## Department Of The Army

UNITED STATES ARMY INTELLIGENCE AND SECURITY COMMAND
FREEDOM OF INFORMATION/PRIVACY OFFICE
FORT GEORGE G. MEADE, MARYLAND 207555995
NOV 1 8 Z019
Freedom of Information/
Privacy Office

Mr. Steven Aftergood
Federation of American Scientists
1725 DeSales Street NW, Suite 600
Washington, DC 20036

Dear Mr. Aftergood:

  This is in reponse to your Freedom of Information Act (FOIA) request of July 5, 2017, to
the U.S. Army Installation Management Command (IMCOM), United States Army Garrison,
Fort Huachuca, for copies of ATP 2-22.9, Open-Source Intelligence, Intelligence Center of
Excellence (Huachuca), 30 June 2017. On January 8, 2019, IMCOM forwarded your request
and records to the U.S. Army Training and Doctrine Command (TRADOC). On November 5,
2019, TRADOC forwarded your request and records to this office and they were received on
November 6, 2019.

  Coordination with another element of our command has been completed and records have
been returned to this office for final disposition and direct reply to you. The records have
been determined to be partially releasable and are enclosed.

  Information has been sanitized that would result in an unwarranted invasion of the privacy
rights of the individuals concerned. This information is exempt from the public disclosure
provisions of the FOIA per Title 5 U.S. Code 552 (b)(6).

Information also has been withheld pursuant to Title 5 U.S.C. 552(b)(3) of the FOIA.

Exemption (b)(3) pertains to information that is exempt by statute. The applicable statute is
50 U.S.C.  3024(i), which protects intelligence sources and methods.

  The withholding of the information described above is a partial denial of your request.
This denial is made on behalf of Major General Gary W. Johnston, Commanding, U.S. Army
Intelligence and Security Command, who is the Initial Denial Authority for Army intelligence
investigative and security records under the FOIA. You have the right to appeal this decision
to the Secretary of the Army. Your appeal must be postmarked no later than 90 calendar
days from the date of this letter. After the 90-day period, the case may be considered
closed; however, such closure does not preclude you from filing litigation in the courts. You
should state the basis of your disagreement with the response and provide justification for a
reconsideration of the denial. An appeal may not serve as a request for additional or new
information. An appeal may only address information denied in this response. Your appeal
is to be made to this office, for forwarding, as appropriate to the Secretary of the Army,
Office of the General Counsel.

There are no assessable FOIA fees.

If you have any questions regarding this action, feel free to contact this office at 1-866-
548-5651 , or email the INSCOM FOIA office at: usarmy.meade.902-mi-grp.mbx.inscom-foiaservice-center@mail.mil and refer to case #0065F-20. Please note that you now have the ability to check the status of your request online via the U.S. Army Records Management and Declassification Agency (RMDA) website:
https://www.foia.army.mii/FACTS/CaseStatus.aspx. Please refer to FOIA Control Number:
FP-20-003201 . You may also contact the INSCOM FOIA Public Liaison, Mrs. Joanne Benear, for any further assistance and to discuss any aspect of your request at 301-677-
7856. Additionally, you may contact the Office of Government Information Services (OGIS)
at the National Archives and Records Administration to inquire about the FOIA mediation services they offer. The contact information for OGIS is as follows: Office of Government Information Services, National Archives and Records Administration , 8601 Adelphi Road-
OGIS, College Park, Maryland 20740-6001; email at ogis@nara.gov; telephone at 202-741-
5770; toll tree at 1-877-684-6448; or facsimile at 202-741-5769.

Sincerely, chaeiL
Director Freedom of Information/Privacy Office Investigative Records Repository Enclosure

# Open-Source Intelligence (U)

## June 2017,

DISTRIBUTION RESTRICTION: Distribution authorized to U.S. Government agencies only because It requires protection in accordance with AR 380-5, AR 530-1, and U.S. Army Directive 2016-37, 22 November 2016. This determination was made on 10 February 2017. Contractor and other requests must be referred to ATIN: ATZS-
CDI-D, t,J.S. Army Intelligence Center of Excellence, Fort Huachuca,  AZ 85613-7017, or via e-mail at usarmy.huachuca.icoe.rnbx.doctrlne@mail.mil. Requests to release this do.cument to foreign ~ntities must be referred to the requestor's supporting foreign disclosure office.

.

.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document in accordance with AR 380-5.

This publication supersedes ATP 2-22.9 dated 10 July 2012.

Headquarters, Department of the Army Headquarters, United States ~arine Corps

# Forofficial Use Onl'R

r .

(U) This publication is available at the Army Publishing Directorate site (http://Www.apd.army.mil), and the Central Army Registry site (https://atiam.train.army.mil!catalog/
dashboard).

(U) This publication is available at the U.S. Marine Corps Doctrine
website (https.!!doctrine.usmc.mil).
Headquarters Department of the Army Army Techniques Publication No. 2-22.9
Washin~on, DC
Marine Corps Reference Publication No. 2-JOA.J
Headquarters United States Marine Corps Deputy Commandant Combat Development &
Integration Quantico, Virginia
30 June 2017

## Open-Source Intelligence (U) . Contents (U)

PREFACE **(U)** !~       v
INTRODUCTION (U) ........ ; ........ vii

## Part One Fundamentals (U)

Chapter 1
OPEN-SOURCE INTELLIGENCE {OSINT) OVERVIEW (U) ,; ........ 1-1
Defining OSINT (U) ........ , ........ : ........ ~ ........ 1-1
Operations Security and Publicly Available Information (U) ........ ........ 1-2 OSINT Characteristics (U) ........ ........ ........ ........ .. ....... ...... .. ...... .. : .... 1-2
The Intelligence Warfighting Function (U) ........ 1-3
OS INT Within the Intelligence Enterprise (U) ........ : *........*........ 1'-4 .
Processing, Exploitation, and Dissemination (U) ........ 1-7
The Military Decision-Making Process/Marine Corps *Planning Process* (U) ........ 1-7
Intelligence Preparation of the Battlefield/Batt/espace (U) ........ .-........ 1-8
Chapter 2
OS INT STRUCTURES (U) ........ 2-1
OSINT Capabilities (U) ........ : .... : .... ........ ........ 2-1
OSINT ...:.Brigade Combat Team and Below and Marine Air-Ground Task *Force* (U). 2-1

determination 'as made on 10 February 2017. Contractor and other requests must be referred to ATTN: ATZS-
CDI~D . U.S. Army Intelligence Center of Excellence, Fort Huachuca, AZ 85613-7017, or via e-mail at usarmy.huachuca.icoe.mbx.doctrine@mail.mll. Requests to release this document to foreign entities must be referred to the requestor's su.pporting foreign disclosure office.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document in accordance with AR 380-5.

