhibited by persons

committing a national security crime. The seven indicators are financial matters; personal conduct; loyalty

and allegiance; outside activities; work habits; foreign considerations; or emotional, mental, or personality

disorders. You will list the first CE Indicator exhibited by SUBJECT in the same subparagraph as the

period of association. If you identify more than one CE Indicator, list each in a separate subparagraph,

following the initial one listed in the period of association subparagraph.

21 October 2009

FM 2-22.2

E-13

FOR OFFICIAL USE ONLY

Appendix E

E-43. Example of a known SUBJECT with known CE Indicators.

(X//XX) Source had daily professional and no social contact with SUBJECT since early November 2004,

exact date not recalled, when He was assigned to HHC, 309th MI Bn. SUBJECT often complained to Austin about not

earning enough money to meet HIS monthly obligations, but spent a lot of money when not at work. Source could

provide no further pertinent information concerning SUBJECT’s financial matters.

(X//XX) SUBJECT was often seen intoxicated outside HIS place of duty and 1SG Collins, B Co, 309th MI

Bn, counseled SUBJECT on at least three occasions concerning HIS alcohol consumption. Source could provide no

further pertinent information concerning SUBJECT’s personal conduct.

(X//XX) Source could provide no pertinent information concerning SUBJECT’s loyalty/allegiance, outside

activities, work habits, foreign considerations, or emotional/mental/ personality disorders.

E-44. Example of a known SUBJECT with no known CE Indicators.

(X//XX) Source never met SUBJECT 1 before this incident and could provide no pertinent

information concerning SUBJECT 1’s financial matters, personal conduct, loyalty/allegiance, outside activities, work

habits, foreign considerations, or emotional/mental/ personality disorders.

E-45. Example of an unknown SUBJECT with no known CE Indicators.

(X//XX) Source never saw SUBJECT 2 before this incident and could provide no pertinent information

concerning SUBJECT 2’s financial matters, personal conduct, loyalty/allegiance, outside activities, work habits, foreign

considerations, or emotional/mental/ personality disorders.

E-46. Motivation. After you list the last CE Indicator, a separate subparagraph will list walk-in source’s

motivation for reporting the incident.

(X//XX) Henslee reported this incident due to Her concern over SUBJECT 1’s lack of good security

practices. It concerned Henslee that SUBJECT 2 asked if SUBJECT 1 worked at that location and then took the trash

which would have contained the classified flash memory drive.

E-47. Paragraph 6 (ACTIONS TAKEN). This is the paragraph where you list all actions taken which fall

under the standing investigative authority. These include, but are not limited to sketches, sworn statement,

documents, records checks, and a Secrecy Affirmation Statement.

(U) ACTIONS TAKEN:

(U) Local agency checks (LACs)/military agency checks (MACs) initiated on all SUBJECTS to obtain full

identifying data. Results will be reported via IMFR.

(U) Smith provided a sketch of the incident area.

(U) Smith read and signed a Nondisclosure Agreement and executed a Sworn Statement.

E-48. Paragraph 7 (AGENT’S COMMENTS). In this paragraph, you will write the Freedom of

Information Act (FOIA), provide the CI Investigation Case category justification, and any comments that

you, as the CI special agent, have.

(X//XX) AGENT’’S COMMENTS: Agent names and any other personal identifying information are exempt from

release under FOIA exemptions 6 and 7 (civilians: 5 USC §§ 552(b)(6) and (b)(7)(c)) and may not be disclosed in

response to FOIA requests for intelligence information reports (IIRs) or other intelligence investigative documents. This

office assesses this incident as a Security Matter (Loss) based on what appears to be the unauthorized removal of

classified material from the sensitive compartmented information facility (SCIF), which SUBJECT 1 then passed to an

unauthorized individual. Recommend ATCICA open an investigation to determine the circumstances surrounding

SUBJECT 1’s removal of classified material from the SCIF.

E-49. Paragraph 8 (REPORT PREPARED BY). This paragraph identifies the CI special agent who

prepared the report, their unit, telephone numbers (defense switching network [DSN] and commercial), and

fax numbers.

(U) REPORT PREPARED BY: David M. Jones, special agent, Fort Huachuca Field Office, 902d MI Group,

SECURE TELEPHONE: DSN: 888-9203, COMMERCIAL: (623) 345-9203; SECURE Fax: DSN: 888-9204,

COMMERCIAL: (623) 345-9204.

E-50. Paragraph 9 (EXHIBITS). In this paragraph, you will list all attachments to the report and the date

you received the attachments. If the exhibit is not dated, list it as “undated.” This includes, but is not

limited to sworn statements, sketches, and documents. If there are any exhibits listed, you will place an

E-14

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

open set of parentheses before listing the exhibit. Investigating personnel will use the open parentheses to

identify exhibits during the course of the investigation once ATCICA closes the case or transfers it to

another agency. The parentheses will contain four spaces. The exhibit will then be listed two spaces after.

E-51. Example of no exhibits.

(U) EXHIBITS: NONE.

E-52. Example of one exhibit.

(U) EXHIBITS: (

) DA Form 2823, Sworn Statement, executed by Jacobs, John J., dated 20 April 2008.

E-53. Example of multiple exhibits.

(U) EXHIBIT(S):

(U) (

) Sworn Statement, executed by Jacobs, John J., dated 20 April 2008.

(X//XX) (

) Sketch of incident area, executed by Jacobs, John J., dated 20 April 2008.

(U) (

) Computer diskette, updated.

E-54. Signature block. The signature block follows paragraph 9. Place the signature block five lines below

the last line of text with the first letter centered on the page. It is mandatory that there are at least two lines

of text before the signature block (for example, your signature block will not be the only thing on a page).

Line 1 of the signature block is the CI special agent’s name in capital letters. Line 2 consists of the words

“special agent,” and line 3 is the unit of assignment.

JUSTIN J. BLACK

Special Agent

A Co, 307th MI Bn

E-55. To the left of the signature block, type the word “EXHIBIT” (all caps) on the same line as the agent’s

name. Directly below EXHIBIT, type “as”; both words will be left justified.

21 October 2009

FM 2-22.2

E-15

FOR OFFICIAL USE ONLY

Appendix E

E-56. Figure E-1 is an example of an CI incident report.

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

ATZS-TPQ-A

21 May 2008

MEMORANDUM FOR

ARMY CI COORDINATING AUTHORITY, ATTN: DAMI-CH-CCO, FORT MEADE, MARYLAND

20755

COMMANDER, 902D MILITARY INTELLIGENCE BRIGADE, ATTN: IAMG-OP-ATCICA, FORT

MEADE, MARYLAND, 20755

COMMANDER, USAFCA, 902D MI GROUP, ATTN: IAFC-OP, FORT MEADE, MARYLAND

20755

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

(X//XX) SUMMARY: At approximately 1645, 19 May 2008, an Army Specialist assigned to

1st Signal Brigade (Bde), found a classified flash memory drive in a trashcan located at an

Army Staff Sergeant’s desk. An Army Sergeant assigned to the 1st Signal Bde, removed the

flash memory drive from the trashcan, and secured it. At approximately 1730, an Unidentified

Individual asked the Specialist if the Staff Sergeant worked in Building 52204. When the

Specialist told the Unidentified Individual the Sergeant worked at the location, the Unidentified

Individual took the trash out of the nearby trash dumpster and left the area. MACOM:

TRADOC; Technology Involved: Unknown.

(U) DATE OF INCIDENT: 19 May 2008.

DERIVED FROM: Sec 2-2, Chapter 2, INSCOM SCG 380-2

DECLASSIFY ON: X1

DATE OF SOURCE: 6 Dec 96

CLASSIFICATION

Figure E-1. Example of a CI incident report

E-16

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

21 May 2008

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

(X//XX) LOCATION OF INCIDENT: Building 52204, Headquarters (HQ), 1st Signal Bde,

Fort Huachuca (FH), Arizona.

(U) PERSONS INVOLVED:

(X//XX) SUBJECT (S):

(1)

(X//XX) SUBJECT 1: RIVERA, Brenda MNU; SSG; DPOB: 12 March 1976,

Pittsburgh, Pennsylvania; Plans Noncommissioned Officer, S3, HQ, 1st Signal Brigade;

assigned to Headquarters and Headquarters Company (HHC), 1st Signal Bde, FH;

Residence: Apartment 105, Mountain View Apartment Complex, 800 Carmichael Street,

Sierra Vista, AZ; Security Clearance: TOP SECRET, with access to SECRET; Special

access: SENSITIVE COMPARTMENTED INFORMATION; Not Further Identified (NFI).

(2)

(X//XX) SUBJECT 2: SEX: Male; RACE: Hispanic; SKIN COLOR: Light Tan; SKIN

COMPLEXION: Clear Complexion; AGE: 30-35; HEIGHT: 5’11”-6’1”; WEIGHT: 160-170

pounds; BUILD: Medium; HAIR: Brown; EYES: Brown; DRESS: Beige short sleeve

shirt with a Cochise Disposal Systems (CDS) logo, beige khaki pants; DISTINGUISHING

CHARACTERISTICS: None; NFI.

(X//XX) SOURCE: Henslee, Jane Brittany; SPC; SSN: 123-45-6789; DPOB: 3 July

1984; San Jose, California; Administrative Specialist, S3, Room 5, Building 52204, HQ, 1st

Signal Bde; assigned to HHC, 1st Signal Bde; Residence: Room 238, Building 52106, HHC,

1st Bde Barracks, FH; ETS: 29 August 2009; PCS: 20 March 2007; Security Clearance:

SECRET, with daily access to SECRET; Special access: NONE.

CLASSIFICATION

Figure E-1. Example of a CI incident report (continued)

21 October 2009

FM 2-22.2

E-17

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

ATZS-TPQ-A

21 May 2008

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

(X//XX) WITNESS: Carr, David MNU; SGT; POB: Billings, Montana; Transportation

Sergeant, S3, Room 11, Building 52204, HQ, 1st Signal Bde, FH; assigned to HHC, 1st

Signal Brigade; ETS: Indefinite; Security Clearance: TOP SECRET; with daily access to

TOP SECRET; Special access: NONE; NFI.

( U) OTHERS KNOWLEDGEABLE: UNKNOWN.

(X//XX) NARRATIVE:

HENSLEE HAD NO OBJECTION TO HER IDENTITY BEING RELEASED

(X//XX) At approximately 1630, 19 May 2008, Henslee and Carr started cleaning and

conducting end-of-day security checks in the HQ, 1st Signal Bde. At approximately 1645,

Henslee started to take the clear plastic bag from the trashcan located at the front right-

hand corner of SUBJECT 1’s desk, and noticed the trash can contained a classified flash

memory drive. The title of the document contained in the flash memory drive, 1st Signal

Brigade General Defense Plan 01-06(U), classified SECRET, with a NOT RELEASABLE

TO FOREIGN NATIONALS handling caveat, was embroidered on a black cloth lanyard

attached to the flash memory drive. Henslee called Carr, the detail supervisor, over to the

trash can and showed him the flash memory drive. Carr removed the flash memory drive

from SUBJECT 1’s trash can and secured it in the HQ, 1st Signal Bde security container.

The security container was a gray, five-drawer, Mosler, General Services Administration

approved security container, accredited to store SECRET information. Henslee could

provide no further pertinent information regarding the flash memory drive, the classified

document or the security container.

(X//XX) After Carr removed the flash memory drive he told Henslee to look through the

remaining trash to make sure there was no other classified information. Henslee told Carr

She did not find any other classified materials. Henslee could provide no further pertinent

information concerning the conversation.

CLASSIFICATION

Figure E-1. Example of a CI incident report (continued)

E-18

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

21 May 2008

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

(X//XX) Carr secured the flash memory drive, Henslee emptied the remaining trash

cans, and at approximately 1700 She collected all the bags and took them out to the

dumpster located in the parking lot behind Building

52204. The parking lot was

approximately 100 meters northeast of Building 52204. The dumpster stood alone in the

southwest portion of the parking lot, perpendicular to two rows of marked parking slots. The

dumpster was blue, approximately 3’ x 5’, with a sloping top approximately 3 feet in the front

and approximately 4 feet in height in the back. Henslee walked back to the HQ after She

threw away the trash and helped Carr complete the clean up and end-of-day security

checks. Henslee could provide no further pertinent information about the dumpster or its

location.

(X//XX) Once Henslee and Carr finished the security checks, they departed the HQ,

locked the building, and walked behind Building 52204 to a parking lot adjacent to the trash

dumpster. Carr intended to give Henslee a ride in the HQ duty vehicle to the barracks, since

She did not have a car. As Henslee approached the HQ vehicle, She noticed SUBJECT 2,

approximately 75 feet away, looking through several trash bags that were on the ground in

front of the dumpster. SUBJECT 2 loaded the trash bags into the back of a CDS vehicle.

SUBJECT 2 walked towards Henslee. When HE came within 10-20 yards of Henslee and

Carr, HE asked if SUBJECT 1 worked in Building 52204. Henslee told SUBJECT 2 SHE

did. SUBJECT 2 turned around and returned to the area of the dumpster. SUBJECT 2

removed some trash bags from the dumpster and loaded them into the back of the CDS

vehicle. Henslee and Carr entered the duty vehicle and Carr drove Henslee to the barracks.

Henslee could provide no further pertinent information regarding SUBJECT 2, the CDS

vehicle, the contents of the trash bags or the incident.

(X//XX) Henslee had daily professional contact with SUBJECT 1 since early March

2008, exact date not recalled, when She was assigned to HHC, 1st Signal Bde. Henslee

had no social contact with SUBJECT 1. SUBJECT 1 complained about being overworked

and not having enough money to pay HER bills. Henslee could provide no further pertinent

information concerning SUBJECT 1’s finances.

CLASSIFICATION

Figure E-1. Example of a CI incident report (continued)

21 October 2009

FM 2-22.2

E-19

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

ATZS-TPQ-A

21 May 2008

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

(X//XX) SUBJECT 1 did not accomplish HER projects, had a cluttered desk, and seemed

to spend more time looking for paperwork than actually working. Henslee could provide no

further pertinent information concerning SUBJECT 1’s work habits.

(X//XX) Henslee could provide no pertinent information concerning SUBJECT 1’s,

personal conduct, loyalty/allegiance, outside activities, foreign considerations, or

emotional/mental/ personality disorders.

(X//XX) Henslee never saw SUBJECT 2 before the incident and could provide no

information concerning SUBJECT

2’s financial matters, personal conduct,

loyalty/allegiance, outside activities, work habits, foreign considerations, or

emotional/mental/ personality disorders.

(X//XX) Henslee reported this incident due to Her concern over SUBJECT 1’s lack of

good security practices. It concerned Henslee that SUBJECT 2 asked if SUBJECT 1

worked at that location and then took the trash which would have contained the classified

flash memory drive.

(U) ACTIONS TAKEN:

(U) LACs and MACs were initiated on SUBJECT 1, results will be reported via IMFR.

(X//XX) Henslee provided a hand-drawn sketch of the trash dumpster area.

