THE UNIVERSITY OF THE ARMY
1775
THE UNIVERSITY OF THE ARMY
Headquarters
Department of the Army
Washington, DC
13 June 2025
*Army Regulation 381–12
Effective 13 July 2025

Military Intelligence

Counterintelligence Awareness and Reporting

By Order of the Secretary of the Army:

RANDY A. GEORGE
General, United States Army
Chief of Staff

Official:

MARK F. AVERILL
Administrative Assistant to the
Secretary of the Army

History. This publication is a major revision. The portions affected by this major revision are listed in the summary of change.

Authorities. This regulation implements 10 USCUSCUnited States Code 7013, Executive Order 12333, DoDD 5240.01, DoDD 5240.02, and DoDD 5240.06.

Applicability. This regulation applies to the Regular Army, the Army National Guard/Army National Guard of the United States, and the U.S. Army Reserve, unless otherwise stated.

Proponent and exception authority. The proponent of this regulation is the Deputy Chief of Staff, G–2. The proponent has the authority to approve exceptions or waivers to this regulation that are consistent with controlling law and regulations. The proponent may delegate this approval authority, in writing, to a division chief within the proponent agency or its direct reporting unit or field operating agency, in the grade of colonel or the civilian equivalent. Activities may request a waiver to this regulation by providing justification that includes a full analysis of the expected benefits and must include formal review by the activity's senior legal officer. All waiver requests will be endorsed by the commander or senior leader of the requesting activity and forwarded through their higher headquarters to the policy proponent. Refer to AR 25–30 for specific requirements.

Army internal control process. This regulation contains internal control provisions in accordance with AR 11–2 and identifies key internal controls that must be evaluated (see appendix D).

Suggested improvements. Users are invited to send comments and suggested improvements on DA FormDA FormDepartment of the Army form 2028 (Recommended Changes to Publications and Blank Forms) directly to usarmy.pentagon.hqda-dcs-g-2.list.dami-cdc@army.mil.

Distribution. This regulation is available in electronic media only and is intended for the Regular Army, the Army National Guard/Army National Guard of the United States, and the U.S. Army Reserve.

*This regulation supersedes AR 381-12, dated 1 June 2016.

AR 381–12 • 13 June 2025

UNCLASSIFIED

All provisions of chapter 4 are punitive, with the exception of paragraph 4–5. Violations of the punitive provisions of chapter 4 may subject offenders to criminal prosecution, disciplinary action under the Uni-form Code of Military Justice (UCMJUCMJUniformed Code of Military Justice), adverse administrative action pursuant to AR 690–752, or other ad-verse action authorized by applicable provisions of law.

ACI office An ACICA-validated ACI field office or resident agency assigned responsibility for a command, facility, program, installation, or geographic area. This includes offices sourced from across the ACI enterprise (for example, ACIC, Military Intelligence Brigade-Theater (MIB–T), FORSCOMFORSCOMU. S. Army Forces Command, U.S. Army Special Opera- tions Command, USARUSARUnited States Army Reserve, ARNGARNGArmy National Guard, and 650th Military Intelligence Group).

Anomalous Health Incidents Sudden sensory events such as sounds, pressure, or heat concurrently or immediately preceding the sudden onset of symptoms such as headaches, pain, nausea, or disequilibrium (unsteadiness or vertigo). (see DoDD 5111.13 and Secretary of Defense memorandum (Anomalous Heath Incidents), dated 15 September 2021).

Anomaly Defined in DoDD 5240.06.

Army Counterintelligence Coordinating Authority The ACICA is an Army level office responsible for the worldwide mission management and technical con- trol of all controlled ACI activities conducted under the SECARMYSECARMYSecretary of the Army’s Authorities. The ACICA has the au- thority to task, direct, control, and prioritize all CI activities. The activities include CI investigations, CI op- erations, special collection procedures, CI projects, CI support to research, technology, and acquisitions, and CI Cyber. The ACICA exercises direct control of all CI investigations including direct tasking of CI field or resident offices. The ACICA is not responsible for CI activities conducted by the 650 th MI Group; collection; analysis and production; CI technical services; CI support to force protection, technology, and critical infrastructure; and CI cyber activities. (see AR 381–20).

CI awareness Defined in DoDD 5240.06.

CI element Defined in DoDD 5240.02.

CI incident assessment The collection and examination of information of CI interest to determine if a CI investigation is warranted.

CI insider threat Defined in DoDD 5240.02.

CI investigations Defined in DoDD 5240.02.

CI-experienced person An individual designated by ACIC, based on their cumulative knowledge, skills, and abilities, to conduct specialized CIAR briefings.

Classified national security information Defined in DoDM 5200.01, Volume 1 and EO 13526.

Collection Defined in DoDM 5240.01.

Contact Any form of meeting, association, or communication, in person, by radio, telephone, letter, or other means, regardless of who started the contact or whether it was for social, official, private, or other rea- sons.

Contracted cadet The military status of a cadet is a member of the Individual Ready Reserve or a member of the Selected Reserve in the Simultaneous Membership Program, unless activated for military training at which time a cadet is placed on orders (see DoDI 1215.08) and is in contrast to a “Reserve Officers’ Training Corps (ROTCROTCReserve Officers’ Training Course) student” who may be taking ROTCROTCReserve Officers’ Training Course courses but is not formally enrolled in the program.