This publication supersedes ATP 2-22.9 dated 10 July 2012.

Contents (U)

OSINTDivision and Above (U)........ A
P
T S
e 2-4
Service OmamZalions (Ll).....c
oo
aosamsasis PE 2-6
OSINT -Division and Above (U) ........ -........ 2-4
Service Organizations (U) .. ........ ... ........ .... .. .. ........ . _. .. ........ 2-6

## Part Two Osint And The Intelligence Process Part Two Osint And The Intelligence Process

Chapter 3
PLAN AND DIRBET 1) ncmmreasmmmvnisssinsmssasessmssssimmsssainniimnstamamsiis
s 3-1
Information Collection and OSINT (U) .....ccccvvnenee. B SV
 3-1
Intelligence Missions and Information Requirements (U) ....icovevcininiernnen TRN 3-2 Py erOSiNT ACLIIUES (L) isaunmisvaammmmammmnns
sy osmmmoms s 3-2
Preparation Considerations for OSINT Elements Accessing the Internet (U) .....,.... 3-5
Chapter 3
PLAN AND DIRECT (U) ........ 3-1
Information Collection and OSINT (U) ... ... ........ 3-1 Intelligence Missions and Information Requirements (U) .... , .. .... ........ .-........ 3-2
Planning for OS INT Activities (U) ........ ........ ........ 3-2 Preparation Considerations for OSINT Elements Accessing the Internet (U) ..... , .... 3-5
Chapter 4
COLLECT (U) .... _
........ ~ ........ 4-1
OSINT Collection Activiti_es (U) ........ ....... ........ : ........ 4-1
Chapter 4
COLLERT () nrecsvmomsmasmmsmmmrsmsssseinistissis o S-L 4-1
OSINT Collection ACtiVItIES (U) ieeiiviiiiviiiineiieniiienieiies
s
sessanessissnns e A 4-1
Types of Open-Source Information (U)........ccoueiiiimmmmimnieec
e, 4-2
 Types of Open-Source Information (U) ........ ..... 4-2
.
CISINT LBUEHON (L)
e sinmissmuisminsmmmmnssm
i
s
s s
W ST
TS 4-2
OSINT Collection (U) ........ .. ........ .. ........ ........ 4-2
Chapter 5
g
Ry
S L
S
U
U
U S  5-1
Processing Information (U) ...
e 5-1
Types of Intelligence Products (U) i......c.coivirmriiimiimnisciniinmninee
s 5-2
EVBIUETING IO, CLB} oo cnanmsiing somswmmmmyorminmmmiissssinsshnmmmsnnnssssiine
Srssraman sl
(s 5-3
Chapter 5
PRODUCE (U) ........ ; ........ 5-1 Processing Information (U) ........ ........ .. ...... ........ ... 5-1
Types of Intelligence Products {U) ........ ........ ........ ... 5-2
Evaluating Information (U) ... ........ : ........ ........ ........ .... ........ 5-3
Chapter 6
DISSEMINATE (U).sevuueereersmneessisnsssersessssessssenes T  6-1
B C T 1) S 8-1 Dissemination Methods and Techniques (U) ........cccocvoviviniiiininnnes N e-1
Reporting Methods (U)........ U
  1
Chapter 6
DISSEMINATE (U)., ........ ~ ........ 6-1 Dissemination (U) ........ .. .. ........ .. ........ ........ 6-1 Disse-mination Methods and Techniques (U) .... ........ ........ : ........ ... 6-1
Reporting Methods (U) ....... .. ........ _. ........ _.: ........ 6-2
Appendix
A
LEGAL RESTRICTIONS AND REGULATORY LIMITATIONS (U)...coveemererirerenns A-1
Appendix A
LEGAL RESTRICTIONS AND REGULATORY LIMITATIONS (U) ........ A-1
Appendix B
SECURITY AWARENESS (U) ...ccccvveivinieniciinianns AN
s
N
T
RS
RS) B-1
Appendix .B
SECURITY AWARENESS (U) ........ ; ........ ~ ........ 81
Appendix C
BA$1C AND ADVANCED INTERNET SEARCHES (U) ........ C-1
Appendix D
OPEN-SOURCE_ RESOURCES (U) ........ ~ ........ D-1
Appendix
C
 BASIC AND ADVANCED INTERNET SEARCHES (U) c.ccvvuveerrersrereesssessessersessseseee c-1
Appendix
D
OPEN-SOURCE RESOURCES (U) .uuuuvueuurmeesseerississnssissmnssssessssnssssnsesssstans D-1
RERRET it
R
s Glossary-1
GLOSSARY (U) ........ ~ ........ Glossary-1
REFERENCES
1
1
| SO P
 References-1.
REFERENCES (U) ........ : ........ References-1 -
 1 4
N O
OO
PRPRUS. SO
- RS Index-1
INDEX (U) ........ : ........ : ........ Index-1

## Figures (U) Figures (U)

-
Fi_gure_ 1-1 . (U) Intelligence relationships among regional communities of interest... ........ 1-5
- Figure 1-2. (U) Marine Corps intelligence relationships ........ W
R r 1-6
 Figure 1-2. (U) Marine Corps intelligence relationships .; ........ .. : .. ....... ....... ........*......* 1-6
~
Figure 2-1. (U) Brigade combat team OSINT Cell @XaMPIE.......cocvrivrierieereerieeeeirerissesereesessesessereees 2-2
Figure 2-1. (U) Brigade coin bat team OS INT cell example ........ : ........ 2-2
Figure 2-2. (U) Marine-air ground task force intelligence center OSINT
cell example........ 2-3
Figure 2-2. (U) Marine~air ground task force intelligence centerOS!NT cell example ...... *....*...... *..* 2-_3
- Figure 2-3. (U) Division and above/Major subordinate command OSINT cell example........c...... 2-5

.  Figure 2-3. (U) Divi~ion and above/Major subordinate *com(Tiand* OSINT cell example_ ........ ,. 2-5

Figure 3-1. (U) Planning for OSINT activities ........ R  3-3
Figure 3-1 . (U) Planning for OSINT activities ..... , ........ ........ .. ........ 3-3
.
..
,