(X//XX) Henslee read and signed a nondisclosure agreement and executed a DA Form

2823, Sworn Statement.

CLASSIFICATION

Figure E-1. Example of a CI incident report (continued)

E-20

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

21 May 2008

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

(X//XX) COMMENTS: Agent names and any other personal identifying information are

exempt from release under FOIA Exemptions 6 and 7 (5 USC §§ 552(b)(6) and (b)(7)((c)), and

may not be disclosed in response to FOIA requests for IIRs or other intelligence investigative

documents. This office assesses this incident as a SM01, based on what appears to be the

planned unauthorized transfer of classified material to unauthorized personnel. Recommend

that ATCICA CONUS open an investigation to determine the circumstances surrounding

SUBJECT 1’s possible planned unauthorized transfer of classified information to SUBJECT 2.

(U) REPORT PREPARED BY: Justin J. Black, Special Agent, Alaska Field Office, A Co,

307th MI Bn, 902d MI Group, SECURE TELEPHONE: DSN: 888-9203, COMMERCIAL: (520)

533-9203; SECURE Fax: DSN: 533-9204, COMMERCIAL: (520) 533-9204.

(U) EXHIBITS:

(U) (

) DA Form 2823, Sworn Statement, dated 20 May 2008.

(U) (

) Sketch of incident area; executed by Henslee, Jane B., dated 20 May 2008.

EXHIBITS

JUSTIN J. BLACK

Special Agent

A Co, 307th MI Bn

CLASSIFICATION

Figure E-1. Example of a CI incident report (continued)

21 October 2009

FM 2-22.2

E-21

FOR OFFICIAL USE ONLY

Appendix E

INVESTIGATIVE MEMORANDUM FOR RECORD

E-57. IMFR format. All IMFRs will be prepared in the prescribed format in Arial font, font size 12. This

includes non-IMFR (for example, records checks), specific examples for records checks are provided in

this section. The following is a step-by-step explanation of the format shown in figures E-2 through E-6

(pages E-24 through E-44).

E-58. Overall classification. The overall classification will be marked on the top and bottom of each page

in bold. The font for this will be Arial/14. You will classify your reports based on the CI category.

UNCLASSIFIED

CONFIDENTIAL

SECRET

TOP SECRET

E-59. Portion markings. Each paragraph will be marked with the appropriate portion marking placed in

parentheses at the beginning of the paragraph between the paragraph number and the beginning of the text.

The portion markings will have two spaces before and two spaces after the parentheses.

E-60. Classification/Declassification authority. These will appear on the bottom of the first page, two

spaces from last line of text. For all reports, classification authority and declassification instructions are as

follows:

DERIVED FROM: Sec 2-2, Chapter 2

INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 6 Dec 96

E-61. Heading, office symbol, and date. All reports will begin with appropriate DA letterhead, office

symbol, and date. For training purposes, enter the heading as follows:

DEPARTMENT OF THE ARMY

307th MILITARY INTELLIGENCE BATTALION

902d MILITARY INTELLIGENCE GROUP

FORT HUACHUCA, ARIZONA 85613

ATZS-TPQ-A

(report date)

E-62. Place IMFR double spaced below the office symbol, or enter REPORT OF ACTIVITY as

appropriate.

E-63. Subject block. Double spaced below the INVESTIGATIVE MEMORANDUM FOR RECORD line

is the subject block. Once the CI special agent sends the CI incident report to the ATCICA, the ATCICA

will send a message back indicating whether they will open the case or if the case does not fall within CI

jurisdiction. If ATCICA opens the case, the message will provide the new subject block which investigative

personnel will use throughout the rest of the investigation. Normally the first three lines will not change,

however line four will. ATCICA will replace the LCCN with an ASCCN. The ASCCN will always be

UNCLASSIFIED and represented by a “(U).”

SUBJECT: SMITH, John J.

2LT; 123-45-6789

9 July 1963, Sierra Vista, Arizona (X//XX)

ASCCN: 06-111-902 (U)

SUBJECT: SMITH, John

U.S. ARMY

1963, Arizona (X//XX)

ASCCN: 06-111-902 (U)

E-22

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-64. Privacy Act Caveat. Before the start of paragraph 1, the appropriate Privacy Act Caveat is listed

three spaces below the subject block, three spaces above paragraph 1, and centered.

E-65. Paragraph 1. This paragraph contains, in this order, the date the interview was conducted; source’s

name (first, middle, last) with full identifying data; SUBJECT(S) names (first, middle, last) with full

identifying data; and the reason for the interview. As with the CI incident report, all grammatical guidelines

apply. Once you identify the person providing the information in paragraph 1, the word “source” will

substitute for that person’s surname.

1. (X//XX) On 1 October 2008, an interview of <source’s full name; first, middle, last and identifying data>, hereinafter

referred to as source, provided information concerning <SUBJECT 1’s name and known personal data>; SUBJECT 1

and <SUBJECT 2’s name and known personal data or description>; SUBJECT 2 of this investigation. The purpose of

this interview was to determine what knowledge source had pertaining to the mishandling of classified information, and

possible espionage activity concerning SUBJECT 1 and 2. Source provided the following information:

E-66. Paragraph 1a. This sub-paragraph starts the incident information. Use the same format as paragraph

5 of the CI incident report.

E-67. The last sub-paragraph of paragraph 1 will list all actions taken. These include, but are not limited to

sketches, sworn statement, documents, records checks, and a Secrecy Affirmation Statement.

E-68. Paragraph 2 (AGENT’S COMMENTS). In this paragraph, you will write the Freedom of

Information Act and any comments that you, the CI special agent, have.

(X//XX) AGENT’S COMMENTS: Agent names and any other personal identifying information are exempt from

release under FOIA exemptions 6 and 7 (civilians: 5 USC §§ 552(b)(6) and (b)(7)(c)) and may not be disclosed in

response to FOIA requests for IIRs or other intelligence investigative documents.

E-69. Exhibits. Exhibits are listed to the left of the signature block (left justified).

E-70. Example of no exhibits:

Exhibits

VINCENT K. MCMAHON

None

Special Agent

A Co, 307th MI Bn

E-71. Example of one exhibit:

Exhibits

VINCENT K. MCMAHON

(

) DA Form 2823

Special Agent

A Co, 307th MI Bn

E-72. Example of multiple exhibits:

Exhibits

VINCENT K. MCMAHON

(

) DA Form 2823

Special Agent

(

) Sketch of Incident Area

A Co, 307th MI Bn

(

) USB Thumb drive, undated

E-73. Signature block. The signature block follows paragraph 2. The signature block is placed five lines

below the last line of text with the first letter centered on the page. It is mandatory that there are at least two

lines of text before the signature block. Line one of the signature block is the CI special agent’s name in

capitalized letters. Line two consists of the words “Special Agent”, and line three is the unit of assignment.

VINCENT K. MCMAHON

Special Agent

A Co, 307th MI Bn

21 October 2009

FM 2-22.2

E-23

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

(X//XX) On 7 December 2008, Brenda Anne RIVERA; SSG; SSN: 123-45-6789; DPOB: 12

March 1976; Pittsburgh, Pennsylvania; Plans Noncommissioned Officer, Room 5, Building

52204, Headquarters (HQ), 1st Signal Brigade (Bde), Fort Huachuca (FH), Arizona; assigned

to Headquarters and Headquarters Company (HHC), 1st Signal Bde, FH; residing at Apartment

105, Mountain View Apartment Complex, 800 Carmichael, Sierra Vista, AZ 85635; ETS: 15

June 2008; PCS: 15 June 2008; Security Clearance: TOP SECRET; with daily access to

SECRET; Special access: SENSITIVE COMPARTMENTED INFORMATION; SUBJECT 1 of

this investigation, provided information concerning HER possible involvement in espionage, the

deliberate mishandling of classified information, and HER relationship with Roberto

“The

Plumber” AMOROS, a Cuban Intelligence Service officer described as follows: SEX: Male;

RACE: Hispanic; SKIN COLOR: Light tan; SKIN COMPLEXION: Clear; AGE: 30 - 35; HEIGHT:

5’ 11’ - 6’ 1’; WEIGHT: 160 - 170 pounds; BUILD: Medium; HAIR: Brown, short; EYES: Brown;

DRESS: Light blue, short sleeve dress shirt, tan slacks, brown leather belt and dress shoes.

DERIVED FROM: Sec 2-2, Chapter 2, INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

CLASSIFICATION

Figure E-2. Example of an IMFR—interview

E-24

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

DISTINGUISHING CHARACTERISTICS: Spoke English without an accent; NFI; SUBJECT 2

of this investigation. SUBJECT 1 understood and waived HER rights under Article 31, UCMJ.

SUBJECT 1 executed a DA Form 3881 (Rights Warning Procedure/Waiver Certificate).

SUBJECT 1 admitted SHE purposely attempted to compromise classified national defense

information and release it to SUBJECT 2, who tasked HER to do so. SHE provided the

following information concerning the alleged incident:

(X//XX) At approximately 1600, 19 May 2008, SUBJECT 1 checked the office, Room 5,

Building 52204, HQ, 1st Signal Bde, FH, to make sure SHE was alone. There was no one

else in the room. SHE did not want anyone to see HER place the classified flash memory

drive in the trashcan. The flash memory drive was approximately 2 inches long, 1 inch wide,

and 1/2 inch thick. Printed in black on the flash memory drive were the words Centron Spin

Drive 4 GB. Affixed to the flash memory drive was a red SECRET classification label

approximately one-third inch wide. There was a black cloth lanyard attached to it with red

embroidered stenciling that read 1st Signal Brigade General Defense Plan 06-01 (U). The

General Defense Plan (GDP) contained on the flash memory drive was classified SECRET

with a NOT RELEASABLE TO FOREIGN NATIONALS handling caveat. The GDP

contained information concerning how all units stationed at FH would react to various forms

of attack or emergency. The GDP also contained units located outside FH who would

quickly deploy to FH. Because the document focused on FH’s defense, it identifies strategic

and tactical weaknesses concerning FH. SUBJECT 1 knew that compromising the GDP

could result in grave damage against FH facilities, operations, and personnel. There were

no other files on the flash memory drive.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

21 October 2009

FM 2-22.2

E-25

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

(X//XX) SUBJECT 1 removed the flash memory drive from HER computer and placed it

in HER trashcan located at the front, right hand corner of HER desk. SUBJECT 1 was very

nervous and forgot to place other trash on top of the flash memory drive. SUBJECT 1,

although SHE had poor organizational skills, never purposely mishandled classified

information before and started to feel physically ill. SUBJECT 1 kept a cluttered desk, as

usual, and SHE thought about how easily the flash memory drive could accidentally fall or

how someone could knock it into HER trashcan. SHE decided that was how she would

explain it if something went wrong and someone found it in the trashcan before SUBJECT 2

retrieved it. SUBJECT 1 shut down HER computer, locked the security container, and

initialed the SF 702 (Security Container Checksheet) on top on the container. SUBJECT 1

knew, since it was Friday, someone from the office would conduct the end of day security

checks and clean up, to include taking all the office trash out to the dumpster.

(X//XX) At approximately 1615, SUBJECT 1 turned HER computer off and left the office.

SHE walked out to the parking lot to HER privately owned vehicle (POV), entered it, and

drove to HER residence. At approximately 1645, SUBJECT 1 arrived at HER residence.

SUBJECT 1 was very concerned because SHE knew SHE forgot to cover the flash memory

drive with other trash. SUBJECT 1 was also worried that SUBJECT 2 would be very angry

when HE found out SHE did not cover up the flash memory drive. SUBJECT 1 wanted to

call SUBJECT 2, but HE told HER not to call HIM because HE would contact HER after a

few days went by. SUBJECT 1 went about HER normal daily schedule and waited for

SUBJECT 2 to contact HER.

(X//XX) SUBJECT 1 first met SUBJECT 2 in November 1998, exact date not recalled, at

an off-post restaurant in Vilseck, Germany. From November 1998 to February 1999, exact

dates not recalled, SUBJECT 1 and SUBJECT 2 met socially at various locations, at least

once a week, in and around Vilseck. In mid-February 1999, exact date not recalled,

SUBJECT 1 and SUBJECT 2 were romantically involved.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

E-26

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

SUBJECT 2 appeared very interested in SUBJECT 1, asking HER many questions about

HER life and job. SUBJECT 2 bought gifts for SUBJECT 1 including jewelry, stuffed

animals, and romantic greeting cards. SUBJECT 1 was very happy with the growing

relationship and believed SHE was very fortunate because SUBJECT 2 seemed very

interested in HER feelings and even HER career. SUBJECT 2 told SUBJECT 1 HE worked

local jobs as a woodworker and applying finishes to furniture. SUBJECT 2 rented a small

apartment in Vilseck but preferred to meet SUBJECT 1 at other locations, usually a

gasthaus. A gasthaus was a small bar/restaurant which rents out a few rooms.

e. (X//XX) SUBJECT 2 did not ask SUBJECT 1 for any classified or unclassified national

defense information while in Vilseck. SUBJECT 2 did ask questions about SUBJECT 1’s job

and even HER security clearance level. SUBJECT 1 told HIM SHE held a TOP SECRET

clearance, but usually only handled SECRET information. SUBJECT 1 told SUBJECT 2

SHE was excited because HER next duty assignment in Fort Lewis, Washington, would

allow HER to work on more “high speed” projects. SUBJECT 1 often started conversations

about what SHE did at work because SUBJECT 2 always became very attentive when SHE

talked about work. While stationed in Vilseck, SUBJECT 1 never spoke to SUBJECT 2

about classified information or sensitive operational information. SUBJECT 1 did discuss

information contained in UNCLASSIFIED Army Regulations an Field Manuals. SUBJECT 1

could [provide no further pertinent information concerning the information she discussed

with SUBJECT 2.

(X//XX) In March 2000, exact date not recalled, SUBJECT 1 traveled to HER new

assignment in Fort Lewis, while SUBJECT 2 moved nearby so THEY could be together.

SUBJECT 1 was assigned to 3rd Bde, 2d Infantry Division, Fort Lewis. SUBJECT 1 worked

as an instructor at the System Administrator & Network Manager’s Security Course.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

21 October 2009

FM 2-22.2

E-27

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

SUBJECT 2 told SUBJECT 1 HE obtained employment with a local plumbing company.

SUBJECT 1 had almost daily social contact with SUBJECT 2 and no professional contact.

From June 2000 to July 2003, exact dates not recalled, SUBJECT 1 and SUBJECT 2

continued THEIR romantic relationship. SUBJECT 2 remained very interested in SUBJECT

1’s work. SUBJECT 2 often asked to see the training material SUBJECT 1 used to teach

system administration and network security. SUBJECT 1 often brought UNCLASSIFIED

instructional material back to HER barracks room to prepare to instruct classes. SUBJECT

2 told SUBJECT 1 HE could help HER study the material by asking HER questions and

using the instructional material to make sure SHE knew the correct answer. The materials

which SUBJECT 2 helped SUBJECT 1 review were: System Administration Level 1(U),

System Administration Level 2(U), Network Security Level 1(U), Network Security Manager

Level

1(U), all UNCLASSIFIED. These instructional manuals covered basic file

manipulation, UNIX operating system, UNIX basic commands, UNIX and Windows

networking, and UNIX and Windows security.