Contractor Defined in DoDD 5240.02.

Controlled unclassified information Defined in 32 CFRCFRCode of Federal Regulations 2002.4.

Counterintelligence Defined in EO 12333, as amended.

Critical program information Defined in DoDI 5200.39.

Debriefing assignment or who has, through observation, participation, or personal knowledge, information of intelli- gence or CI value or significance. isfy intelligence requirements.

Defensive travel briefings Formal advisories alerting personnel of the potential for harassment, exploitation, provocation, capture, or entrapment while traveling. These briefings, based on actual experience when available, include infor- mation on courses of action helpful in mitigating adverse security and personnel consequences and ad- vise of passive and active measures that personnel should take to avoid becoming targets or inadvertent victims as a consequence of hazardous travel (see DoDM 5105.21, Volume 3).

Department of the Army personnel Persons employed by the Army. It includes all military, civilian, contractors, and foreign nationals.

Espionage See UCMJUCMJUniformed Code of Military Justice, Article 103a (10 USCUSCUnited States Code 903a).

Field office, ACI A field office is normally a subordinate element of an MIB–T or ACIC Region. It provides CI support within a specified portion of a geographic area of responsibility and typically provides administrative supervision over multiple resident agency offices.

Force protection Defined in the DoD Dictionary of Military and Associated Terms.

Foreign diplomatic establishment Any embassy, consulate, or interest section representing a foreign country.

Foreign intelligence entity Defined in DoDD 5240.06.

Foreign power Defined in DoDM 5240.01.

Insider threat A threat presented by a person who has, or once had, authorized access to information, a facility, a net- work, a person, or a resource of the department; and wittingly, or unwittingly, commits an act in contra- vention of law or policy that resulted in, or might result in, harm through the loss or degradation of govern- ment or company information, resources, or capabilities; or a destructive act, which may include physical harm to another in the workplace (see Public Law 114–328).

Leak The unauthorized disclosure of classified or sensitive information, as to the news media.

Military Department Counterintelligence Organization Elements of the Military Departments authorized to conduct CI investigations (for example, U.S. Army Counterintelligence, Naval Criminal Investigative Service, and the Air Force Office of Special Investiga- tions) (see DoDD 5240.06).

National Security Education Program The National Security Education Program (NSEP) is a U.S. federal government initiative to enhance U.S. national security and economic competitiveness by increasing “critical need” foreign language skills, cul- tural understanding, and regional expertise within the U.S. federal workforce. NSEP oversees eight initia- tives designed to support and expand language and cultural skills within the federal workforce. NSEP Programs provide pathways to careers in federal government, and select programs include a year-long federal service requirement upon completion of academic study. NSEP oversees eight programs: David L. Boren Scholarships and Fellowships, The Language Flagship, English for Heritage Language Speak- ers, National Language Service Corps, Project Global Officer, Language Training Centers, and Regional Flagship Language Initiatives (see DoDI 1025.02).

Resident agency, ACI A resident agency is normally a subordinate element of an ACI field office. It provides ACI support within a specified portion of a geographic area of responsibility.

Sabotage See 18 USCUSCUnited States Code Chapter 105.

Sedition See UCMJUCMJUniformed Code of Military Justice, Article 94 (10 USCUSCUnited States Code 894).

Self-radicalization Significant steps an individual takes in advocating or adopting an extremist belief system for the purpose of facilitating ideologically based violence to advance political, religious, or social change. The self-radi- calized individual has not been recruited by and has no direct, personal influence or tasking from other violent extremists. The self-radicalized individual may seek out direct or indirect (through the Internet for example) contact with other violent extremists for moral support and to enhance his or her extremist be- liefs.

Special Agent, ACI An individual (military or civilian) who has been accepted, accredited, and successfully completed Coun- terintelligence Agent Course or equivalent approved course, and is authorized to investigate national se- curity crimes and support prosecution under UCMJUCMJUniformed Code of Military Justice and federal laws (PMOSPMOSPrimary military occupational specialty MOSMOSMilitary occupational specialties 35L, 351L, 35A2E; Of- fice of Professional Management Occupational Series 0132).

Special Agent-In-Charge, ACI An ACI Special Agent appointed as the supervisor of an ACI field office, resident agency, or ACIC Re- gion.

Spying See UCMJUCMJUniformed Code of Military Justice, Article 103 (10 USCUSCUnited States Code 903).

Subversion See 18 USCUSCUnited States Code Chapter 115.

Suspicious activity Any behavior or incident that is indicative of criminal activities, intelligence gathering, or other preopera- tional planning related to a security threat to DoD interests.

Terrorism See 18 USCUSCUnited States Code Chapter 113B.

Treason See 18 USCUSCUnited States Code 2381.

Unauthorized disclosure Defined in DoDM 5200.01, Volume 3.

Unsolicited correspondence Requests for information from a person which may range from direct inquiries by phone, email, fax, or let- ter in which the recipient is asked to provide seemingly innocuous data. Typical requests include solicita- tion of research papers, requests for additional information after a public presentation, suggestions for mutual research, requests for survey participation, and so forth; correspondence where the actual purpose may be to identify by name and position any individual who might be targeted later by a foreign intelligence service, and to elicit targeted information not readily obtainable by other means.