## - Tables (U) - Tables (U)

.
. Table 3-1. (U) OSINT preparation considerations ...
i 3-5
_Table 3-1. (U~ OSINT prepara_tion considerations ..... ........ : .. : ........ 3-5
' Table 4-1. (U) Open-source media, components, and elements........cccocuviieeninininene, 4-3
Table 4-1. (U) Open~source media, ~ompon?nts, and elements ........ ........ 4-3

ATP 2-22.91MCRP 2-10A.3
30 June 2017
ATP 2-22.9/MCRP 2-1(JA.3
30 June 2017

Contents (U)
Contents (U)

. Table C-1. (U) Boolean logic operators, connectors, and delimiters ........ e
C-3
.
.
. 'Table C-1. (U) Boolean logic operators, connectors, and delimiters ........ C-3
Table C-2. (U) Common website domains ........cccumveinrirecisvonnmsnssinenn, S S
m C-6
Table C:-2. (U) Common website domafns ........ ........ ........ : ........ : ........ C-6
'
Table C-3. (U) Interhet country code examples ........cccceevveveiiiverenenns YUCIRpT C-8
Table C:.3. (U) Internet country code examples ........ C-8
Table D-1. (U) Military networks and research portals........cccceceeeoiviniiinineececininene, D-1
Table D-1. (U) Military networks and research portals ........ ........ D-1
Table D-2. (U) Newspapers and NEWS fEBUS ........oveierierieienreresesisesnesiosesese
e
e sesneseseessaens D-2
Table D-2. (U) Newspapers and news:teeds ........ ........ ........ 0 ~2
Table D-3. (U) U.S. military organizations and Federal agencies........ccccociivimievninniincneccnennne, D-2
Table D-3. (U) U.S. military organizations and Federal agencies ........ D-2
ST
IR T ST D-6
Table D-11. (U) Internet portals ........ ..... ........ D-6
'Table D-12. (U) Mapping and infrastructure bortals ...... S  S
e
T D-6
Table D-12. (U) Mapping and infrastructure portals ..... : ........ ........ D-6
Table D-13. (U) Countries and geographiC @reas ........c.co.vieieeimieniimieennieeiviessmreesianssisesssnnesnnnne D-7

Table D-13. (U) Countries and geographic areas ........ ........ D-7
- Table D=14., (U) RESEAICN fOPICS .. ...icciiiieiiviienistiieiinriosiieiisreessirsismierssrionsnetsiesssseessessessssrseserees D-7
 Table D-14. (U) Research topics ........ D-7
Table D-15. (U) Conflict, threats, and military topics........' ....... S  D-9
Table D-15. (U) Conflict, threats, and military topics ........ D-9
30 June 2017
ATP 2-22.9/1MCRP 2-10A.3
30 June 2017
ATP 2-22.9/MCRP 2-10A.3
This page intentionally left blank.

## Preface (U)

(U) ATP 2-22.9/MCRP *2-JOA.3* establishes a common framework, foundational concepts, and methods of use for Army and Marine *Corps* open-source intelligence (OSINT) activities. It highlights the fundamentals of OSINT as an intelligence discipline and discusses the role it plays in the intelligence process. This publication addresses only ope~-source information.

(U) ATP 2-22.9/MCRP 2-JOA.3-

-
Establishes a common foundation for understanding OSINT.
-
Provides fundamental principles and terminology for Army elements and Marine Corps
organizations conducting OSINT activities.
-
Emphasizes the value of open-source information.
.
-
Describes systematic approaches to plan, prepare, collect, and produce intelligence from opensource information.
(U) The principal audience for ATP 2-22.9/MCRP *2-JOA.3* is-

-
A1my or Marine *Corps* intelligence staffs at battalion, brigade/Marine air-ground task force,
division, corps, and theater army/ Marine *expeditionary force* that collect open-source information
or use OSINT to aid intelligence analysis or support the military decision-making process/Marine
Corps planning process.
-
Army intelligence personnel (military, civilians, and contractors) assigned, attached, detailed to,
or supporting Army intelligence organizations, units, or elements with an authorized OSINT
mission.
-
Army intelligence elements or Marine Cor:ps *organizations* conducting OSINT activities.
-
Strategic, operational, and tactical commanders who require OSINT to address specific
intelligence requirements to support planning and operations.
(U) Cyberspace is a global domain within the information environment consisting of the interdependent network of information technology infrastructures and resident data, including the internet, telecommunications networks, computer systems, and embedded processors and controllers (JP 3-12[R]).

(U) Commanders and staffs of Army/Marine *Corps* headquarters serving as joint task force or multinational headquarters should also refer to applicable joint or multinational doctrine concerning the range of military operations and joint or multinational forces. Trainers and educators throughout the Army/Marine *Corps* also use this publication.

(U) Commanders, staffs, and subordinates ensure their decisions and actions comply with applicable United States (U.S.), international, and, in some cases, host-nation laws and regulations. Commanders at all levels must ensure their *Soldiers/Marines* operate in accordance with the law of war and the rules of engagement.

(See FM 27-1 0.)

## Preface (U)

(U) A TP 2-22.9/ MCRP *2-1* OA.J uses joint terms where applicable. Selected joint, Anny, and Marine Corps terms and definitions appear in both the glossary and the text. This publication is not the proponent for any Army/Marine *Corps* terms. (See the page vii for style conventions used to identify terms in this publication.)
(U) The use or mention of the name of any commercial or private organization or its associated trademark or services by the Army/Marine *Corps* does not express or imply an endorsement of the sponsor or its products and services by the Army/Marine Corps.

(U) ATP *2-22.9/MCRP* 2~10A.3 applies to the Active Army and Marine *Corps,* the Army National Guard/Army National Guard of the United States, the U.S. Army Reserve, and the U.S. Marine Corps Reserve, unless otherwise stated.

(U) The proponent of ATP 2-22.9/MCRP *2-JOA.J* is the U.S. Army Intelligence Center of Excellence. The preparing agency is the Capabilities Development and .Integration Directorate, U.S. Anny Intelligence Center of Excellence, Fort Huachuca, AZ. Send  comments and recommendations on a DA Form 2028
(Recommended Changes {o Publications and Blank *Forms)* to Commander, U.S. Army Intelligence Center of Excellence, ATTN: ATZS-CDI-D (ATP 2-22.9), 550 Cibeque Street, Fort Huachuca, AZ 85613-7017; by e-mail to usarrny.huachuca.icoe.mbx.doctrine@mail.mil; or submit an electronic DA Form 2028.