(X//XX) In August 2002, exact date not recalled, SUBJECT 1 asked SUBJECT 2 to

move in with HER because SHE loved HIM and wanted to know what it would be like to live

with HIM. SUBJECT 2 said HE was not ready for that step, but that HE did love HER and

thought THEIR relationship was great as it was. SUBJECT 1 and SUBJECT 2 continued

THEIR romantic relationship.

(X//XX) In July 2003, exact date not recalled, SUBJECT 1 was assigned to 78th Signal

Bn, Camp Zama, Japan. SUBJECT 2 traveled to Tokyo (coordinates not available), Japan

and found work as a handyman. SUBJECT 1 and 2 had weekly social contact and no

professional contact. SUBJECT 1 and SUBJECT 2 continued THEIR romantic relationship.

CLASSIFICATION

Figure E-2. Example of an IMF—interview (continued)

E-28

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

SUBJECT 2 became increasingly distant over time toward SUBJECT 1. SUBJECT 2 met

less with SUBJECT 1 from July 2003 to April 2004. SUBJECT 2 often narrowed discussion

topics to SUBJECT 1’s work. If SUBJECT 1 talked about work,

SUBJECT

2 would

show increased affection. This resulted in SUBJECT

1 initiating more conversations

surrounding HER work. SUBJECT 2 asked SUBJECT 1 to bring HIM Field Manuals and

other publications dealing with communications and automated information systems SHE

used at work. The material, SUBJECT 1 brought SUBJECT 2 was UNCLASSIFIED.

SUBJECT 1 began to feel uncomfortable about how interested SUBJECT 2 was in HER job

and asked HIM why HE wanted to see so much material. SUBJECT 2 told SUBJECT 1 HE

was proud of the work SHE did and was so interested because HE cared about HER.

SUBJECT 1 could provide no further pertinent information concerning the material SHE

provided to SUBJECT 2.

(X//XX) On 7 February 2005, SUBJECT 2 called SUBJECT 1 and told HER to meet HIM

at a motel. SUBJECT 1 went to the motel and met with SUBJECT 2. SUBJECT 2 said HE

did not want anyone to see HIM in public with HER and would call HER to arrange meetings

at motels. SUBJECT 2 told SUBJECT 1 to get rid of all pictures and anything else that

showed a connection between THEM. SUBJECT 1 started to cry and asked HIM why HE

wanted HER to do that. SUBJECT 2 told HER HE worked for the Cuban Intelligence

Service and HE wanted HER to collect classified information for HIM. SUBJECT 1 told

SUBJECT 2 SHE thought HE loved HER. SUBJECT 2 told SUBJECT 1 HE did love HER

and SHE needed to listen to HIM and do what HE wanted. SUBJECT 1 told SUBJECT 2

SHE could not give HIM classified information. SUBJECT 2 told SUBJECT 1 SHE had

already given HIM a great amount of information and if SHE did not do what HE wanted, HE

would turn HER into the authorities.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

21 October 2009

FM 2-22.2

E-29

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

SUBJECT 2 said SHE had an affair with a foreign intelligence agent and the authorities

would never believe SHE did not know who HE was. SUBJECT 1 agreed to do what

SUBJECT 2 wanted. SUBJECT 1 felt betrayed by SUBJECT 2 but still loved HIM and was

afraid to disobey HIM. SUBJECT 2 continued to meet with SUBJECT 1 occasionally.

SUBJECT 1 informed SUBJECT 2 HER next duty station was FH. SUBJECT 2 appeared

happy and told HER HE would also move nearby sometime after SHE arrived there.

SUBJECT 1 could provide no further pertinent information concerning HER meetings with

SUBJECT 2.

(X//XX) In June 2005, exact date not recalled, SUBJECT 1 was assigned to HHC, 1st

Signal Bde. In early July 2005, exact date not recalled, SUBJECT 2 called SUBJECT 1 and

told HER to meet HIM at the Days Inn Conference Center, 222 South Freeway Road,

Tucson, AZ 85745, on 8 July 2008. SUBJECT 2 told SUBJECT 1 HE would call HER the

day before and give HER HIS room number.

(X//XX) On 8 April 2008, SUBJECT 1 drove HER POV to Tucson and met SUBJECT 2

in Room 34 at Days Inn. SUBJECT 1 was very happy to see SUBJECT 2, but SUBJECT 2

was cold to HER and questioned HER extensively about HER new workplace and what

information SHE had access to. SUBJECT 2 told HER to look through all the classified

material SHE had access to. SHE was to do this over time and only when no one else was

around. SHE was to remember titles of documents and know what type of information they

contained. SHE was not to call HIM unless it was an emergency, and SHE could not tell

anyone about HIM. HE called HER occasionally to set up meetings. SUBJECT 2 told HER

to do a good job at work and to not do anything that would negatively affect HER access to

classified information. SUBJECT 2 asked SUBJECT 1 if SHE understood all the instructions

and SHE said yes. SUBJECT 1 could provide no further pertinent information.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

E-30

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

(X//XX) Between July 2005 and January 2008, SUBJECT 1 followed SUBJECT 2’s

instructions and became familiar with most of the classified information stored in HER

office. Once every few weeks, exact dates not recalled, SUBJECT 2 called SUBJECT 1 and

arranged meetings at random motels in Tucson during the weekends. SUBJECT 1 briefed

SUBJECT 2 on the classified material SHE had access to. This access was limited as HER

position did not warrant a need to know. In January

2008, exact date not recalled,

SUBJECT 1 became the Plans Noncommissioned Officer. This position required daily

access to classified material. SUBJECT 1 could provide no further pertinent information.

m. (X//XX) In early April 2008, SUBJECT 1 met SUBJECT 2 at a motel in Tucson. THEY

discussed HER new position and access. SUBJECT 2 showed interest in the 1st Signal

Brigade General Defense Plan 06-01 (U). SUBJECT 1 told HIM they kept the document on

a classified flash memory drive. THEY discussed ways to remove the flash memory drive

from SUBJECT 1’s office. SUBJECT 1 said SHE would feel very uncomfortable leaving the

office with the flash memory drive or any other classified material in HER possession.

SUBJECT 2 asked HER when they took the trash out of the office. SHE told him that every

Friday, junior enlisted Soldiers removed all the trash in HER office and took it to the

dumpster out in the parking lot. SUBJECT 2 smiled and said HE knew exactly how THEY

would remove the classified information. HE told HER HE had access to a trash truck and

should be able to get it onto post. SUBJECT 2 told HER to place the flash memory drive

into a trashcan in HER office and cover it up with trash so no one would know it was there.

SUBJECT 2 would drive the trash truck onto post that night and remove all the trash in the

dumpster. That way SUBJECT 1 did not have to take the chance of removing the material

HERSELF. SUBJECT 2 told HER HE would contact HER when HE wanted HER to do it.

SUBJECT 1 could provide no further pertinent information.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

21 October 2009

FM 2-22.2

E-31

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

(X//XX) On 18 May 2008, SUBJECT 2 called SUBJECT 1 and asked if the Friday trash

procedures had changed; SUBJECT 1 said no. SUBJECT 2 told HER to make it happen on

19 May 2008 and SUBJECT 1 said SHE would. On 22 May 2008, exact time not recalled,

SUBJECT 1 found the flash memory drive in the security container. As time passed and no

one said anything to HER, SHE believed no one knew it was HER who put it in the trash

can. It concerned HER that SUBJECT 2 had not contacted HER since 18 May 2008. SHE

was worried about HIM and wondered if HE was angry with HER because HE did not

receive the flash memory drive.

(X//XX) On 20 August 2008, SUBJECT 2 called SUBJECT 1 and arranged a meeting for

2 September 2008, at the Lucky Star Motel, 23 Lucy Way, Santa Fe, New Mexico.

SUBJECT 2 told SUBJECT 1 to request leave for a trip to Las Vegas, Nevada and go there

for a few days then drive to meet HIM on 2 September 2008. On 21 August 2008,

SUBJECT 1 requested leave from 31 August 2008 to 6 September 2008, to go to Las

Vegas. On 31 August 2008, SUBJECT 1 drove to Las Vegas and spent two nights at the

Royal Dove Hotel and Casino, 147 Paramount Ave, Las Vegas. During this time SUBJECT

1 spent $200 (US) gambling, watched the hotel shows, and spent the rest of HER time in

HER room wondering how the meeting would go with SUBJECT 2. SUBJECT 1 was still

worried that somehow, someone would find everything out.

(X//XX) In the early morning, 2 September 2008, exact time not recalled, SUBJECT 1

drove to Santa Fe and met SUBJECT 2. SUBJECT 1 began to cry and told SUBJECT 2

SHE was sorry it did not work. SUBJECT 2 hugged HER and told HER it was OK and

THEY would find another way to do it. To SUBJECT 1’s surprise, SUBJECT 2 was very

affectionate and steered the conversation toward THEIR relationship and talked about

showing HER around town. From 2 September 2008 to 4 September 2008, SUBJECT 1

and SUBJECT 2 spent the entire time together and continued THEIR romantic relationship.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

E-32

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

ATZS-TPQ-A

8 December 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Espionage

19 May 2008 (X//XX)

ASCCN: 06-902d-357 (U)

SUBJECT 2 said nothing about what HE wanted SUBJECT 1 to do next at work. SUBJECT

2 said not to worry and everything was fine. SUBJECT 2 said it was not SUBJECT 1’s fault.

SUBJECT 2 told SUBJECT 1 HE would contact HER in a few weeks; HE did not give a

specific date. SUBJECT 1 could provide no further pertinent information.

(X//XX) On 15 October 2008, SUBJECT 2 called SUBJECT 1 and told HER HE needed

to go on a trip, but would be back in about a month. SUBJECT 2 told SUBJECT 1 HE loved

HER and HE would call HER as soon as HE returned. SUBJECT 1 asked where SUBJECT

2 would be, but HE did not reply. SUBJECT 2 had not contacted SUBJECT 1 since the 15

October 2008 phone call.

(X//XX) SUBJECT 1 complained at work about not having enough money because SHE

believed SHE should make more money with the computer and networking skills SHE had.

SUBJECT 1 could provide no further pertinent information.

(X//XX) SUBJECT 1 had poor organizational skills at work. SHE worked on a large

number of projects at one time and it was hard to keep up on them all. SUBJECT 1 could

provide no further pertinent information.

(X//XX) SUBJECT 2 told SUBJECT 1 HE was a Cuban Intelligence Service agent and

HE focused on collecting information from US Military personnel and facilities. SUBJECT 1

could provide no further pertinent information.

(X//XX) SUBJECT 1 could provide no pertinent information concerning SUBJECT 2’s

financial matters, work habits, personal conduct, outside activities, foreign considerations,

or emotional/mental/personality disorders.

CLASSIFICATION

Figure E-2. Example of an IMFR—interview (continued)

21 October 2009

FM 2-22.2

E-33

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

ATZS-TPQ-A

22 May 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

INFORMATION CONTAINED IN THIS REPORT WAS OBTAINED FROM

OFFICIAL MILITARY PERSONNEL RECORDS

(X//XX) On 22 May 2008, a review of the Personnel File available at 1st Signal Brigade,

Fort Huachuca, Arizona 86513, provided information regarding Brenda Anne RIVERA, SSG,

123-45-6789, DPOB:

12 March

1976, Pittsburgh, Pennsylvania; SUBJECT

1 of this

investigation. The purpose of this review was to determine previous and current assignments,

security information, special skills, and previous access to special technology or projects. The

checks revealed the following information:

NAME:

RIVERA, Brenda Anne

RANK:

SSG

SSN:

123-45-6789

DPOB:

12 March 1976, Pittsburgh, PA

DERIVED FROM: Sec 2-2, Chapter 2, INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

CLASSIFICATION

Figure E-3. Example of an IMFR—personnel files checks

21 October 2009

FM 2-22.2

E-35

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

ATZS-TPQ-A

15 June 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

9 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

INFORMATION CONTAINED IN THIS REPORT WAS OBTAINED FROM

OFFICIAL GOVERNMENT RECORDS

(X//XX) On 21 May 2008, a review of the Pass and Identification Office files available at

Main Gate, Fort Huachuca, Arizona 86513, provided information regarding Roberto MNU

AMOROS; SUBJECT 2 of this investigation. The purpose of this review was to determine

SUBJECT 2’s identity and reason for being on Fort Huachuca. The checks revealed the

following information:

(X//XX) SUBJECT 2 entered Fort Huachuca on 17 April 2008, 22 May 2008, 19 June

2008. SUBJECT 2 drove the same Cochise Disposal Systems truck every time HE entered

Fort Huachuca. On 17 April 2008, SUBJECT 2 told the civilian security guard at the main

gate HE applied for an Arizona commercial license plate at the Motor Vehicles Division,

Sierra Vista, AZ. SUBJECT 2 had no license plate on the truck.

(X//XX) SUBJECT 2 also told the civilian security guard HE checked into the

Windemere Hotel and Conference Center, Sierra Vista, each time he traveled to Fort

Huachuca.

DERIVED FROM: Sec 2-2, Chapter 2, INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

CLASSIFICATION

Figure E-4. Example of an IMFR—records checks

21 October 2009

FM 2-22.2

E-39

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

ATZS-TPQ-A

10 June 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

INFORMATION CONTAINED IN THIS REPORT WAS OBTAINED FROM

OFFICIAL GOVERNMENT RECORDS

(X//XX) On 10 June 2008, a review of files provide by Theater CI Coordinating Authority

(ATCICA), originating from Detachment 14, Foreign CI Activity, Intelligence and Security

Command, Fort Meade, Maryland, provided information regarding Roberto MNU AMOROS;

SUBJECT 2 of this investigation. The purpose of this review was to determine SUBJECT 2’s

identity and possible connection with foreign entities. The checks revealed the following

information:

(X//XX) SUBJECT 2 was an Intelligence Officer in the Cuban Intelligence Service (CIS)

known as “The Plummer”. CIS used “honey pot” operations against unsuspecting female

subjects. This typically included the CIS officer building a romantic relationship over a long

period of time before revealing their true motive. CIS also preferred to use low-budget, low-

technology intelligence operations, such as pay telephones, secure communications plans,

dead drops, or face-to-face.

DERIVED FROM: Sec 2-2, Chapter 2, INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

CLASSIFICATION

Figure E-5. Example of an IMFR—intelligence files checks

21 October 2009

FM 2-22.2

E-41

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

ATZS-TPQ-A

10 June 2008

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

(X//XX) SUBJECT 2’s prior actions include building relationships with female Soldiers

and civilians who worked on Fort Campbell, Kentucky in 1996. SUBJECT 2 began romantic

relationships with, and elicited unclassified military operational and personnel information

from these individuals. US Army Intelligence discovered these actions in late 1996 but

SUBJECT 2 left the area shortly after, location unknown.

