UNITED24 - Make a charitable donation in support of Ukraine!



Chapter 2


During the last decade, a record number of espionage cases have involved US service members and US Government civilian employees. Most of these cases involved "volunteers," individuals who sought FIS employment. The US Army's authority to conduct intelligence and CI activities is EO 12333. Implementation of the EO and applicable DOD directives by the US Army are in AR 381-20. To accomplish this mission, CI agents conduct investigations to enhance, maintain, and preserve the security of the US Army. See Appendix A for TTPs.


US Army CI forces conduct two types of investigations: CI investigations (also known as Subversion and Espionage Directed Against US Army and Deliberate Security Violations [SAEDA] investigations) and personnel security investigations (PSIs).

CI INVESTIGATIONS: CI investigations are national security investigations under Army CI jurisdiction. AR 381-12 requires US Army personnel, both civilian and military, to report suspicious activities. This program provides the greatest number of leads to Army CI personnel. AR 381-20 specifically lists those activities which fall under Army CI investigative jurisdiction. Types of CI investigations include

  • Treason.
  • Espionage.
  • Spying.
  • Subversion.
  • Sedition.
  • FIS-directed sabotage.
  • CI aspects of terrorist activities directed against the Army.
  • CI aspects of assassination or incapacitation of Army personnel by terrorists or by agents of a foreign power.
  • Defection of military and DA civilians overseas, and debriefing of the individual upon return to US control.
  • Detention of Army military or civilian personnel by a government or hostile force with interests contrary to those of the US.
  • Investigation and debriefing of military members and Army civilians overseas who are declared absent without leave (AWOL), missing, or deserters who had access to TOP SECRET national defense information or sensitive compartmented information (SCI) within one year prior to their being declared AWOL, missing, or deserters. Investigation and debriefing of special category absentees (SCA) who were in a special mission unit (SMU); who had access to one or more special access programs (SAPs); or were in the DA Cryptographic Access Program (DACAP).
  • CI aspects of security violations and compromises, and communications security (COMSEC) insecurities.
  • CI aspects of incidents of DA personnel with a SECRET or higher security clearance, access to a SAP or SCI, or in the DACAP or SMU who commits or attempts to commit suicide.
  • CI aspects of unofficial travel to designated countries, or contacts with foreign diplomatic facilities or official representatives, by all military personnel or DA civilians employed overseas.
  • CI scope polygraph examinations. See AR 381-20.
  • CI technical surveillance countermeasures (TSCM). See AR 381-14 (S).

All CI investigations are controlled by the Army Central Control Office (ACCO) and network of worldwide sub-control offices (SCOs). The ACCO and SCOs were established and are operated by Headquarters, INSCOM, at the direction of the DCSINT, Headquarters, DA.

ACCO. The ACCO is located at Fort Meade, MD. The ACCO exercises technical control, review, coordination, and oversight of Army CI controlled activities, including investigations. The ACCO has the specific responsibility to

  • Provide objective technical review ensuring complete and proper accounting of CI controlled activities in compliance with established policy.
  • Open CI investigations and assign all case control numbers; counterespionage (CE) projects; and ensure all initial SAEDA reports are reviewed in accordance with AR 381-47 (S).
  • Provide CFSO.
  • Retain the authority to assume direct control of any investigation or reassign it to another SCO. Direct case control includes imparting operational or investigative guidance, direct tasking, and investigative plan approval.
  • Establish a suspense system for timely completion of priority investigations.
  • Ensure that information within the purview of other intelligence, security, or law enforcement agencies is properly referred to them, and accept and process referrals from other agencies.
  • Ensure that case files and other records and reports are properly processed and transferred to the US Army Investigative Records Repository (IRR). Close all investigations upon files transfer to the IRR.
  • Provide quality control of reports to the SCOs.
  • Monitor status of suspended or transferred investigations in which Army interest continues.
  • Approve or disapprove requests for CI case summaries and declassification of classified case summaries, and declassify information classified by AR 381-47 (S). Coordinate with other service CI agencies and the Federal Bureau of Investigation (FBI) when non-Army case summaries are requested.
  • Conduct additional activities as stated in AR 381-47 (S).
SCOs. The SCOs are responsible for the day-to-day management of CI controlled activities. The SCO will
  • Serve as the central focal point for monitoring the conduct of CI controlled activities within an area of responsibility.
  • Open and close investigations, and determine their direction and scope, except those directly controlled by the ACCO. Approve investigative plans and task investigative elements accordingly.
  • Respond to and coordinate technical direction and tasking from the ACCO.
  • Report immediately to the ACCO all incidents which meet the criteria in AR 381-12 or AR 381-47 (S).
  • Ensure all reports are properly addressed and disseminated based on content.
  • Review all CI reporting to ensure it is accurate, complete, and in compliance with CI policy and intelligence oversight.
  • Coordinate activities with legal and intelligence oversight officials, as required.
  • Refer information within the purview of other intelligence, security, or law enforcement agencies in the AOR, as required.
  • Coordinate briefings to commanders and senior intelligence officials.
  • Pass lateral leads to other SCOs, when required, with information copies to the ACCO.
  • Complete and terminate activities and transmit final reports to the ACCO for case closure. Provide ACCO-approved summaries of information, when required, to the concerned commander and other agencies in the theater.
  • Forward requests for CI case summaries, non-Army case summaries, and requests for declassification to the ACCO.
  • Ensure appropriate coordination with (keep the respective senior intelligence officer informed) CI controlled activities affecting theater security.
  • Conduct additional activities as stated in AR 381-47 (S).

CI investigations are conducted only by CI personnel assigned or attached to units with a CI investigative mission. They have been school-trained by the United States Army Intelligence Center and Fort Huachuca (USAIC&FH) and hold specialty skill identifier 35E, or MOS 351B or 97B, and have been issued badge and credentials; or by Army civilian employees in career field 0132 who are assigned to CI units, have been school-trained, and are issued badge and credentials. See AR 381-20, paragraph 9-4.

Local national investigators employed by overseas Army CI units who have been issued MI representative credentials may conduct investigative leads. They will not be the primary or sole investigator.

PERSONNEL SECURITY INVESTIGATIONS: AR 380-5 states that no person is entitled to knowledge of classified defense information or material solely by virtue of grade or position. This knowledge is entrusted only to those individuals whose official duties require access to the information. Persons requiring access must be investigated and receive favorable results before being cleared to receive classified material or information. Some foreign nationals and indigenous employees in overseas areas require a degree of access to perform their duties. Policy prohibits granting security clearances but permits granting of limited access authorization (LAA) following a favorable background investigation. These investigations are called LAA investigations and usually involve use of the polygraph.

PSIs are conducted outside continental United States (OCONUS) by the US Army on behalf of the Defense Investigative Service (DIS). Agents conduct PSIs to determine loyalty to the US and suitability for access to classified defense information. The investigative activity for PSIs runs the gamut from records checks, to interviews with people who know the subject of the investigation, to interviews with the subjects themselves. The complete guide for conducting PSIs is in DIS Manual 20-1-M.

Join the GlobalSecurity.org mailing list