(U) U.S. Marine Corps readers of this publication are encouraged to submit suggestions and changes through the Universal Need Statement (UNS) process. The UNS submission process is delineated in MCO 3900.20, which can be obtained from the Marine Corps Publications Electronic Library online .

. (U) The UNS recommendation should include the following information:

- Location of change .
- Publication number and title .
- Current page number .
..
Paragraph number (if applicable) .
- Line number .
- Figure or table number (if applicable) . - Nature of change .
- Addition or deletion of text .
- Proposed new text .

## Introduction (U) Open-Source Intelligence And Current Operations (U)

(U) Circumstances have never been more favorable for using open-source information in developing intelligence to support operations. OSINT activities offer the following advantages:

-
Least intrusive.
-
Cost-effective.
-
Abundant sources of data and information.
(U) The increasing volume of potentially detailed information worldwide on the internet provides compelling reasons to use open-source information to defend the Nation. Despite the recent recognition ofOSINT as an intelligence discipline, OSINT is arguably one of the oldest forms of intelligence. Before the advent of satellites and other advanced technological means ofcollectinginformation, military professionals developed intelligence from open-source information to gain knowledge and understanding of foreign lands, peoples, potential threats, and armies. However, the world is reinventing itself on the internet, posting unprecedented amounts of information that become immediately available to the public. New techniques, technologies, data . .

sources, and emerging practices to develop OSINT products evolve at a substantial rate to meet the growth of open-source information worldwide. ATP *2-22.9/MCRP 2-!0A.3* explains OSINT fundamentals, and how to organize for and conduct OSINT assets while leveraging joint force and Department ofDefense (DOD)
enterprise capabilities.

(U) OSINT may only be conducted by intelligence professionals due to the 'authorities and restrictions placed upon intelligence personnel in Executive Order 12333 as amended, DOOM 5240.01, DOD 5240.1-R
AR 381-10, and *MCO 3800.*28. Commanders must ensure the activities of other warfighting domains operating in the cyberspace environment are de-conflicted with intelligence operations, and  intelligence collection activities are levied on intelligence elements.

(U) Further, for the Army, the Deputy Chief of Staff, G-2; the Commander, U.S. Army Intelligence and Security Command (INSCOM); the Commanders of Army Commands and Army Service Component Commands; and the Commander, 650th Military Intelligence Group'or their designees may grant, in writing, to assigned, attached, aligned, or detailed Army intelligence organizations, units, or elements the authority to conduct OSINT activities to support their intelligence missions.

Note. (U) Intelligence officers have a responsibility to advise thi: commander on the best ethical use of OS INT.

(U) Open sources possess much of the information needed to understand the physical and human factors of an operational environment. Many information and intelligence requirements can be satisfied with opensource information. Open-source information may increase situational . awareness. and can provide confirmation of information obtained through non-OSINT-related technical or classified resources.

(U) Access to the massive amounts of open-source information, including publically available information, is reshaping how people perceive the world. People can use open-source information to pursue a broad spectrum of objectives. The significance and relevance of OSINT provides an additional leverage capability and can cue technical or classified assetS'to refine and vaiidate both information and intelligence.

## Oversight Of Open-Source Intelligence (U)

(U) Only intelligence personnel perform the collection and exploitation of open-source information for the purposes of answering intelligence requirements. This publication applies to the military intelligence/ Marine Corps intelligence, surveillance, and *reconnaissance enterprise* use of open-source information; it does not address the use of open-source information by other branches and specialties. Activities conducted by others
(such as information operations, civil affairs, cyberspace operations, law enforcement, operations staff planners, security) fall under the purview of their respective centers of excellence or Marine Corps commands. Nonetheless, all warfighting functions are subject to restrictions on the collection and storage of non-DOD-affiliated U.S. person information. Although intelligence is the only warfighting function subject to intelligence oversight, all warfighting functions are required to comply with law.

Note. (U) Collection of information on U.S. persons is regulated by law and regulation. (See appendix A.)


## Style Conventions (U)

(U) "OSINT practitioners" indicate intelligence personnel in the Active Army and *Marine Corps,* the Army National Guard/Army National Guard of the United States, U.S. Army Reserve, the U.S. Marine Corps Reserve, the Army Civilian Corps, *Civil Marines,* .and contracted intelligence analysts who engage in authorized missions involving open-source information.

(U)Jn doctrinal publications, the normal convention for identifying terms is through the use of italics. Since this is a dual-designated Army and *Marine Corps* publication, the following protocol is used to distinguish proponency (authority) for information and terms:
\

-
Terms in bold italics and phrasing in italics-Marine Corps.
-
Terms in bold and definitions in plain 'text-joint and Army terms with the proponent publications
in parentheses.



## Summary Of Changes (U)

(U) ATP 2-22.9/MCRP *2-JOA.3* updates the following *Army/Marine Corps* doctrine on OSINT:

-
Chapter 1-
-
Incorporates the definition ofOSINT established by Public Law 109-163.
-
Adds the definitions of open-source information, publicly available information, and
collection.
~ . Chapter 2 provides information concerning organizations that conduct OS INT.
-
Chapters 3 through 6 are reorganized to follow the construct of the intelligence process.
-
Appendix A provides legal guidance on the collection of open-source information and OSINT.
-
Appendix B provides information on security awareness.
-  Appendix Cprovides a discussion on internet research techniques.
-
Appendix D 'provides a list of open-source resources.
\

## Part One Fundamentals (U)

(U) The passage of legislation has affected the United States (U.S.) intelligence community and its application of open-source information. The National Security Act of 1992 began the reformation of the U.S. intelligence community. This resulted In the establishment of the Open-Source Office in 1992, the Director of National! ntelligence Open Source Center in 2005, and the Open Source Enterprise in 2015. Part one describes the fundamentals of ope~-source intelligence (OSINT).

## Chapter 1 Open .. Source Intelligence (Osint) Overview (U)

(U) Chapter 1 discusses the role, characteristics, considerations, and employment of OS NT. OSfNT is a discipline within the intelligence warfighting function; as such, it provides timely, relevant, accurate, predictive, and tailored intelligence that focuses missions and operations. OSINT involves the collection, analysis, evaluation, synthesis, and processing, exploitation, and dissemination (PED) of information to answer intelligence requirements.

Note. (U) This publication applies to the collection, exploitation, and analysis of open-source information, including publicly available information (PAl), for the purposes of answering intelligence requirements. Only intelligence personner perform this task. Only intelligence professionals may conduct OSINT activities due to the authorities and restrictions placed upon them in Executive Order (EO) 12333 as amended, DODM 5240.01. DOD 5240.1-R.