(X//XX) SUBJECT 2’s last known residence was Lot 12, 202 N. Wellspring Drive, New

Horizons Trailer Park, Clarksville, Tennessee. Record Checks indicated SUBJECT 2 rented

a trailer from February 1996 to October 1996 and paid in cash.

(X//XX) AGENT’S NOTES: Agent names and any other personal identifying information are

exempt from release under FOIA exemptions 6 and 7 (5 USC §§552(b)(6) and (b)(7)((c)) and

may not be disclosed in response to FOIA requests for IIRs or other intelligence investigative

documents. John J. Walker, CW4, Operations Officer, 902nd ATCICA Office CONUS, provided

the file for review.

EXHIBIT

JUSTIN J. BLACK

Special Agent

A Co, 307th MI Bn

CLASSIFICATION

Figure E-5. Example of an IMFR—intelligence files checks (continued)

E-42

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

ATZS-TPQ-A

10 June 2008

INVESTIGATIVE MEMORANDUM FOR RECORD

SUBJECT: Fort Huachuca, Arizona

Security Matter (Compromise)

19 May 2008 (X//XX)

LCCN: 06-Team 9-001 (U)

INFORMATION CONTAINED IN THIS REPORT WAS OBTAINED FROM

OFFICIAL PUBLIC RECORDS

(X//XX) On 10 June 2008, a check of the following agencies’ records revealed no

information identifiable with Brenda A. RIVERA, SSG, 123-45-6789; DPOB: 12 March 1976,

Pittsburgh, Pennsylvania; SUBJECT 1 of this investigation. The purpose of this check was to

determine if SUBJECT was ever involved in any criminal activity which would explain HER

suspected involvement with a known Foreign Intelligence Officer.

(U) Sierra Vista Police Department, Sierra Vista, Arizona

(U) Tucson Police Department, Tucson, AZ

(U) Cochise County Sheriff’s Office, Sierra Vista

DERIVED FROM: Sec 2-2, Chapter 2, INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

CLASSIFICATION

Figure E-6. Example of an IMFR—law enforcement records checks

21 October 2009

FM 2-22.2

E-43

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

REPORT OF INVESTIGATION

E-74. The report of investigation (ROI) serves as an executive summary of investigative results reported in

IMFRs and Exhibits. The ACICA processes and forwards investigative and operational records included in

the ROI to the Investigative Records Repository (IRR), Fort Meade, MD. ROIs are required for any

investigation that goes beyond the interview(s) of the original source(s) of information and local and

military agency checks (Standing Investigative Authority).

E-75. The ROI highlights investigative efforts to either confirm or discount espionage indicators or

allegations. The report should be concise, ensuring pertinent results are emphasized. The agent preparing

the ROI cites investigative findings to explain, refute, or support allegations or incidents in which

espionage activity is suspected.

SUSPENSE DATES

E-76. Regulatory Requirements: AR 381-12 mandates that the ROI will be submitted to ACICA within 45

days of the termination of the investigation. ACICA may grant ATCICA an extension, upon request.

E-77. ATCICA Suspense Dates: When the ATCICA terminates an investigation, it will task the appropriate

element to prepare and submit an ROI. In most cases, the suspense for the ROI to reach the ATCICA is

30 days after the termination date. If an investigation involved minimal investigative activity, ATCICA

may issue a shorter suspense for the ROI. If an investigation has been lengthy and contained a significant

amount of investigative activity, ATCICA may extend the suspense for the ROI.

E-78. Transmission of ROI: The ROI and all original signature documentation must be sent through

command channels and received by ATCICA before the assigned suspense. Regardless of the electronic

medium used, the ROI and all administrative documents pertaining to the ROI (for example, exhibit cover

sheets and multiple source classification listings) must be included.

E-79. ROI Review and Approval Process: The ATCICA will review the ROI and forward the ROI to the

ATCICA. The ATCICA reviews the ROI and coordinates with the ATCICA to resolve any discrepancies or

problems with the document. The ATCICA will publish a message closing the investigation and retire the

ROI to the intelligence records repository.

E-80. Interim ROIs: Interim ROIs are required when a case is being transferred from one office to another

or from one ATCICA’s AOR to another ATCICA’s AOR.

INITIATING THE REPORT OF INVESTIGATION

E-81. Once an investigation is opened and a lead investigative element is assigned, the lead investigating

element will begin drafting the ROI. The administrative portions of the ROI will be prepared once the

investigating unit receives the ATCICA opening message.

E-82. Each time an investigative action takes place and an IMFR completed, the lead agent will prepare an

ROI entry summarizing the action and its implications for the case. This ROI-in-progress can serve as a

running case status report and drastically reduce the amount of time required to complete the ROI upon

case termination.

E-83. By writing the ROI as the investigation progresses, instead of writing it at the conclusion of the case,

the lead agent will save time and effort since more than three quarters of the work on the ROI will be

completed by the time the investigation is terminated. When the investigation is terminated, the lead agent

will only review and consolidate investigative actions as required, fine tune the report, attach original

signature documents, and forward the ROI through command channels to the ATCICA.

21 October 2009

FM 2-22.2

E-45

FOR OFFICIAL USE ONLY

Appendix E

FORMAT

E-84. The ROI is prepared using a standardized format on letterhead stationary from the lead investigative

unit. The required print style is letter quality, Courier New font, 12 pitch font size. Use normal margins on

continuation pages with the page sequential numbers centered at the bottom of each continuation page. If

additional pages are required, use plain bond paper.

E-85. Administrative heading. The administrative heading consists of the lead investigative element’s

office symbol, the date prepared

(the completed ROI) and the type of report. At the top of each

continuation page, place the office symbol on the top line, left margin, and the date prepared at the right

margin. On the second line, place the ACICA CCN.

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

IAMG-A-A

25 November 2004

REPORT OF INVESTIGATION

CLASSIFICATION

IAMG-A-A

25 November 2004

ACICA CCN: 05-5555-902 (U)

E-86. Paragraph 1, administrative data. Paragraph 1 of the ROI consists of the administrative data,

which can usually be extracted from the CI incident report and the ACICA response. Paragraph 1 of the

ROI consists of the investigation title and the ACICA CCN (as reflected on the ACICA opening message),

command investigating the incident, control office, date opened, date closed (left blank), the reason for

investigation and the case status (terminated, transferred or suspended). The second example below is for

identifying the reason the investigation was initiated.

(X) ADMINISTRATIVE DATA:

TITLE:

SMITH, John D.

ACICA CCN:

05-5555-902

CPT, 123-45-6789

15 June 1973, Omaha, NE

INVESTIGATING UNIT: 902d MI Group

CONTROL OFFICE: ATCICA

DATE OPENED: 4 October 2004

DATE CLOSED:

REASON FOR INVESTIGATION: To determine if CPT John D. SMITH engaged in espionage on behalf of an FISS

and ITO or a foreign government as indicated by HIS unreported continuing contact with foreign military officers and

HIS unauthorized removal of classified documents from a secured area.

CASE STATUS: Terminated

E-46

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

To determine if Ann B. AAAAA engaged in espionage on behalf of a foreign intelligence service or a foreign

government, as indicated by HER alleged impersonation of a MI special agent.

To determine if Michael C. BBBBB engaged in espionage on behalf of a foreign intelligence service or a foreign

government, as indicated by HIS failure to complete a CI Scope Polygraph Examination.

To determine if David D. CCCCC had unauthorized contact with a representative of a foreign intelligence service or a

foreign government or compromised classified defense information while Absent Without Leave.

To determine if the circumstances surrounding the suicide of Fanny O. DDDDD indicated HER involvement in

espionage activity on behalf of a foreign intelligence service or a foreign government.

To determine if Bartholomew O.J. EEEEE III committed a Communications Security (COMSEC) violation under the

direction of a foreign intelligence service or a foreign government.

To determine if Jane K. FFFFF had an unauthorized contact with a representative of a foreign intelligence service or a

foreign government for the purposes of espionage activity.

E-87. Paragraph 2, synopsis. Paragraph 2 contains a summary of the investigative results reported in the

IMFR. It is a concise summary of the elements of an investigation. The ROI should address the basic

interrogatives, which were answered during the progress of the investigation concerning the SUBJECT and

the incident. In the case of CI scope polygraph examination (CSPE) investigations, this subparagraph will

contain a synopsis of the information provided by the polygraph packet and the ATCICA opening

memorandum.

E-88. Privacy Act Caveats. The first entry of Paragraph 2 preceding subparagraph a will be all appropriate

Privacy Act caveats, which may restrict the release of the investigative information. List all appropriate

caveats between the paragraph heading and the narrative. Capitalize and center the listed caveats. The ROI

will list a caveat when the information was obtained from—

Financial Institutions (AR 190-6).

Electronic Surveillance (AR 381-10, chapter 5).

Source Requesting Confidentiality.

A governmental agency which requires consent for the release of its information.

(U) SYNOPSIS:

SOURCE WAS GIVEN AN EXPRESSED PROMISE OF CONFIDENTIALITY

AS A CONDITION OF PROVIDING INFORMATION IN THIS REPORT

INFORMATION CONTAINED IN THIS REPORT WAS OBTAINED FROM A

FEDERAL AGENCY, WHO RESERVES THE RIGHT TO RESTRICT RELEASE

INFORMATION CONTAINED IN THIS REPORT IS FINANCIAL RECORD INFORMATION, WHICH WAS OBTAINED

PURSUANT TO THE RIGHT OF FINANCIAL PRIVACY ACT OF 1978, 12 USC 3401 (ET SEQ.). THIS

INFORMATION MAY NOT BE RELEASED TO ANOTHER FEDERAL AGENCY OR DEPARTMENT OUTSIDE THE

DOD WITHOUT COMPLIANCE WITH THE SPECIFIC REQUIREMENTS OF 12 USC 3412 AND AR 190-6

E-89. First subparagraph. The first subparagraph of paragraph 2 contains the essence of the information

reported in the CI incident report. It contains the date the information was reported, identification of the

source, full identification of the SUBJECT, unit of assignment, and an outline of the allegations upon

which the investigation was predicated. Identifying data for all subjects will include Name, rank, SSN,

DPOB, duty position, name of unit or organization and location of unit. Other persons involved in the

investigation (for example, source, witnesses, co-workers) will be identified only by their full name and

relationship to the investigation (for example, source, SUBJECT’s neighbor, co-worker). Any reference to

SUBJECT or SUBJECT’s last name will be typed in capital letters. This paragraph must also contain a

statement as to when ATCICA opened the case.

21 October 2009

FM 2-22.2

E-47

FOR OFFICIAL USE ONLY

Appendix E

(X) This investigation was predicated on the 2 October 2004, report that under a promise of confidentiality David L.

Roth, SPC, reported that John David SMITH, CPT, 123-45-6789, DPOB: 15 June 1973, Omaha, NE; 35E, Security

Officer, Headquarters and Headquarters Company (HHC), 3rd Battalion, 28th Infantry Regiment, Fort Riley, KS,

hereinafter referred to as SUBJECT, removed classified information from the safe located in the S-2 of 3/28 INF BN

headquarters building, placed the information in HIS coat pocket and departed the building. SUBJECT often told

source about HIS new girlfriend and commented that HE would like to learn Russian so that HE would be able to

communicate with her better. On 4 October 2004, ATCICA opened this investigation. (1,2, Exhibit I)

E-90. IMFR/Exhibit numbering. This and subsequent subparagraphs referring to investigative results

reported in the IMFRS and supported by the exhibits will reference the appropriate documentation from

which the information was extracted for synopsis at the end of the subparagraph. An Arabic numeral in

parentheses references IMFRs at the end of each summary paragraph, and exhibits are referenced by

Roman numerals. Do not place the numerals on the reports or exhibits until the ROI is complete. Then, IN

PENCIL, write the numerals on the bottom right of the first page of the IMFRs and on the bottom center of

the exhibit cover sheet. This first subparagraph must summarize the CI incident report and ATCICA

opening message. In the case of a CSPE investigation, the ATCICA memorandum will act as the reference.

E-91. Subsequent subparagraphs will synopsize the investigative actions conducted to support, refute, or

mitigate the information reported in the CI incident report. Similar investigative actions with similar results

may be summarized in the same subparagraph. The subparagraphs of the ROI should follow the logical

flow of the case’s development. This does not mean to always set a chronological pattern of events. List

IMFRS and Exhibits to flow sequentially.

(X) From 5 October 2004 to 15 October 2004, interviews of SUBJECT’s co-workers and supervisors provide

background and personal information concerning SUBJECT, but nothing pertinent to this investigation. (2-5)

(X) On 15 October 2004, Robert R. Truit, SUBJECT’s neighbor, provided that SUBJECT frequently traveled to

Canada on fishing trips. SUBJECT was an avid fisherman. (6, Exhibit II)

(X) On 17 October 2004, Jerry P. Jones, SUBJECT’s co-worker, provided that SUBJECT used illegal drugs on a

weekly basis. Jones witnessed SUBJECT take office manuals to HIS automobile. (7, Exhibit III)

(X) From 5 October 2004 to 20 October 2004, civilian and military law enforcement, credit bureau, finance,

personnel, and security records provided assignment data, allotment and financial information, but no derogatory

information concerning SUBJECT. (8-11)

E-92. Significant results. Interviews resulting in significant information will be identified in a separate

subparagraph for each interview. Interviews not resulting in significant information will be included in one

subparagraph for all similar interviews. This ensures significant interviews stand out to the reader. When an

interview includes a Rights Warning, include a statement in the ROI that individuals read and waived or

invoked their legal rights.

E-93. Paragraph 3, case status. Paragraph 3 indicates the case status and complements information

provided in the first paragraph of the ROI. The closing paragraph briefly addresses the investigative results

as they pertain to the allegations listed in the opening paragraph. This paragraph will also list actions taken

to neutralize any threat, such as revocation of security clearance or prosecution. In the case of interim

ROIs, explain the reason for the interim ROI and the basis for continuing the investigation. This paragraph

should synopsize any supporting, mitigating, or exculpatory information obtained during the course of the

investigation. For example, “The loss of COMSEC material was due to inadvertent destruction” or “The

security container had an inoperable locking mechanism which could not be attributed to foul play initiated

by a foreign intelligence and security systems (FISS) and international terrorist organizations (ITO).”

Computer network incident investigations may need more of an explanation concerning the investigative

findings. Recommendations, reviewer’s opinions, or conclusions deemed appropriate will be noted in the

letter of transmittal accompanying the ROI. NO such comments will be included within the ROI.

E-48

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

(X) CASE TERMINATED: This investigation did not disclose any indication of espionage activity. John Q. PUBLIC

is a certified collector of law enforcement badges and has not falsely identified HIMSELF for any illegal purposes or

personal gain.

