Military Intelligence

Counterintelligence Investigative Procedures

By Order of the Secretary of the Army:

JAMES C. MCCONVILLE
General, United States Army
Chief of Staff

Official:

KATHLEEN S. MILLER
Administrative Assistant
to the Secretary of the Army

History. This publication is a new Department of the Army pamphlet.

Summary. This pamphlet complements AR 381-20 (classified) and is the counterintelligence reference for counterintelligence investigative procedures and processes based on U.S. law, Department of the Army policy, Army Counterintelligence Coordinating Authority policy, and

U.S. Army Intelligence Center of Excellence doctrine. AR 381-20 will take precedence whenever this publication is in conflict with AR 381-20.

Applicability. This pamphlet applies to the Regular Army, the Army National Guard/Army Guard of the United States, and the U.S. Army Reserve, unless otherwise stated.

Proponent and exception authority. The proponent of this pamphlet is the Deputy Chief of Staff, G-2. The proponent has the authority to approve exceptions or waivers to this pamphlet that are consistent with controlling law and regulations. The proponent may delegate this approval authority, in writing, to a division chief within the proponent agency or its direct reporting unit or field operating agency, in the grade of colonel or the civilian equivalent. Activities may request a waiver to this pamphlet by providing justification that includes a full analysis of the expected benefits and must include

formal review by the activity's senior legal officer. All waiver requests will be endorsed by the commander or senior leader of the requesting activity and forwarded through their higher headquarters to the policy proponent. Refer to AR 25-30 for specific guidance.

Suggested improvements. Users are invited to send comments and suggested improvements on DA FormDA FormDepartment of the Army form 2028 (Recommended Changes to Publications and Blank Forms) directly to the Deputy Chief of Staff, G-2 (DAMI-CDC), 1000 Army Pentagon, Washington, DC 20310-1000.

Distribution. This publication is available in electronic media only and is intended for the Regular Army, the Army National Guard/Army National Guard of the United States, and the U.S. Army Reserve and for the Marine Corps.

A records check is the process SAs use to obtain relevant information about sources or subjects from the records and information holdings of military, civilian, or Government agencies, as well as certain commercial companies and vendors, during the conduct of an investigation. Information from records checks may be obtained during a personal encounter between SAs and a representative of the agency or company from which information is being requested. Records checks may also be conducted by telephone, email, facsimile, or an online database. SAs conducting a records check must be able to articulate the CI mission, function, and authority when collecting information concerning a U.S. person.

An interview is a process that SAs use to obtain information verbally from people associated with or who have direct knowledge relevant to a CI investigation. It occurs during a personal meeting between SAs and the person who has information concerning the investigation. Interviews are used to further develop information to refute, mitigate, or resolve allegations of a national security crime or incident of CI interest.

Reporting procedures and management of investigation-related documents are essential to maintaining an investiga-tion on track and supportive of prosecutorial objectives. Case management begins with the initial report of an activity or incident of CI interests and ends when ACICA informs the investigative element that the case has been closed and placed in the USAIRR and provides guidance to destroy additional document copies. All investigative activities are documented and managed in ACOP.

CI investigations consist of fact-finding and information collection activities. The results of these activities are pre-pared in written form and submitted to appropriate offices and agencies. ROI entries in ACOP are the end product of all investigative efforts. CI reports transmit information accurately to the responsible operations management element and higher technical authorities to provide a legal record of investigative activities. CI reports must answer all reason-able questions, which may be raised by reviewing technical and legal authorities.

CI investigations are controlled and developed through a series of investigation management documents that chronicle the history of an investigation from its opening to its closing. Investigation management documents record every aspect of an investigation, as well as the results from actions taken. ACICA must concur with and approve all inves-tigation management documents prior to investigative action being taken and prior to the case being closed.

CI investigation supporting documents are used to request records checks and special investigative or collection tech-niques that require coordination, staffing, and approval based on guidance in DODMDODMDepartment of the Defense Manual 5240.01, AR 381 – 10, and AR 381 – 20.

CI investigations of incidents of CI interest and national security crimes must be conducted in accordance with the principles of law and the rules of evidence that govern the prosecution of any criminal activity. AR 195 – 5 and FM 3 – 19.13 cover the legal aspects of gathering, handling, documenting, and controlling evidence. CI personnel must have a thorough understanding of the legal principles and procedures involved in conducting an investigation to ensure prosecutorial integrity of the investigation, know when to seek legal guidance before exercising an investigative ac-tivity, and recognize those cases where specific guidance, assistance, or approval must be obtained before executing further investigative activities.

Conducting investigative activity and producing evidence are only part of the investigative process. SAs must be also be adept at documenting and transmitting their findings to decision makers and adjudicators via the many CI reports. Each CI report has a specific purpose and guidelines that must be observed when documenting a CI investigation. All CI reporting will put into ACOP.

No two investigations are ever the same, but each requires SAs to rely on their experiences and employ best practices to achieve investigative goals. This appendix includes some investigative aids developed to focus investigative activ-ity, employ investigative resources, and manage and analyze collected information.