DODI 3115.12, JP 2-0, AR 381- I 0, and MCO *3800.2B.* This publication does not apply to any of .

the other warfighting functions.

## Defining Osint (U)

I-I. (U) The definitions in this section are important in any open-source activity. They assist leaders and practitioners in understanding open-source activities and the authorities under which intelligence components conduct these activities.

1-2. (U) Open-source intelligence is intelligence that is produced from publicly available information and is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific 'intelligence requirement (Public Law I 09-163 ). The term also applies to the activity itself. OSINT activities are integral to the intelligence warfighting function (see ADRP 2-0 and MCDP 2)
and are conducted using the PED process, contributing to all-source analysis, tipping and cueing from other intelligence activities, and support to targeting activities.

1-3. (U) The intelligence resulting from open sources is produced by intelligence professionals, incorporating tips and cues from other disciplines, and is integrated into all-source analysis. The following terms a:re fundamental to understanding OSINT:

-
Open-source information: Information that any member of the public could lawfully obtain by
request or observation as well as other unclassified information that has limited public distribution
or access (JP 2-0).

-
Publicly available information: Information that has been published or broadcast for public
consumption, is available on request to the public, is accessible online or otherwise to the public,
is available to the public by subscription or purchase, could be seen or heard by any casual.
observer, is made available at a meeting open to the public, or is obtained by visiting any place or
attending any event that is open to the public. Publicly available information includes information
generally available to persons in a military community even though the military community is not
open to the civilian general public (DODM 5240.01).
-
Collection: Information is collected when it is received by a Defense Intelligence Component,
whether or not it is retained by the Component for intelligence purposes or other purposes.
Collected information includes information obtained or acquired by any means, including
information that is volunteered to the Component. Collected information does not include:
information that only momentarily passes through a computer system of the Component;
information on the internet or in an electronic forum or repository outside the Component that is
simply viewed or accessed by a Component employee but is not copied, saved, supplemented, or
used in some manner; information disseminated by other Components or elements of the
Intelligence Community; or information that is maintained on behalf of another U.S. Government
agency and to which the Component does not have !'ICCess for intelligence purposes
(DODM 5240.01).
1-4. CU) OSINT production contributes to all-source intelligence and the continuing activities of the intelligence process (analyze and assess), as described in ADRP 2-0 and *MCDP 2.* Like other intelligence disciplines, OSINT is developed based on intelligence requirements and can be used to cue or supportother intelligence disciplines.

## Operations Security And Publicly Available . Information (U)

1-5. (U) When using open-source information, operatio~s security (OPSEC) is a major concern. Denying the adversary clues to the Nation's plans and interests are of the upmost importance. (See chapter 3 and appendix B for more information on OPSEC.)
1-6. (U) PAl comes from many different venues such as broadcasting, publishing, and the internet. When accessing these venues, the user must practice good OPSEC procedures and obtain the information in the least intrusive way. With leaks of classified information to the internet, users must know that some opensource information has not been downgraded and collection may cause data spillage on a Department of Defense (DOD) Nonsecure Internet Protocol Router Network (NIPRNET) system.

## Osint Characteristics (U)

1-7. (U) The following characteristics frame the role ofOSINT in Army and *Marine Corps* operations:

-
OSINT provides the foundation. Open-source information provides foundation information and
real-time ongoing information updates to assist in developing and enhancing intelligence products
and the intelligence disciplines. There is much information about the political, military, economic,
social, and infrastructure of a region or local area obtainable from open-source information and
readily changed to OSINT products. This foundation information and intelligence products can be
essential to generating a clear picture for the commander. The variety of foundational websites
associated with social structures, education systems, and news services provides a foundational
perspective for intelligence knowledge.
-
OSINT addresses requirements. The availability, depth, and range of open-source information
enable intelligence professionals to satisfy many priority intelligence requirements (PIRs) and
information requirements without using specializedhuman or technical collection means.
-
OSINT enhances collection. Open-source information supports other requirements a~d provides
information that optimizes the employment and performance of sensitive human and technical
collection means. Examples of this type of information include biographies, cultural information,
geospatial information, and technical data.
-
OSINT enhances production. As part of singie-source and all-source intelligence production,
the use and integration of OS INT ensure commanders have the benefit of all sources of available
information.
1-8. (U) OSINT supports the development and refinement of the collection plan to satisfy intelligence
 requirements, and may quickly fill information gaps to optimize the use of low-density collection assets.

OSINT supports situational understanding by-

-
Developing an understanding of complex situations by integrating intelligence and operations.
-
Supporting fused all-source analysis.
-
Providing tips and cues from other intelligence activities.
-
Supporting intelligence operations and activities in other intelligence disciplines.

## The Intelligence Warfighting Function (U)

1-9.  (U) Intelligence warfighting function is the related tasks and systems that facilitate understanding the enemy, terrain, weather, civil considerations, and other significant aspects ofthe operational environment
(ADRP 3-0). Intelligence is 1. The product resulting from the collection, processing, integration, evaluation, analysis, and interpretation of available information concerning foreign nations, hostile or potentially hostile forces or elements, or areas of actual or potential operations. 2. The activities that result in the product. 3.

The organizations engaged in such activities (JP 2-0). The Marine Corps amplifies the JP 2-0 definition.

Intelligence is knowledge about the enemy or the surrounding environment needed to support decision making. This knowledge is the result of the coller:tiqn, processing, exploitation, evaluation, integration, analysis, and interpretation of available information about the battlespace and threat. Intelligence is one of the six war.fightingfimctions (MCRP 1-10.2).