(X) CASE TERMINATED: This investigation did not disclose any indication of espionage activity. John Q. PUBLIC

considered the polygraph examination program to be an infringement on HIS right to personal privacy. PUBLIC

resigned from HIS position with the Army and no longer has any access to U.S. defense information.

(X) CASE TERMINATED: This investigation did not reveal any indication of a foreign intelligence service

involvement or evidence of a security compromise committed by John Q. PUBLIC during HIS AWOL period. PUBLIC

believed HIS commander was preparing to give HIM an Article 15 for being late to work on several occasions.

(X) CASE TERMINATED: This investigation did not disclose any indication of espionage activity. John Q. PUBLIC’s

suicide was incidental to HIS being jilted by HIS lover.

(X) CASE TERMINATED: This investigation did not disclose any indication of espionage activity. John Q. PUBLIC

was unaware of others who had access to HIS safe. ATCICA referred this matter to SUBJECT’s command for their

action.

(X) CASE TERMINATED: This investigation determined that John Q. PUBLIC is a U.S. citizen not affiliated with the

Department of Defense. ATCICA referred this matter to the Federal Bureau of Investigation for their action.

(X) CASE TERMINATED: This investigation did not determine that John Q. PUBLIC engaged in espionage activity

on behalf of a FISS and ITO. Under the special authority of the Security Office, PUBLIC is authorized to transport

defense information from HIS office to other U.S. Government buildings located on the other side of town.

E-94. Paragraph 4, preparer. Paragraph 4 identifies the preparer of the ROI.

(U) ROI prepared by: Special Agent Jane A. Quigley, A Company, XXXth Military Intelligence Battalion, 902d MI

Group, City, State, Zip Code.

E-95. Enclosure list. The enclosure list is placed at the left margin on the same line as the signature block.

List the total number of IMFRs and exhibits.

Note. The following documents are NOT included with the ROI: Privacy Act Statements,

Secrecy Affirmations, Non-Disclosure Statements, tasking messages, case control sheets, IPs,

internal or administrative documents such as telephone memoranda, and planning documents.

DO NOT place them as exhibits to IMFRs.

E-96. Signature block. The last entry on the ROI will be the signature block of the approving authority.

All ROIs will be reviewed by the ATCICA for investigative sufficiency and adherence to ROI guidelines.

The lead agent’s company commander will sign the ROI.

Encl

JOHN B. JONES

16 IMFRs

CPT, MI

7 Exhibits

Commanding

E-97. Unlisted attachments. The requirement for separate unlisted attachments, and the accompanying

cover memorandum, no longer exists. Actions which were not strictly investigative in nature but which

influenced the course of the investigation were previously documented as unlisted attachments; these

actions will now be addressed in the actual ROI. Supporting documentation, which would have previously

been handled as unlisted attachments, will now be attached and counted in the same manner as IMFRs.

Affected documentation includes, but is not limited to—

Approvals for Special Collection Techniques.

ACIC Analytical Reports (for example, Link Analysis).

Administrative messages that change the number of subjects or the name(s) of the

SUBJECT(S), or that change an impersonal subject block to a personal one.

CI special operations concept (CISOC) approvals.

21 October 2009

FM 2-22.2

E-49

FOR OFFICIAL USE ONLY

Appendix E

Federal Bureau of Investigation (FBI) Memorandums.

SOI and responses to other SOIs from other agencies or commands.

CLASSIFICATION OF THE REPORT OF INVESTIGATION

E-98. Marking. Mark all paragraphs and subparagraphs in accordance with AR 380-5. Classify all

subparagraphs based on content. Avoid over classification.

Note. Most record checks and interviews contain little or no actual classified information.

Because of this fact, the ACICA generally declassifies all ROIs.

E-99. Classification authority. Carefully review the following references to determine which

classification authority must be cited:

AR 381-12.

AR 381-47.

INSCOM SCG 380-2.

Supported unit classification guides/Special Access Program (SAP) classification guides.

E-100. Place the classification authority and the declassification instructions at the bottom of the first

page. An example is shown below.

DERIVED FROM: Sec 2-2, Chapter 2

INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

E-101. Caveats. Use information-handling caveats as necessary on the ROI and in appropriate

paragraphs. Mark all IMFRs, exhibit cover sheets, and exhibits with the appropriate classification. Apply

common sense and familiarize all agents with current classification guidance. MULTIPLE SOURCES in

the CLASSIFIED BY line should be listed individually at the bottom of page 1, unless there are so many

that this becomes impractical. In such an event, a separate listing of the sources and their declassification

instructions should be attached on a separate page.

Note. Bear in mind that most exhibits are NOT classified.

E-102. Exhibits. Ensure each exhibit has a completed exhibit cover sheet to accompany the exhibit.

Double-check all classification markings (if needed). IMFRs written because of a polygraph examination

that occurred as part of the investigation will report the findings of the examination and any critical

comments as they pertain to the case. The DA Forms 2802 (Polygraph Examination Report) will not be

attached as an exhibit.

REPORT OF INVESTIGATION LETTERS OF TRANSMITTAL

E-103. The ROI Letter of Transmittal prepared on appropriate letterhead will be signed by the Battalion

Commander and addressed as shown in figure E-7. Figure E-8 (page E-52) provides an example of an ROI.

E-50

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

DEPARTMENT OF THE ARMY

Headquarters, Organization’s Official Letterhead

Installation, State Zip

IAMG-B-DT (381-20p)

21 AUGUST 2005

REPORT OF INVESTIGATION

(X) ADMINISTRATIVE DATA:

TITLE: JONES, John L.SPC, 000-00-0000

ACICA CCN: PI-BDT

03-019

DPOB: 20 Nov 82, Cleveland, OH

INVESTIGATING UNIT: 902D MI Group

CONTROL OFFICE: ATCICA

DATE OPENED: 25 April 2005

DATE CLOSED:

REASON FOR INVESTIGATION: To determine if John L. JONES compromised classified

information, and if the compromise involved espionage on behalf of a FISS and ITO entity.

CASE STATUS: Terminated

(U) SYNOPSIS:

SOURCE HAD NO OBJECTION TO HER NAME BEING RELEASED TO SUBJECT

INFORMATION CONTAINED IN THIS REPORT WAS OBTAINED FROM OFFICIAL

GOVERNMENT RECORDS

DERIVED FROM: Sec 2-2, CH 2, INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

CLASSIFICATION

Figure E-8. Example of an ROI

E-52

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

CLASSIFICATION

IAMG-B-DT (381-20p)

21 AUGUST 2005

ACICA CCN: PI-BDT-03-019

THIS REPORT CONTAINS THIRD AGENCY INFORMATION WHICH WILL NOT BE

DISSEMINATED WITHOUT PRIOR APPROVAL.

(X) In March 2005, SUBJECT may have removed a CD ROM containing classified

information from HIS Reserve Unit, and placed the information on HIS home computer.

Source, Karen R. Nesbith, SUBJECT’s spouse at the time of the incident, reported that

SUBJECT had a CD ROM in a tool box which HE had brought home from HIS reserve unit.

Neither the plastic case in which the CD ROM was stored, nor the CD, contained any

markings. When source asked SUBJECT about the CD ROM, HE indicated it was a

government CD. Later that day SUBJECT became concerned as to the contents of the CD

and inserted it into HIS computer. Source recalled seeing an eagle and some words in

black near the bottom of the screen, but could not recall any of the words. Initially, She

reported that the screen showed TOP SECRET markings on it, but then changed Her

recollection to “classified,” and then said it had some kind of markings indicating “not just

anybody was allowed to access” the CD. (1, EXHIBIT I)

(U) On 15 May 2005 the Army CI Coordinating Authority conducted checks of the

Defense Eligibility Dependent System and the Defense Clearance and Investigations Index.

The Defense Clearance and Investigations Index check showed no record for SUBJECT.

(2, 3)

(X) On 15 May 2005, interviews of personnel at SUBJECT’s reserve unit revealed that

SUBJECT did not display any CI indicators, the unit did not have any classified information

on a CD ROM, and SUBJECT did not have access to classified information. Additionally, in

approximately March-April 2005 timeframe, SUBJECT had quit attending weekend drills

and the unit submitted paperwork to process SUBJECT out of the reserve program. (4)

CLASSIFICATION

Figure E-8. Example of an ROI (continued)

21 October 2009

FM 2-22.2

E-53

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

(X) During May-June 2005, the Cleveland, OH Federal Bureau of Investigation (FBI)

office attempted to locate SUBJECT to conduct a joint FBI/US Army Intelligence interview.

However, all efforts to locate SUBJECT were unsuccessful. ACICA suspended the

investigation on July 5, 2003. On 1 August 2005, the FBI located SUBJECT and conducted

an interview. SUBJECT denied any access to or compromise of classified information.

SUBJECT, who was in a failing marriage, told source the CD Rom contained classified

information; HE thought that would make HIM look important, and source would want to

stay married to HIM. (5)

(X) CASE TERMINATED: This preliminary inquiry did not reveal any evidence of a security

compromise, or espionage involvement by SUBJECT.

(U) ROI prepared by Special Agent Bill Bonn, A Company, 308th MI Battalion, 902d MI

Group, Detroit Resident Office, Warren, MI 48397.

Encl

JAMES J. MONK

5 IMFRs

CPT, MI

1. Exhibit

Commanding

CLASSIFICATION

Figure E-8. Example of an ROI (continued)

E-54

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

SUMMARY OF INFORMATION

E-104. Figure E-9 is an example of an SOI.

CLASSIFICATION

DEPARTMENT OF THE ARMY

_________________ Field Office

307th Military Intelligence Battalion

Fort Huachuca, Arizona 85613-7002

March 28, 1999

Special Agent David L. Bowie

Federal Bureau of Investigation Legal Attaché

Dear Special Agent Bowie:

Enclosed is a two-page Summary of Information (SOI), regarding an incident on a US

Military Training Mission installation involving a foreign military officer.

Because the foreign national identified in the SOI is not subject to the investigative jurisdiction

of US Army Intelligence, the details of the referenced incident are forwarded to your agency for

any investigative action you deem appropriate.

This organization is willing to assist your agency (consistent with applicable regulations) in

any inquiry/investigation you undertake, regarding this incident/individual, upon your request.

Point of contact is Special Agent William Raven, DSN 318-438-5555.

Sincerely,

Enclosure

WYATT B. ERPP

Special Agent in Charge

____________Field Office

DERIVED FROM: Sec 2-2, Chapter 2, INSCOM SCG 380-2

DECLASSIFY ON: Source Marked X1

DATE OF SOURCE: 2 DEC 96

CLASSIFICATION

Figure E-9. Example of an SOI

21 October 2009

FM 2-22.2

E-55

FOR OFFICIAL USE ONLY

Appendix E

CLASSIFICATION

SUMMARY OF INFORMATION

PREPARING OFFICE: _________________, 307th Military Intelligence Brigade

DATE PREPARED: 28 March 1999

SUBJECT: SCHMIDT, Helmut

CPT, German Army

DPOB: 3 May 1960, Suhl, GE (X//XX)

ACICA CCN: 98-0500-513

SOURCE WAS GIVEN AN EXPRESS PROMISE OF CONFIDENTIALITY AS A CONDITION FOR

PROVIDING THE INFORMATION IN THIS SUMMARY.

(X//XX) On 26 March 1999, a confidential source reported the following information regarding

Helmut SCHMIDT, CPT, DPOB: 30 November 1980, Berlin, Germany, Missile Leader, German

Defense Forces hereinafter referred to as SUBJECT, who was an exchange officer at the HAWK

Missile Repair Course, US Military Training Mission, Riyadh, Saudi Arabia:

(X//XX) On 25 March 1999, during a break outside the classroom, SUBJECT was overheard

asking an unidentified US Army Captain for information regarding the US Army Brilliant Anti-Armor

Sub-Munition. When the US Army Captain responded that Brilliant Antiwar Technology (BAT)

information was not authorized for release to foreign military personnel, SUBJECT stated that HIS

government would be willing to pay for information.

(X//XX) Source recalled that on 23 March 1999, He observed SUBJECT placing what

appeared to be US defense contractor BAT advertisement brochures into HIS notebook. The

brochures were not classified.

(X//XX) A check with the Command Security Manager and the Command Foreign Disclosure

Officer disclosed that the BAT contains US Army missile technology classified SECRET and that the

BAT is not approved for sale or transfer to any foreign country. The check also disclosed that no

foreign personnel are accredited to the BAT program. The prime contractor for the BAT is XYZ

Corporation, 1000 Memorial Parkway, Huntsville, Alabama.

(FOUO) A check with the US Commander of Military Training Mission Riyadh, confirmed

SUBJECT’s student status at the HAWK Missile Repair Course. SUBJECT has been assigned to

Military Training Mission since 5 January 1999, and is scheduled to depart Riyadh on 15 April 1999,

upon graduation from the course.

(U) A check of the local US Army CI cross-reference database disclosed no information regarding

SUBJECT.

(X//XX) The source of information is Smith, Don; CPT; 425-12-1111; DPOB: 14 January 2007,

Tucson, Arizona; Liaison Officer, US Military Training Mission, Riyadh, Saudi Arabia.

WYATT B. ERPP

Special Agent in Charge

__________ Field Office

CLASSIFICATION

Figure E-9. Example of an SOI (continued)

E-56

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-105. The Privacy Act of 1974 advisement statement is shown in figure E-10.

PRIVACY ACT OF 1974

ADVISEMENT STATEMENT

United States Army Intelligence is conducting an investigation of a CI matter pursuant to Army

Regulations, which necessitates obtaining personal information from you. The Privacy Act of

1974 requires that each individual asked to provide personal information be advised of the

following four points:

a. AUTHORITY: The Department of the Army is authorized to conduct CI investigations

under EO 10450, “Security Requirements for Government Employees,” EO 12333 “United

States Intelligence Activities,” and Title 10 of USC § 3012.

b. PRINCIPAL PURPOSES: This investigation is being conducted by the Army to permit

responsible official(s) to determine the nature and extent of action, if any, necessary to

ensure the security of the Army. The principle objectives in collecting this information are:

(1) To acquire factual information and/or evidence pertinent to the matter under

investigation.

(2) To determine facts concerning possible compromise of US National Defense

information.

c. ROUTINE USES: The information obtained from you will become part of Army records and

will be provided to those officials responsible for the security of the Army. The information

may, at Army initiative or upon request, be furnished to accredited Department of Defense

activities, other Federal agencies, and/or to LEAs for their official use. Under certain

circumstances, pursuant to applicable international agreements, the information may be

provided to security and/or law enforcement officials of a foreign government.

d. VOLUNTARY OR MANDATORY NATURE OF DISCLOSURE: The disclosure of personal

information is voluntary. However, failure to disclose necessary and relevant information

which impedes the investigation may have an adverse impact on your security clearance, if

you possess one, or are being considered for one, or your employment, if you are a military

member or employee of the Department of the Army.