1-10. (U) The intelligence warfighting function includes understanding threats (enemies and adversaries)
and weather. It synchronizes information collection with the Army tactical tasks of reconnaissance, surveillance, security, and intelligence operations. Intelligence is driven by commanders-it is more than just collection. Developing intelligence is a continuous process that involves analyzing information from all sources and conducting operations to develop the situation. (See ADRP 2-0 and *MCDP 2* for fundamental intelligence doctrine. See FM 2-0 for doctrine on intelligence operations. See ADRP 3-90, FM 3-90-2, and MCRP 2-JOA.B for doctrine on reconnaissance and security. See FM 3-55 and MCRP *2-JOA.B* for doctrine on surveillance.)
1-11 . (U) The intelligence warfighting function facilitates support to the commander ~:~nd staff through a broad range of Army tactical tasks. (See ADRP 1-03 and MCO *3500.26A.)* The Army intelligence warfighting function tasks include-

-
Provide intelligence support to force generation.
-
Provide intelligence support to sitmitional understanding.
-
Conduct information collection.
-
Provide intelligence support to targeting and information capabilities.
1-12. (U) The Marine Corps intellz'gencefunctional tasks per MCO 3500.26A include-

-
Provide support to the commander 's estimate.
-
Provide intelligence to develop the situation.
-
Provide indications and warning ofthreat.
-
Provide intelligence support to force protection.
-
Provide intelligence support to targeting.
-
Provide intelligence support to combat assessment.
1-)3. (U) The intelligence warfighting function receives information from a wide variety of sources. OSINT, as an intelligence discipline, is produced from open-source information. PAl can be used to-

-
Support situational understanding of the threat and operational environment.
-
Develop intelligence about the enemy, terrain, weather, and civil considerations.
-
Generate intelligence knowledge before receipt of mission tci provide relevant knowledge of the
operational environment.
-
Contribute to satisfying intelligence requirements.
-
Develop a baseline of knowledge and understanding about potential threat actions or intentions to
support answering ongoing intelligence requirements.
-
Generate intelligence products as the basis for Army/ *Marine Corps* integrating functions such as
intelligence preparation of the  *battlefield/battlespace* (IPB). lPB is designed to support running
estimates and the military decision--making process (MDMP)/Marine Corps planning process
(MCPP). Many intelligence requirements are generated because ofiPB and its interrelation with
the MDMP/MCPP.
-
Support situation development-a process for analyzing information and producing current
intelligence concerning portions ofthe mission variables of enemy, terrain and weather, and civil
considerations within the area of operations before and during operations. (See ADRP 1-03.)
Situation cjevelopment-
-
Assists the intelligence staff in determining threat intentions and objectives.
-
Assists in confirming or denying courses of action (CO As).
-
Provides an estimate of threat combat effectiveness.
-
Support plan requirements and assess collection by contributing to the analysis of information
requirements, the identification of intelligence gaps, and the determination of assets to satisfy the
requirements. (See ATP 2-01 and MCTP 2-IOA.)

## Osint Within The Intelligence Enterprise (U)

1-14. (U) The intelligence enterprise is the sum of the intelligence efforts of the U.S. intelligence community.

(See ADRP 2-0 and *MCDP* 2.) The intelligence warfighting function is the Army's contribution to the intelligence enterprise. The intelligence enterprise comprises all U.S. intelligence professionals, sensors, systems, federated organizations, information, and processes supported by a network-enabled architecture.

The most important element of the intelligence enterprise is the people who make it work.

1-15. (U) OSINT contributes to the intelligence enterprise by providing information of intelligence value that answers or assists in answering intelligence requirements. Members of the OSINT regional communities
of interest may provide support through intelligence reach, granting access, and information sharing.

## Intelligence Reach (U)

1-16. (U) Intelligence reach is the activity by which intelligence. organizations proactively and rapidly access information from, receive support from, and conduct" direct collaboration and information sharing with other units and agencies, both within and outside the area of operations, unconstrained by geographic proximity, echelon, or command (ADRP 2-0). Units should understand all available intelligence reach options before deployment. (See figure !-!/figure 1-2 *on page 1-6.)* They can coordinate this through supporting regionally aligned military intelligence (MI) brigades (theater)/ Marine air-ground task force
(MAGTF) intelligence centers (M!Csf or combatant commands. The following includes other sources of information:


-
Supporting and supported combatant commands' joint intelligence operations centers.
-
Theater *army/Marine expeditionary force (known as MEF)* intelligence staffs.
-
National Ground Intelligence Center or the Marine Corps Intelligence Activity (MCIA).
-
Other intelligence community members described in chapter 2.
Note. (U) Higher echelon units that provide reach support should maintain an understanding of those units moving into and out of the supported combatant command's area of responsibility, and engage them, as necessary, to provide OSINT reach support.



-
Region.al combatant commands, their associated theater armies, and regionally aligned .l\11
brigades (theater).
Open Source Enterprise .
National Groun~ Intelligence Center .
National Geospatiai-Intelligence Agency .
Defense Intelligence Agency (DIA) .
-
The national-level intelligence community, which provides support through the-
- ..
-
-
National Security Agency.
-
Special operations community personnel who collect open-source information through the
appropriate authorities.

## Unclassified

1-18, (U) Figure /-2 illustrates internal and external Marine Corps intelligence relationships:

-
Marine expeditionary forces and M!Cs.
-
Regional combatant commands and their assoc:iated Marine Corps Service comportent commands.
-
The national-level intelligertce community, which provides support through DJA and MCIA.

## Granting Access (U)

119. (U) The proper management of access to dato.bases, information, and intelligence assists in ensuring personnel, units, and organizations obtain needed information. Digitized open-source information resides in classified and unclassified data repositories . While there is an abundance of information and toots available on the inte~net and DOD information networks, units should contact the Army Open-Source Intelligence Office (AOO) or *MC!A* and *M!Cr* to receive information about accessing specific open-source tools and services. The AOO provides information and support about access to open-source tools and data and provides training and account management for Army intelligence elements.


. .

I

## Lnformatlon Sharing (U) (B) (3) Processing, Exploitation, And Dissemination (U)

1-22. (U) Executing effective OSrNT requires resourcing, planning for, and preparing specific OSfNT PED
capabilities. OSlNT PED capabilitie~ can be organic to the intelligence unit, task-organized or attached to a supponed unit, or distributed from a centralized location through the network as required. Units can execute PED using expeditionary and reach iechniques. At the basic level, the intelligence warfighting function observes details about the threat and relevant aspects of the operational environment. It collects dataprocessed and exploited into useable information.....:..for analysis and production that results in intelligence.

Army doctrine has tong recognized the functions of processing, initial analysis, and reporting, as well as the requirement to provide combat information,

1-23. (U) Expeditionary PED is the deployment of lailored formations of tactical, operational, and/or
strategic intelligence *Soldiers/Marines* and enablers to support commanders. Expeditionary PED may be necessary when-

-
Infrastructure is underdeveloped.
-
Emerging technologies are employed.
-
Continuity of operation plans is required.
-
Reach capabilities cannot support high-priority, time-sensitive requirements.
1-24. (U) Reach PED is conducted from sanctuary locations. It leverages a robust communications infrastructure and pooled resources to provide multidiscipline intelligence PED support to deployed commanders. Reach PED reduces the number of forward-deployed Soldiers/Marines by shifting PED
functions to dedicated centers within the United States or other theater locations. Reach PED depends on assured communications to maintain uninterrupted mission support.

1-25. (U) OSINT PED includes the activitie:~ necessary to process infonnation into a useable fonn for ingestion into the intelligence process or for dissemination as combat information. For example, OS *TNT* PED
may include the translation of foreign language material into English {a useable fonn) for use during IPB. Advanced processing may involve digitizing, transcribing, and translating non-English graphics, recordings, and text documents into English-language text fonnat. Language-based processing activities require procedures and management to ensure transcripts and translations are timely, accurate, complete, and free of bias. Continuity of operation plans, commanders' requirements, and architecture limitations may require simultaneous employment of expeditionary and reach PED elements, For example, geospatial intelligence PED may be conducted through expeditionary means, while OS *TNT* PED may be conducted through reach to the M1 brigade {theater) or DIA.

## The Military Decision-Making Process/Marine Corps . . Planning Process(~

1-26. {U) The militAry decision-making process is an interactive planning methodology to understand the situation and mission, develop a course of action, and produce an operation plan or order (ADP *5-0).* The MDMP is the Army's seven-step analytical approach to visualizing the operational environment, the threat,
!lnd future operations. lt results .in an improved understanding and a plan or order guiding the force through preparation and execution. (See ADRP *5-0* for more infonnation on the MDJ1..1J>.)
l-27. (U) The Marine Corps planning process is a six-step methodology which helps organize the thought processes of the commander and staff throughout the planning and execution of military . operations. /(
focuses on the mis.sion and the threat and is based on the Marine Corps philosophy ofmaneuwr warfare. It capitalizes on the principle of unity of command and supports the establishment and maintenance of tempo.

The six steps consist of problem framing, course of action development, course of action war game, course of action comparison and decision, orders develop1'nent, and transition (MCRP I- I 0. 2).

Note. (U) Tenets of the MCPP include top-down planning, single-battle concept, and integrated
planning. (See MCWP 5-l 0 for more information on the MCPP.)
1-28. (U) Upon receipt of the mission or in anticipation of a new mission, commanders and staffs begin the MDMP. During step 1, OSINT is used to generate intelligence knowledge and assist in identifying gaps addressable by open-source information. Immediately following receipt of the mission, the commander and staff begin mission *analysislproblemframing,* the second *step/first step* of the *MDMPIMCPP.* Commanders and staffs analyze the relationships among the mission variables (mission, enemy, terrain and weather, troops and support available-time avail~ble and civil considerations [METT-TC]Imission, enemy, terrain and weather, troops and support available-time available *[METT-T]),* seeking to gain a greater understanding of the--

-
Operational environment, the threat, and operational variables (political, military, economic,
social, information, infrastructure, physical environment, and time [PMESII-PT]/political,
military, economic, social, iriformation, and infrastructure [PMES!I}).
-
Higher commander's desired end state.
-
Mission and how it is nested with the higher headquarters' mission.
-
Forces and resources available to accomplish the mission and associated tasks.
1-29. (U) Throughout the *MDMPIMCPP,* various staff elements use open-source information to perform open-source research to support nonintelligence activities (for example, to prepare functional area-specific running estimates, papers, briefings, plans, and orders). Intelligence analysts use open-source information to collect intelligence in order to produce products that assist the staff in updating its running estimates and producing initial assessments. The intelligence staff atso conducts OSINT activities to answer specific intelligence requirements. Major intelligence contributions to mission analysis occur as part ofiPB.

## Intelligence Preparation Of The Battlefieldibattlespa Ce (U)

1-30. (U) Intelligence preparation of the battlefield is the systematic process of a11alyzing the mission variables of enemy, terrain, weather, and cfvil considerations in an area of interest to determine their effect on operations (A TP 2-0 1.3 ), Intelligence preparation of the battlespace is the systematic, continuous process of analyzing the threat and environment in a specific geographic area (MCRP *2-JOB.l).* IPB is a four-step process, used to enhance situational understanding and awareness of the operational environment. By
 applying the TPB process, commanders gain insight to selectively apply combat power and maximize operational effectiveness at critical .points in time and space. (See ATP 2-0 1.3/MCRP 2-1 *OB.* I for IPB
techniques.)
1-31. (U) During IPB, OSINT makes significant and integral contributions to generating intelligence knowledge and satisfying intelligence and info.rmation requirements identified during the rvfDMPIMCPP.

Mission variables (METT-TCIMEIT-1), operational variables (PMESII-PTIPMESIJ), and civil considerations (areas, structures, capabilities, organizations, people, and events [kriown as ASCOPE]) are tools used to collect'essential information and intelligence, identifY information and intelligence gaps, and organize information and intelligence into functional categories. OSINT often identifies information gaps that require additional .collection and analysis.



## Chapter 2 Osint Structures (U)

(U) This chapter describes the framework for the organization of OSINT assets to enable commanders and staffs to leverage OSINT capabilities to address specific intelligence requirements.

## Osint Cap Abilities (U)

2-1. (U) Currently, the Army and *Marine Corps* lack a military occupational specialty for OSINT
practitioners. The commander or Army intelligence staff section (G-2/S-2/R-2) may organize OSINT assets, as necessary, to meet mission requirements. The intelligence staff must balance additional requirements for OSINT against requirements from other intelligence disciplines and complementary intelligence capabilities.

Any formation of an OSINT cell diverts personnel from other intelligence tasks and requirements.

2-2. (U) Generally, DOD and the intelligence community support OSINT collaboratively. The AOO
collaborates with all Army intelligence elements to operationalize the use of open-source data in all-source analysis.

2-3. (U) Options available for organizing an OSINT capability include-

-
Forming a dedicated cell of OSINT analysts.
-
Training selected analysts throughout the intelligence element to leverage OSINT to satisfy
intelligence requirements.
2-4. (U) Reach. The MI brigade (theater) should be leveraged for reach OSINT, regardless of the size or type of OSINT organization, the same way it provides reach support for other intelligence capabilities.

Contract support. Contract support can augment the organization, especially to provide continuity in subject matter expertise and to coach newly. trained OSINT practitioners.

## Osint-Brigade Combat Team And Below And Marine Air- Ground Task Force (U)

2-5. (U) Tactical commanders create OSINT cells from organic or reinforcing intelligence personnel
(including the PED platoon from the expeditionary MI brigade) when required to satisfY intelligence requirements.

Note. (U) Neither brigade combat teams *(BCTs)/MAGTFs* nor battalions have assigned OSINT
positions. Positions assigned to a task-organized OSTNT cell come from those within the unit.