____________________________

(Date)

(Signature)

Figure E-10. Privacy Act of 1974 advisement statement

21 October 2009

FM 2-22.2

E-57

FOR OFFICIAL USE ONLY

Counterintelligence Investigative Report Writing Guide

E-107. The secrecy affirmation statement is shown in figure E-12.

SECRECY AFFIRMATION STATEMENT

WARNING NOTICE: SENSITIVE SOURCES OR METHODS INVOLVED

______________________________________________, hereby affirm I have been

informed that

(Insert source’s First name, Middle initial and Last name)

disclosure of the nature, source(s), or the existence of the CI activity in which I am involved or

of which I have knowledge is prohibited without the expressed approval of US Army

Intelligence. I further certify that I have been briefed on my security responsibilities for the

information which we have discussed, and that any unauthorized disclosure by me of any

information imparted to me or otherwise acquired by me regarding this CI activity will be

considered in violation of the Uniform Code of Military Justice and/or the US Espionage Laws

as defined in Chapter 37, Title 18 of the US Code.

______________________________

DATE (day/month/year)

SIGNATURE

______________________________

Printed Name of Witness

Signature of Witness

WARNING NOTICE: SENSITIVE SOURCES OR METHODS INVOLVED

Figure E-12. Secrecy affirmation statement

21 October 2009

FM 2-22.2

E-59

FOR OFFICIAL USE ONLY

Appendix F

Predeployment and Mission Planning

This appendix addresses predeployment actions the counterintelligence (CI) leader

must take to prepare for deployment. CI leaders must anticipate, identify, consider,

and evaluate all potential threats. They must take advantage of enhanced information

flow through hierarchical and nonhierarchical networks (computer, communications,

and personnel). CI leaders need to be involved with the operational planning and

orders production to ensure CI assets are employed early and utilized properly.

Success as a leader rests upon being prepared for the mission. The guidelines in this

appendix will help the team leader develop a focused preparation plan.

MISSION ANALYSIS

F-1. Mission analysis should be the first and most important step. Mission analysis begins upon

notification and continues until departure. Good analysis ensures the right personnel and equipment deploy.

The parent and supported units will do much of the mission analysis. CI leaders should obtain a copy of

mission analysis products from higher echelons before starting their own analysis. They should ensure they

have an understanding of the tasks to be performed, the purpose behind accomplishing those tasks, the

supported commander’s intent, and any restraints placed on your element.

F-2. This information will come in the operation order (OPORD) from the parent or supported unit

operations officer

(S-3) or, if the mission is already established, through coordination with the unit

currently in theater. The notification of any deployment and the readiness status of the deploying element

dictate the time line. But if time permits, CI leaders should—

Update threat databases.

Review available databases on assigned contingency areas.

Review, update, and/or develop intelligence preparation of the battlefield (IPB) products.

F-3. During the predeployment phase a CI team can obtain mission background by accessing the Secure

Internet Protocol Router Network (SIPRNET). Most operations have an established site where information

can be pulled down and questions can be asked. A well-established operation will have more information

available. Information on initial entry situations will be more difficult to find and may have to be

researched. The following are some types of information that should be collected and analyzed before a

unit deploys:

Country studies. Country studies will provide background on the country and people. This

document will give you a better understanding of the environment. The CI team needs to look

for a country study that presents both the historical and current situation. This will tell the

team how far the country has fallen and will provide insight into dealings with the people.

Road to war. The Road to War will focus on what led up to the conflict and the conflict

itself. Knowing the reasons behind the conflict is important to understanding the people and

interacting with them.

21 October 2009

FM 2-22.2

F-1

FOR OFFICIAL USE ONLY

Appendix F

Current reporting. Current CI reporting will focus the team on what is currently happening

in country, establish what the collection priorities are, and give the team examples of how to

write their reports.

Standing operating procedures (SOPs). The unit’s tactical standing operating procedures

will further define the mission, equipment, and team requirements. All SOPs vary and when

the team deploys it might not use its own SOP. For this reason, the team should conduct a

review of the supported unit’s SOP to ensure compliance.

PREDEPLOYMENT CONSIDERATIONS

F-4. Predeployment integration planning. CI operational activities should be integrated into established

unit and higher echelon or headquarters operation plans (OPLANs). This integration should include

information and reporting architectures, technical control and oversight for subordinate teams,

responsibilities and function of operational management elements (staff2X, CI Coordinating Authority

[CICA] and operational management teams [OMTs]), and financial management annexes for any source

operations; for example, source operations and host country liaison.

F-5. Information exchange. Continuous contact with theater CI elements to facilitate information

exchange will allow the CI team and operational management elements to become knowledgeable

concerning the operational environment, previous reporting, current operational procedures, personalities,

host-nation (HN) capabilities, and cultural nuances that CI elements will be required to understand to

successfully operate and support the commander.

F-6. Establish standing operating procedures. The CI team should have pre-established plans and SOPs

which vary according to the type of military operation.

F-7. Operational integration. Operational coordination and the covering agent program (CAP) to

conduct liaison with supported units during predeployment exercises is vital. Liaison must be conducted

with commanders, S-2s, administrative support personnel, logistical support personnel, communications

personnel, and others. CI teams supporting specific units should obtain their supported unit’s briefing slide

formats, unit SOPs, and ensure all team members are aware of the procedures governing CI interface. This

will allow the CI team to integrate into the supported unit’s pre-mission planning and build trust and

confidence with the supported command by exhibiting a habitual relationship between the supported unit’s

mission and the CI team. CI leaders should—

Conduct liaison and coordination meetings

(predeployment through redeployment) with

representatives from other law enforcement, security and intelligence Army, Department of

Defense (DOD), and U.S. national agencies essential to developing an all-source picture and

to identify information gaps that may be satisfied by the CI team.

Conduct 24-hour operations: automation, communications capacity, and personnel necessary

to provide continuous intelligence information collection and requirements management,

processing, and reporting.

Plan and coordinate for linguistic support.

Develop and forward requests for information (RFIs) to higher headquarters in accordance

with SOPs to obtain all information required to complete predeployment and operational

planning.

Ensure that team data processing equipment is interoperable with the supported unit’s

network structure and appropriate interfaces are available.

Ensure the CI team and operational management elements are integrated with supported unit

exercises and mission readiness rehearsals to validate CI deployment information and

reporting architectures, SOPs, load plans, and packing lists.

F-2

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Predeployment and Mission Planning

F-8. Joint operations environment. Organizations like the Strategic CI Detachment

(SCID) in

Multinational Force-Iraq (MNF-I) and Combined Forces Command-Afghanistan (CFC-A) will be more

common and will reside on the joint manning document. Each service requires its CI personnel to follow

the service-specific procedures even when working in a joint environment. Each service has a different way

of doing things and varying degrees of restrictions, with the Army being the most restrictive.

F-9. Freedom of movement. CI teams work best in single vehicles or pairs rather than large vehicle

convoys when the threat level is high. A low profile patrol is preferable to a show of force. Vehicles should

have no markings, which can serve to identify the teams as MI (for example, bumper markings). The

commander may approve the modification of MI unit vehicles to reflect that of the supported command.

Likewise, the commander may agree to change the unit shoulder patch of the supporting MI Soldiers to that

of the supported command. The 2X should pursue such initiatives.

F-10. External CI teams. Commanders will often see or hear of CI entities working in their area of

operations (AO), which are not under their direct command. The tendency is for commanders to insist on

either their removal or their assurance that they report to local commanders before operating in the area.

These teams will be collecting for other agencies and formations and will therefore have different SOPs or

priority intelligence requirements

(PIRs). It will usually be unacceptable for reasons of security or

unworkable for teams to check in every time they enter the AO. Commanders must accept that these teams

or individuals cannot be controlled by subordinate commanders. Deconfliction, command, control, and

communications (C3), cooperation, patience, and understanding all play an important part in resolving

these situations. The 2X is the key to diffusing and resolving such situations.

F-11. Protection and operational risk mitigation. Commanders must weigh risk versus gain when

considering protection measures for CI. Commanders may approve lower protection measures for teams on

a case-by-case basis. Experience has shown that in non-hostile environments teams will be more successful

when dressed in minimal protective equipment and unencumbered by crew-served weapons and rifles. In

some situations, “dressing down” without badges of rank, unit designation, and ballistic protection will

enhance operators’ ability to gain rapport with sources rather than to intimidate them. Collectors will

attempt, where possible, to appear the same as their maneuver colleagues. However, due to the very nature

of their role, they may often appear to operate in very different ways.

F-12. Communications. Where possible, all teams should be in regular communications with their parent

operations room or task force tactical operations center (TOC). However, recent operations have shown

that this is not always practical nor possible. Tactical satellite radios have assisted in some cases; however,

where this system is not available, commanders and staff must again weigh risk versus gain.

F-13. Curfews and prohibited activities. Frequently, teams will need to take part in activities prohibited

to other Soldiers (for example, consumption of alcohol, remaining out past curfew, working in civilian

clothes). Such exceptions must be used with discretion and approved, in advance, by the C/J/G/S-2 or 2X

and appropriate commander.

F-14. Incentive program. Teams will have discretionary funds and incentive items to reimburse or entice

sources and contacts. These items are subject to strict command discipline and accounting.

F-15. Accommodations. Mission requirements and operations tempo of the CI team should be considered

when identifying a location for team operations and billeting. The optimal accommodations for a CI team

within a compound are to be billeted in the same building or tent as their base of operations. This

accommodation will allow the team leader to effectively execute mission requirements and develop an

adequate sleep plan.

F-16. Base of operations considerations. Operations security OPSEC should be paramount when

identifying a location for CI team base of operations. The CI team will routinely bring local national

civilians onto the compound or base camp during the conduct of overt and discreet source operations, and

to screen local civilians who are seeking employment. These operations dictate the need to locate the base

of operations in an area of the compound that will reduce the local national civilian’s ability to view

21 October 2009

FM 2-22.2

F-3

FOR OFFICIAL USE ONLY

Appendix F

equipment, personnel, and activities. Additionally, discreet source operations require the base of operations

to be located in an area conducive to the quick and discreet movement of sources on and off the compound.

F-17. Billeting considerations. The ability to billet the entire CI team together will produce a cohesive

team, able to respond quickly to time-sensitive tasking during all hours. Additionally, CI operations are

fluid in their execution and require team members to work unusual and unscheduled hours. Thus, the sleep

plan and impact upon non-CI Soldiers are two critical considerations in billeting arrangements.

APPENDIX 3 (COUNTERINTELLIGENCE) TO ANNEX B

(INTELLIGENCE) TO OPERATION ORDER

F-18. The intelligence staff prepares the intelligence annex of the operation order (OPORD). Annex B

(Intelligence) of the OPORD, implements the command’s intelligence plan. Each organization within the

division uses the annex to understand how that the intelligence effort supports its operation. Appendix 3

(Counterintelligence) is the counterintelligence section Annex B (Intelligence). Figure F-1 is Appendix 3

(Counterintelligence) to Annex B (Intelligence) to an OPORD.

APPENDIX 3 (COUNTERINTELLIGENCE) TO ANNEX B (INTELLIGENCE)

1. MISSION:

Identify the scope of the CI mission and the objectives associated with the conduct of those

missions. For example, 519^th MI BN CI Teams will conduct CI Force Protection Source

Operations (CFSO) to identify, counter, neutralize, or exploit the foreign intelligence and

security services

(FISS) and international terrorist organizations

(ITO) intelligence threat

targeting U.S./coalition forces. The 519th MI Battalion CI teams will conduct locally employed

persons (LEPs) screening to asses host nation, indigenous, or third-country national persons

for suitability to work for and have access to U.S. installations and facilities and identify

potential threats to U.S./coalition forces. The mission statement should include all aspects of

the CI mission; however, they should be discussed in broad supporting terms. Individual

missions

(for example, CFSO, LEP Screening, CI Investigations) should be detailed in

separate Tabs supporting this appendix.

2. SITUATION:

a. FISS and ITO. Identify all known or suspected FISS and ITO elements within the CI

element’s area of intelligence responsibility (area of intelligence responsibility). This should

include a summary of information on their capabilities, affiliations with other FISS and ITO

entities, key personalities, methods of operation, and targeting focus b. Friendly. Identify all

Army, DOD service, U.S. and coalition agencies and elements with the CI element’s area of

intelligence responsibility which may be leveraged for information or required for operational

coordination purposes.

b. Friendly. Identify all Army, DOD service, U.S. and coalition agencies and elements with

the CI element’s area of intelligence responsibility which may be leveraged for information or

required for operational coordination purposes.

c. Assumptions. List any assumptions that must be addressed to identify the operational

execution and effectiveness of supporting CI elements. This may include command and

support relationships, logistical issues

(for example, supplies, equipment, and facilities),

information reporting, and areas of operation (AOs).

Figure F-1. Appendix 3 (CI) to Annex B (Intelligence) to an OPORD

F-4

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Predeployment and Mission Planning

3. EXECUTION:

a. Concept of Operations. You must outline the concept of operations in as much detail as

possible to ensure that all contingencies are covered. Be open to suggestions and

recommendation even if they are just used as alternative courses of action (COAs) or

branches off existing COAs.

b. The following priority tasks will be performed by CI assets. List exactly who you expect

to be responsible for specific tasks down to company and team level, especially if you have

specialized technical CI assets available. Consider how movement from phase to phase

within the major operations battles and engagements will impact priorities, requirements, and

missions and who will be available to execute the prescribed tasks.

(1) Phase I.

(2) Phase II.

(3) Phase III.

(4) Phase IV.

(5) Phase V.

c. Tasks.

(1) Parent Unit.

(2) Theater CI Coordinating Authority (TCICA).

(3) CI Coordinating Authority (CICA).

(4) Service components.

(5) Coalition CI assets and coordination.

(6) Brigade level asset coordination.

d. CI Collection and Reporting.

(1) C/J-2 retains Collection Requirements Management authority over all CI assets.

Coordinate with the analysis and control element (ACE).

(2) CI assets will be tasked to fulfill CI collection requirements reflected in the CI

Collection Plan produced to support this OPLAN. Make sure you have contributed meaningful

input to the CI Collection Plan or you will not have any decent missions preplanned for you

elements.

(3) Coordinate the release of national level CI reports through the CI Staff Officer (CISO)

and/or the TFCICA before release. All national level products will be reported via intelligence

information reports (IIR) format. All other CI reports will be in accordance with component

regulations or unit SOPs. Upon or before execution of this OPLAN, C/J-2 will coordinate all

other attached or assigned or operational control (OPCON) CI elements to ensure that unit

SOPs are sufficient to provide continuity in CI reporting.

Figure F-1. Appendix 3 (CI) to Annex B (Intelligence) to an OPORD (continued)

21 October 2009

FM 2-22.2

F-5

FOR OFFICIAL USE ONLY

Appendix F

(4) CI investigative reporting will be in accordance with AR 381-20.

e. CI Analysis and Production.

(1) The CISO will publish the initial CI threat assessment (CITA) to support this OPLAN.

Subsequent CI analysis and production will be published by the CISO or his designated

elements within the ACE and subordinate elements will perform analysis and production for

dissemination within channels. Analytical products will be disseminated within the command

and may be released to other consumers in accordance with established reporting guidance.

(2) The command will receive theater level terrorist warnings and advisories from the

CISO. The ACE will advise the command on current threat information produced and collected

locally. Additionally the ACE will produce analysis products of threat information received from

higher-level collectors.

f. CI Investigations.

(1) The command will conduct CI-oriented investigations. The Army Theater CI

Coordinating Authority (ATCICA) will provide technical control and oversight, in accordance

with applicable regulations for all CI investigations within the AO. Commanders will be apprised

of investigations on a strict need-to-know basis. The TCICA is the release and dissemination

authority for all CI investigations occurring in the AO.

(2) CI elements involved in CI investigations will operate in accordance with all applicable

Army and DOD regulations and directives.

(3) HN requirements for apprehension and/or detention of personnel involved, for

example, in espionage, sabotage, will be disseminated through the TCICA when published by

the CISO.

(4) Procedures for the conduct of other CI investigations will be published as necessary.

g. CI Operations.

(1) The CISO is responsible for the planning, coordination, and oversight of CI operations

and activities within the AO.

(2) Consistent with requirements and priorities determined by the CISO and supporting

commands, CI elements will develop CI target lists, collection requirements, and black (detain)

white (protect), and gray (suspect) lists within the AO.

(3) CI elements will, with the C/J-1 and the local contracting office when applicable,

conduct screening and vetting activities for locally employed persons (LEPs) to determine

employability of the LEP before hiring.

(4) CI elements, in coordination with supporting Military Police organizations and theatre

interrogation facilities, will conduct CI screening operations of refugees, displaced persons,

enemy prisoners of war (EPWs), and detained suspects for CI exploitation.

Figure F-1. Appendix 3 (CI) to Annex B (Intelligence) to an OPORD (continued)

F-6

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Predeployment and Mission Planning

h. Coordinating Instructions.

(1) The CISO and TFCICA will be apprised of significant CI activities and operations.

(2) Intelligence Oversight. The J-2 will ensure all support CI activities and operations are

conducted in accordance with all applicable regulations and directives.

(3) Intelligence Contingency Funds (ICF). ICF will be the responsibility of the subordinate

CI elements and their respective commands.

4. SERVICE AND SUPPORT:

In accordance with annex I (Service Support), specific service and support needs will differ

according to the tactical situation, mission, methods, and time line of deployment. List any

unique intelligence service support (for example, contractor support) not addressed in either

the base order or annex I.

a. Command-regulated classes of supply. Highlight subordinate allocations of command-

regulated classes of supply that impact functional area operations (such as the controlled

supply rate). Summarize in a matrix or table if necessary.

b. Supply distribution plan:

State the method of supply (supply point or unit distribution) to be used for

appropriate classes of supply for each subordinate or supporting unit.

Give tentative locations for supply points or locations for linkup of push

packages direct to units.

Give allocation of classes of supply by subordinate unit, control measure, or

combination. Summarize in a matrix or table, if necessary.

c. Transportation. State the allocation and priority of support of haul or airlift assets

dedicated for moving classes of supply.

d. Health service support. Address arrangements made for health support of functional

area units operating in forward maneuver unit areas.

e. Maintenance. State priority of support, locations of maintenance facilities, and any

relevant policies.

f. Field services. State priority of support, locations of facilities, and command policies.

g. Host Nation:

List type and location of HN functional area facilities, assets, or support.

List procedures for requesting and acquiring HN functional area support.

Highlight any limitations or restrictions on HN support.

5. COMMAND AND SIGNAL:

a. Command.

State the location of key functional area leaders.

Designate a functional area chain of command and succession of command.

Designate a headquarters to control the effort within functional area work

lines on an area basis.

List command posts and other command and control facilities and their

locations.

b. Signal. Address any functional-area-specific communications or digitization connectivity

requirements or coordination necessary to meet functional responsibilities.

21 October 2009

FM 2-22.2

F-7

FOR OFFICIAL USE ONLY

Appendix G

Counterintelligence Support to Multinational Operations

Multinational operations, both those that include combat and those that do not, are

conducted within the structure of an alliance or coalition.

MULTINATIONAL OPERATIONS

G-1. An alliance is a result of formal agreements between two or more countries to support broad, long-

term objectives, usually involving mutual defense. North Atlantic Treaty Organization (NATO) is one

example of an alliance. Alliance operations are synonymous with multinational operations.

G-2. A military coalition is an agreement between countries to commit military forces for a temporary

period for some specific purpose. An example of such a coalition is the military force that restored Kuwaiti

sovereignty in Operation DESERT STORM.

G-3. Multinational operations may involve a coalition, but be led by an alliance and rely upon the military

structure of the alliance. An example of an alliance-led operation is the NATO-led peace enforcement

mission in Bosnia-Herzegovina known as Stabilization Force.

G-4. Multinational CI is an integrated effort by two or more nations working together to support the CI

requirements of a multinational force. It is a cooperative effort that provides mission-focused connectivity

and unity of effort to multinational headquarters to support associated units, facilities, and personnel. Each

contingency deployment will have unique CI support requirements that will impact both structure and

operations. Multinational cooperative planning should begin at the earliest possible stages of a contingency

deployment to maximize the multinational effort.

RATIONALE FOR MULTINATIONAL OPERATIONS

G-5. Protection is a paramount responsibility of command, regardless of nationality. Command

responsibility includes an active CI effort, just as it would in any U.S. deployment.

All combatant commanders have an protection mission. “Command” necessarily includes

protecting the assigned and attached forces. CI may participate in multinational efforts either

as a U.S.-only or a multinational CI element. CI support to multinational commands should be

based on the concept of centralized control and decentralized execution. Multinational CI can

range from very limited coordination between CI elements of participating nations to a fully

integrated effort. The focus and level of coordination of multinational CI operations will be

determined by the coalition intelligence directorate or the combined joint staff CI and human

intelligence operations coordinator (CJ-2X), not by the nations themselves.

Multinational commands should receive coordinated CI support from the participating

military and national CI organizations other supporting agencies. In some multinational

deployments, the United States will not comprise the predominate force, nor will it always be

the most capable of executing the CI mission.

Multinational CI effort should be developed early. If an alliance organization has an existing

CI structure, it should be used as a foundation for deployment. In the case of the formation of

a coalition, combined CI concepts should be considered to ensure their effective

implementation before deployment. Planning for the functions of CI collection and production

and dissemination would need to be formalized in standing operating procedures (SOPs).

21 October 2009

FM 2-22.2

G-1

FOR OFFICIAL USE ONLY

Appendix G

CONCEPT OF MULTINATIONAL COUNTERINTELLIGENCE

ACTIVITIES

G-6. Sharing of CI information is critical to the multinational commander’s protection efforts and is

critical to the multinational CI effort. CI support to multinational operations may include the following:

Combined source registration, cross-coding, and methods to safeguard data.

Protection support to nongovernmental organizations (NGOs).

Intelligence processing, classification, and dissemination based on participant capability and

need to know.

Establishment of legal baseline between participating nations.

Communications and automation architecture interoperability.

COORDINATION OF MULTINATIONAL COUNTERINTELLIGENCE

ACTIVITIES

G-7. Coordination of CI effort at the multinational level is a requirement for an effective combined CI

effort. Service CI components should leverage existing liaison relationships with other countries’ services

to strengthen CI support within the area of responsibility (AOR) or joint operation areas whenever possible.

Unless there is a preponderance of combat forces from a single nation, future multinational efforts will

require the participation of CI personnel from more than one nation. Proactive sharing of historical data and

crisis-related information to ensure proper knowledge of the operational environment should be the

standard for information sharing.

G-8. Such considerations should include the following:

Appropriate security classification guides.

Comprehensive pre-deployment threat data and appropriate CI training.

Impact of cultural, political, and linguistic considerations on providing flexible CI protection.

G-9. There must be a clear understanding that the multinational environment is fluid and dynamic.

Political considerations and military necessity make any hard-and-fast rules impractical. Consequently, all

handling and dissemination procedures for United States originated classified information should be

included in the contingency planning process by the senior U.S. CI representative supporting the

geographic combatant commander. Additional factors concerning the relationship of multinational partners

must be considered. Sensitive material may be released by one partner with the intention of vertical release

only and not lateral dissemination to other multinational partners. Mechanisms must be developed for

safeguarding sources from potential compromise.

G-10. Liaison with host-nation (HN) and multinational security and CI forces, United Nations forces,

NGOs, and other entities may supports CI collection efforts. All of these agencies represent potential

sources of information that may assist in protection directly and support other CI functions indirectly.

When participating nations have their own CI units to support their own forces, liaison with these CI units

is critical to serve the needs of multinational force commanders in their protection responsibility. The level

and type of information to be shared and the means concerned must be addressed during pre-deployment

planning.

RESPONSIBILITIES DURING MULTINATIONAL

COUNTERINTELLIGENCE ACTIVITIES

G-11. It is the responsibility of the designated U.S. CICA or the senior U.S. intelligence officer to explore

the potential and possibilities of conducting some form of multinational or joint CI to support the

G-2

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Counterintelligence Support to Multinational Operations

multinational force commander. Such coordination should be effected by assigned CI personnel of the

highest U.S. headquarters assigned to the multinational command if no CICA is designated.

G-12. The nature of the alliance or coalition, its mission, its expected duration, the nature of the threat, the

degree of the participation by each nation, and the political situation are factors that bear on whether

multinational CI should be attempted. Each nation will make its own decision to participate in

multinational CI based on its own national interests.

G-13. Regardless of the nationality of the force commander, intelligence officer, or CICA, U.S. CI agents

are subject to U.S. laws, regulations, and guidance when serving in a multinational environment. This must

be identified early in the planning process, as these limitations will have a direct impact on the

effectiveness of the overall organization.

G-14. Many nations do not have robustly developed concepts for CI support of combat forces in the field.

Those that have a concept have many variations on how CI forces are organized.

G-15. In addition, the definition of the terminology of CI and security may vary extensively, so it is

extremely important to verify the exact definitions early in the process.

MULTINATIONAL COUNTERINTELLIGENCE COLLECTION AND

REPORTING

G-16. Participation in multinational CI offers a unique opportunity for liaison for collection with

cooperating coalition or HN intelligence services. This closer contact thus contributes more significantly to

the in-theater multinational force CI effort than that of a single nation.

G-17. CI requirements management should be the responsibility of the senior CI officer conducted with the

commander’s C/J/G/S-2 and the collection manager. The nationality of key intelligence personnel in the

multinational force organizational structure may be a limiting factor.

G-18. CI teams must be equipped with compatible portable computers and secure communication

equipment devices to rapidly communicate with the coalition senior CI officer.

G-19. Reports that relate to the execution of CI missions will be transmitted only via dedicated, secure

communications. Reports that indicate imminent threat will be transmitted not only to the senior CI officer

but also immediately to the threatened command over the most expeditious and practical means weighing

information perishability with OPSEC.

G-20. Coordination requirements for source operations and other sensitive activities will be the subject of

extensive negotiation between the participating nations, and subject to extensive legal review. It is

important than CI operational concept is approved by the multinational force commander so that these very

productive activities can be carried out in a timely manner.

MULTINATIONAL COUNTERINTELLIGENCE ANALYSIS AND

PRODUCTION

G-21. Close liaison with military and civilian CI personnel of participating nations provides additional

sources of information. In some cases, one nation may have better databases on information of CI interest

than another nation.

G-22. The robustness of the multinational CI analysis and production effort will depend on the resources

made available by participating nations.

G-23. Dissemination of critical CI information should be through secure communications available for the

dissemination of intelligence traffic. Multinational commands could lack robust secure communications,

and dedicated secure CI communications may be the only means for timely dissemination of critical threat

information.

Publication Date (Date Pending)

FM 2-22.2

G-3

FOR OFFICIAL USE ONLY

Appendix G

INVESTIGATIONS

G-24. If the subject of an investigation is known to be a citizen of one of the multinational force nations,

that nation must be notified and may assume primary investigative jurisdiction. If the nationality of the

subject is unknown, primary jurisdiction will remain with the multinational headquarters CI unit; however,

primacy may change once nationality is determined.

G-25. When an investigation involves a member of the military components of NATO, the 650th MI Group

will assume primacy and notify the concerned nations.

G-26. In either event, the multinational CI unit will support the investigative process and facilitate access to

multinational force activities to further the investigation.

SHARING OF COUNTERINTELLIGENCE INFORMATION

G-27. Each nation will determine what CI information is in its national interest to share. Information may

be provided to the senior CI officer with specific caveats for its protection; in all instances, these caveats

must be respected if the exchange of information is expected to continue.

G-28. In general, most information collected during multinational CI activities will be released to the

multinational command. This concept applies whether CI personnel are operating in a single-nation

capacity or as part of a multinational CI effort. All information directly supporting or dealing with

protection and multinational force security must be provided, at a minimum, to the multinational force

commander, the C/J/G/S-2, and the senior CI officer.

G-29. The use of restrictive caveats should be kept to a minimum. The decision-making criteria should be

“what not to release” vice “what to release.”

G-30. CI information sharing needs to be in the spirit of the multinational effort with the focus on the

protection mission. While it is expected that individuals from each nation will have access to the equivalent

of “not releasable to foreign nationals” information, all should seek to get release to the multinational

command that information which will assist in protecting the entire multinational force.

LIMITATIONS AND CHALLENGES

G-31. Unreliable alliance or coalition partners will negate the effectiveness of multinational CI. In some

cases, the multinational CI effort may be carried by only one nation or a few member nations of the alliance

or coalition. Some potential alliance or coalition partners may not have developed the necessary military

doctrine for the employment of CI to support military forces in the field. Consequently, they may not have

CI personnel in the military, or who can operate in a field environment. If CI personnel exist, they may not

be adequately equipped to perform the mission.

G-32. Multinational commands should receive coordinated, combined CI support from the military and

national level CI organizations and the combat support agencies of the nations participating. Since it is a

multinational effort, the development of multinational CI constructs will usually be subject to a process of

negotiation between the participating nations.

G-33. In some deployments, the United States will not be the predominate force, nor will it necessarily be

the most capable or expert to execute the CI mission. In many cases, other nations will have a more solid

basis for conducting CI operations due to their experience in the area, the language capabilities of their

intelligence personnel, or because they may already have extensive experience in the area due to recent

deployments.

G-34. Negotiations to achieve critical cooperation in the area of CI will require CI personnel to avoid

parochial Service or nationally biased approaches and recognize the potential significant contribution to be

made by CI personnel of all the participating nations to the security of the multinational command.

G-4

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Appendix H

Automation, Communication, and Equipment

Modern automation and communications systems are vital to counterintelligence (CI)

operations and activities. Real-time collaboration, detailed operational planning and

intelligence, synchronization, and reconnaissance

(ISR) integration, as well as

enhanced collection and source exploitation tools, must support team efforts.

Emerging technology continues to allow the entire CI system to operate more

effectively. CI assets must have the best possible technology not only to enhance

collection but also to optimize the survivability of the CI special agents. Commanders

may not be able to rely solely on standard military equipment but must be prepared to

bridge the inevitable technological development gaps through the technical insertion

of commercial-off-the-shelf technology

(COTS) or government-off-the-shelf

technology products.

AUTOMATION

H-1. CI automation uses common hardware and software solutions with a flexible interactive user

interface to provide standardization of equipment and processes across all operational environments and

conditions. CI automation must be deployable, survivable, network ready, and scalable to fit the mission or

force package. System components must be capable of intelligence reach to support forward-deployed

elements. CI automation allows integration and interaction with existing intelligence operations and

systems, CI operational systems, and national-to-tactical databases. This integration allows operations

personnel and analysts to develop plans, levy collection and operational requirements and investigations, as

well as to manage, control, analyze, and report the information collected. CI automation—

Provides connectivity and reach capability across all echelons of CI activity.

Receives higher echelon requirements and transmits requests for information.

Allows for CI collaboration and information sharing with joint interagency and coalition task

forces.

Pushes requirements, requests, and plans for CI operations in theater as required.

Maintains the central CI database for the theater or area of operations (AO).

Leverages joint, theater, and national level requirements and products for strategic,

operational, and tactical CI assets in theater.

Enables CI to provide accurate and timely correlated information to supported commanders

through established reporting channels.

DISTRIBUTED COMMON GROUND SYSTEM-ARMY

H-2. Distributed Common Ground System-Army (DCGS-A) is the Army’s ground processing system for

all ISR sensors. DCGS-A integrates existing and new ISR system hardware and software that produces a

common net-centric, modular, multi-security, multi-intelligence, interoperable architecture. DCGS-A

provides access to data across the Army intelligence enterprise as well as facilitates intelligence reach

operations with knowledge centers.

H-3. DCGS-A provides access to Joint Worldwide Intelligence Communications System

(JWICS),

National Security Agency Network (NSANet), Secure Internet Protocol Router Network (SIPRNET), and

21 October 2009

FM 2-22.2

H-1

FOR OFFICIAL USE ONLY

Appendix H

Nonsecure Internet Protocol Router Network (NIPRNET). DCGS-A links tactical ISR sensors along with

weather, space, and geospatial analysis capabilities to the Army intelligence enterprise. The DCGS-A net-

centric capability enhances distributed operations by allowing ISR data access down to tactical units.

Additionally, it provides the analyst data mining, fusion, collaboration, and visualization tools to conduct

situational awareness, ISR synchronization, targeting support, analysis, and reporting.

H-4. DCGS-A provides users access to ISR raw sensor data, reports, graphics, and web services through

the DCGS-A integration backbone (DIB). The DIB creates the core framework for a distributed, net-centric

intelligence enterprise architecture. The DIB enables DCGS-A to task, process, post, and use data from

Army, joint, and national ISR sensors. The DIB provides a metadata catalog that defines how you describe

data. The metadata allows DCGS-A to expose the required data elements to the user.

H-5. DCGS-A is the primary ISR processing system from the joint task force (JTF) down to battalion and

below units. DCGS-A is the ISR component of the battle command system and provides the intelligence,

weather, and geospatial engineering data to battle command. It provides threat reporting and the threat

portion of the common operational picture, the publish and subscribe services for ABCS users, as well as

accesses friendly unit information for DCGS-A users. DCGS-A provides the analyst data mining, fusion,

collaboration, and visualization tools to quickly sort through large amounts of data to provide timely,

relevant intelligence to the commander.

H-6. DCGS-A tools assist the targeting process as well as synchronize ISR collection. DCGS-A not only

provides the analyst access to national and theater data sources but also serves as a ground station for

organizational ISR sensors. DCGS-A facilitates distributed operations and reduces the forward physical

footprint.

H-7. DCGS-A will eventually integrate all intelligence systems and applications into a single architecture

including CI automated collection and reporting systems.

BIOMETRICS

H-8. CI teams may be equipped with portable equipment for collecting, storing, analyzing, and retrieving

biometric information. A biometric tool set is able to identify personnel by identifying biometric

characteristics of the individuals. A database links identifying characteristics with all previous reports

related to the person. Once a person’s identifying baseline characteristics are entered into the database, if

that person is again detained and scanned, the system has a probability of identifying them that approaches

100 percent accuracy.

H-9. The hardware that makes up a biometric system often consists of COTS in semihardened laptop

computer running an operating system with a graphical user interface. It has a camera and an iris scanner,

each of which is portable and can be used independent of the computer to collect and temporarily store

information. The system also includes a fingerprint scanner that conforms to Federal Bureau of

Investigation (FBI) requirements for admissible evidence. The fingerprint scanner must be attached to the

computer during use.

MACHINE TRANSLATION AND INTERPRETATION

H-10. Understanding oral and written communication in a foreign language is often critical in CI activities

and operations. The optimal solution is to have an individual who is a trained collector of native

proficiency, totally versed in the local situation and U.S. requirements, has a requisite security clearance,

and is capable of reporting accurately in English.

H-11. A commander’s access to such individuals is sometimes problematic. This requirement is met

through a combination of MI linguists, native speakers within the Department of Defense (DOD) system,

and locally hired civilian translators. Difficulties arise if the proficiency levels of MI linguists are not up to

mission requirements, or if the linguists do not possess the proper language for the theater of operation.

Using locally hired translators raises security problems. In light of these conditions, an increasingly viable

solution for the commander is the use of machine translation devices to meet some of these requirements.

H-2

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Automation, Communication, and Equipment

H-12. Voice and text translation machines or software are critical in augmenting available linguists. This

includes natural language processing, artificial intelligence, and optical-character recognition

(OCR)

capabilities. The basic application of machine translation, such as speech recognition and OCRs,

dramatically increases the speed of processing information. Software programs are becoming widely

available that allow a non-linguist to determine the intelligence significance of a foreign document, aid

linguists with laborious tasks, and add consistency to human translation.

H-13. Machine interpretation is the use of a machine to interpret the spoken word between the CI special

agent and another individual speaking a foreign language. Linguists are in high demand during operations

and usually limited in number. As machine interpretation devices that address this problem become

available to the field, they will improve the communication ability of non-linguists.

AUTOMATED ANALYTICAL TOOLS

H-14. The requirement for a robust CI single-discipline analytical capability extends through all echelons

from national level to the operational management teams (OMTs). Communication between CI analysts at

the operational level and analysts at the staff level may best be accomplished through a web-based

communication capability. Web-based visual analytical tools allow maximum analyst participation in the

development of products geared to mission planning, targeting, and information analysis at all echelons.

Analytical products must be responsive to the special needs of a specific collection operation, project, or

element.

H-15. CI special agents run operations in terrain consisting of persons, organizations, and installations of

interest. Intelligence analysis support determines the specific terrain in each team area and how it differs

from one team’s named area of interest (NAI) to another. Specific products include studies on nominated

targets (persons, organizations, and installations) and trends based on CI reporting, as appropriate, and

visual analysis products (time event charts, matrices, link analysis diagrams, and organizational diagrams).

H-16. Automated CI analytical tools (such as time event charts, association matrices, activity matrices, and

link analysis diagrams) improve predictive analysis capability. They save time and permit access to more

complete information thus producing a more accurate, timely product.

H-17. Automated analytic techniques, aided by computerized virtual-viewing programs, allow the analyst

better visualization of the operational environment. These programs assist the analyst in developing

predictions and identifying information gaps to support targeting and collection. Automation and web-

based tools allow the analyst to⎯

Track and cross-cue CI reports.

Incorporate data extraction technology, retrieval, automated data organization, content

analysis, and visualization.

Share analytical decisions with CI teams and other analysts in real time.

Apply multidimensional technologies, content analysis techniques, and web-based

collaborations.

Display analytical results and view CI operations in real time.

Share resources such as models, queries, visualizations, map overlays, and tool outputs

through a common interface.

Apply clustering (a nonlinear search that compiles the results based on search parameters) and

rapid spatial graphical and geographic visualization tools to determine the meaning of large

informational streams.

Rapidly discover links, patterns, relationships, and trends in text to use in predictive analysis.

Capture analytical conclusions and automatically transfer to intelligence databases and

systems.

21 October 2009

FM 2-22.2

H-3

FOR OFFICIAL USE ONLY

Appendix H

SEARCH ENGINES

H-18. Search engines provide access to previously collected or known information facilitating the

development of comprehensive analytical and intelligence products and avoiding unnecessary collection

tasking redundancy. A tool set for data visualization, search, and discovery is required, which is embedded

with several software programs for manipulating data from multiple databases.

H-19. The types of modules in visualization packages should include search engines and knowledge

discovery (semantic clustering) for unformatted data, applications for extracting and organizing formatted

data, and data labeling. The package should also include a model building tool to enable users to make their

archives more efficient with respect to search, retrieval, and compatibility to other applications as well as

archiving and maintenance tools to support what will eventually become a large data warehouse. Search

engines should be⎯

Multilingual and able to query multiple classified and unclassified databases.

Capable of developing, querying, and manipulating stored information.

WEB-BASED REPORTING

H-20. Web-based reporting employs current Internet technology. It employs an interactive graphic interface

using client browser technology, search engines, hyperlinks, and intelligent software agents for searching,

finding, viewing, and maintaining databases and supporting CI work, data, and information flows. It

supports collaborative analysis at multiple echelons through connectivity on the SIPRNET. The following

pertains to web-based reporting:

Web-based databases compatible with any computer hardware, operating system, or software.

Firewalls and information access which are controlled at each level with an approving

systems administrator at each level conducting quality control through release authority

procedures.

Graphic user interface which uses standard Army and DOD report formats.

Graphic user interface which walks the user through a critical task and is able to identify

Army and DOD reports as required. Reports must be Army and DOD platform compatible

and transferable through and to their respective systems.

Multimedia supports applications for attaching, associating, and hyper linking video, still

photographs, voice, scanned objects, graphics, and maps to records and files.

H-21. Web-based reporting and web pages developed for specific products allow the user to⎯

Leverage their effort and expertise against all requirements, not just the ones that must be met

immediately.

Identify timely intelligence gaps and the leads to fill those gaps.

Ensure immediate analytical feedback on collector reports to—

Post questions directly to a web page to enable all CI teams to answer or be cued to the

specific request.

Identify or request clarification on questionable data for quality control.

Fuse CI information and all-source information as required.

Focus collection teams supporting maneuver commanders’ requirements more effectively.

Immediately extract information for crisis reaction.

H-4

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

Automation, Communication, and Equipment

DATABASES

H-22. Without databases, information is difficult or impossible to retrieve quickly, especially under adverse

conditions. Databases support many complex CI functions and requirements, including—

Mission deconfliction.

ISR synchronization.

Requests for information (RFIs).

CI analysis.

Summary, report, and assessment preparation.

Threat and friendly situations tracking.

Targeting.

H-23. Databases interact with other tools to support predictive analysis, prepare graphic analytical products,

and provide situational awareness down to the CI team. These databases⎯

Support time event charts, association matrices, support link analyses, and other analysis

tools.

Require a designated systems administrator at each. To ensure a high degree of integrity,

discrepancies must be verified for accuracy.

Allow operators, managers, and analysts to—

Compartment (protect) source-sensitive operational database segments, files, records, and

fields.

Create, update, and maintain databases from locally generated information.

Import complete or partial databases from larger or peer databases.

Export complete or partial databases to peer or larger databases.

Share databases between peers, subordinates, or higher with appropriate access

authorization.

Provide systematic processing and automated parsing using standardized forms in intelligence

operations, which are automatically parsed into appropriate databases for information storing,

sharing, retrieval, and analysis.

Allow query functions for decisionmaking as well as operational and analytical support.

Provide analytical programs able to correlate data that facilitate information retrieval from

any data repository.

Incorporate information retrieval functions such as browsing (that is, point and click), key

word searching, concepts, and similar functions.

Support a suite of specialized decision support software—a set of tools which supports CI

source administration, analysis, and risk management decisions. Decision support software

tools should produce a set of CI reports specifically tailored to the CI decisionmaking,

analysis, and assessment process.

2X AND CICA REQUIREMENTS

H-24. The counterintelligence (CI) automation systems are normally shared systems used by both the CI

and human intelligence (HUMINT) communities. They must allow for network centric operations. The CI

staff elements require the capability to send and receive data between subordinate OMTs and CI teams as

21 October 2009

FM 2-22.2

H-5

FOR OFFICIAL USE ONLY

Appendix H

well as data exchange between higher and adjacent echelons. Automation requirements for the staff CI and

HUMINT operations coordinator (2X)/CI Coordinating Authority (CICA) must be able to support CI

mission planning, reporting, and dissemination. Their systems must also be interoperable with other service

systems and automated analysis systems, manipulate CI databases, conduct reach, and have access to CI

analytical tools.

OMT AND CI TEAM LEADER REQUIREMENTS

H-25. The OMT must be able to track teams and team members; receive and transmit data including

graphic data to and from higher, lateral, and lower CI elements; create, receive, edit, and transmit reports;

conduct single-discipline CI analysis; receive and transmit technical support information and tasking

information; conduct reach; and conduct mission planning.

INDIVIDUAL COLLECTOR AUTOMATION REQUIREMENTS

H-26. The key to effective CI collection is unimpeded communication between the collector and the source

of information. Any technological support to CI collection must be as unobtrusive as possible to minimize

the intimidation factor when dealing with human sources. The individual collector must be able to--

Record (both video and voice) conversations with sources.

Scan, translate, and transmit documents and photographs.

Instantaneously locate themselves in both rural and urban environments.

Immediately access local, theater, and even national level databases.

Communicate instantaneously with other team elements.

COUNTERINTELLIGENCE WORKSTATION REQUIREMENTS

H-27. CI teams have organic computer and data processing equipment. These workstations provide CI

teams with productivity and management and analysis tools. They also provide SIPRNET connectivity and

processing capability to identify requirements and facilitate reporting into other DOD systems as required.

Included software graphically uses standard Army, DOD, and CI reporting, symbols, and map overlay

generation and map plotting. Teams use workstations to—

Provide quality control and dissemination of reports from the subordinate CI teams.

Direct activities of subordinate CI teams and provide management to them.

Perform single-discipline CI analysis for the supported commander.

Transmit intelligence and administrative reports in near real time to higher headquarters.

Receive tasking and administrative reports from higher headquarters and distribute to CI

teams as required.

Consolidate local databases and provide database input to higher headquarters.

Receive database and digital information from higher headquarters and pass to lower and vice

versa.

COMMUNICATIONS

H-28. Successful CI activities and operations must be supported by multiechelon technical oversight and a

communications system that provides internal team communications linking CI teams to OMTs, and OMTs

to higher headquarters, analytical elements, and theater and national agencies.

H-6

FM 2-22.2

21 October 2009

FOR OFFICIAL USE ONLY

FM 2-22.2 (FM 34-60) Counterintelligence (October 2009) - page 3