## Brigade Combat Team And Below (U)

2-(i. (U) Figure 2~ 1 on page 2-2 illustrates a BCT OSINT cell formed from organic personnel. Positions might include-

-
Section leader.
-
Situation development analyst.
Target development analyst.
- Requirements manager.
-

## S~Tion Leader (U)

2-7 , (U) The section leader-
-
Serves as the primary liaison and coordinator with the BCT intel.ligence staff.
-
Over.;ees th.e BCT OSJNT cell.
-
Prioritizes task~ based on intelligence requirements.
-
Monitors ongoing intelligence support required by the BCT intelligence staff.
-
Ensures the inclusion of all OSJNT products in the planning of current and future operations.

## Requirements Manager (U)

28.
(U) The requirements manager-
-
Ensures situation development and target development to support the intel!lgenc:e s~ff's efforts.
-
Verifies the availability of collection assets.
-
Checks for similar requirements and finished products.
-
Perfonns quality control for situation development and target development products.
-
Supervises the receipt, integration, and dissemination of OSINT products. .

## Situation Development Analyst (U)

2-9.
(U) The situation development analystv
Monitors open-source infonnation for infonnation relevant to situation development.
-
Integrates information received on threat intentions, objectives, combat effectiveness, and
potential missions.
-
Confirms or denies threat COAs based on open-source information.

## I Target Development Analyst (U) [ __ Marine A Ir Ground Task Force (U)

2-11 . (U) Figure 2-2 illustrates a MJC OSINT cell form ed from organic personnel. Positions might include-
-
OS INT officer in charge.
-
OS! NT analyst.
-
OS INT subject matter expert.
-
OS! NT collector.
-
OSJNT chief

## Os Int Officer In Charge (U)

2-12. (U) The OS!NT officer in charge-
-
Serves as the primary liaison and coordinator with the M!C OS!NT staff
-
Provides supervisory and managerial capacity oversight.
-
Prioritizes tasks based on (ntelligence requirements.
-
Ensures the inclusion of all OSJNT products in the planning of current and future operations.

## For Officiab Use Only Osint Subject Matter Expert (U)

2-13. (U) The OSINT subject matter expert-
-
Captures open-source tradecraft.
-
P~rforms the quality control of situation development and target development products.
-
Serves as the OSINT Community of Practice representative.

## Osint Chief (U)

2-14. (U) The OSINT chief-
-
Monitors ongoing intelligence support required by the MIC staff
-
Supervises the receipt, integration, and dissemination ofOSINT products.
-
Manages OS! NT requirements and provides the estimate of supportability.

## Osint Analyst (U)

2-15. (U) The OS/NT analyst-
-
Monitors open-source information for information relevant to situation development.
-
Confirms or denies threat COAs based on open-source information.
-
Analyzes information and produces current intelligence about the enemy, weather and terrain,
and civil considerations before and during operations.

## Osint Collector (U)

2-16. (U) The OSINT collector-
-
Validates open-source information sourcing.
-
Verifies the availability of collection assets.
-
Provides open-source information on threat capabilfties and limitations.

## Osint-Division.And **Above** (U)

2-17. (U) Each theater army or *Marine expeditionary force* may have a task-organized OSINT element in scope and personnel within itself or within a major subordinate command *(lv!SC)*. At the division and above/MSC level, it is common for commanders to create OSINT cells from organic intelligence personnel.

2-18. (U) At the division and above/MSC level, OSINT cells are task-organized within the echelon intelligence staff. These cells exploit open-source information from all available sources. Any task-organized OSINT cell at the division and above/MSC level should support intelligence staffs at the BCT and
. *below/MAGTF* level by providing analytical products specific to the area of operations.

2-19. (U) While division and above/MSC organizations task-organize personnel to fill OSJNT cells based on requirements, typically the organization of the cell is based on operational variables (PMESil-PT/PMES/1).

Although intelligence staffs may have the requirement to provide intelligence for multiple areas, using the analytical construct of .the operational variables provides the focus for collection and analysis. OSJNT
practitioners should leverage foreign area officers, the civil affairs staff, and other staff elements who use open-source information.

## Resource Requirements (U)

2-20. (FOUO) OSINT practitioners should have access to unclassified and classified networks in the same space in order to collect information, contribute to fused all-source analysis, tip or cue assets to act on timesensitive targeting information, and perform processing, exploitation, and analysis. There is no requirement to locate the OSINT cell inside the sensitive compartmented information facility if the unit mission only requires access to open-source information.

2-21, ~
The number of OSJNT pr~~etitioners is based on intelligenco requirements, the 111ission, Wld the federation of OSINr requirements or !eve! of suppon provided through reach (such as the MI brigade
[theater]). The OSINT collection activity requires the unit to have the following:

 -
Required
intelligence
oversight
-
Risk assessment, OPSEC assessment, or
mechanisms.
both.
-
An OSINT training and tradocraft strategy.
-
. Collection plan.
-
Appropriate security classification guides.

## Personnel Dunes (U)

 2-22, (U) Figure 2-3 illustrates a. task-organized OSINT .cell at the division and above/MSC level. The cell might include-

analysts.

-
Team lead and requirements collection
manager.
- Two target development and production
-
Two linguists.
-
Situation development and
productio~
analyst.

Situatlo~
!
Target
Target
1
,.
. I
I
f
Development and
Development and i
Development and
Linguist
Linguist
Production
.
Production
Production
i
!.
..
l
(
Analyst
:
Analyst
\
Analyst
'
l
'
l
.. .
. ". - .
.. -
.. ... -~ .
~ - ' .
-.
;
.
. '
, __ ....

## Team Lead And Requirements Collection Manager (U)

2-23. (U) The team lead and requirements collection manager-

-
Serves as the liaison with the MI brigade (theater).
-
Provides ~It-level intelligence oversight.
-
Ensures the cell has the appropri_ate a~ess to tools and data from the supporting MI brigade
(theater)/M/C or higher headquarters.
-
Trnins the eel!.
-
Prioritizes tasks based on intelligence requirements.
-
Ensures a survey of the internet environment is performed for the area ofoperaiions (for example,
detei"!Tlines the percentage of the population using the internet and the t pes of usage).
-
Inputs the unit's commercial content requirements into
(b) (3)
if required, and monitors
CQmmunity responses.
.
-
Inputs the unit's information requirements into!
(b) (3)
lond monitors community responses.
-
Performs cell production quality control and supervises dissemination.
-
Ensures the inclusion of relevant products in the planning of current and future operations.

## Situation Development Rnd Production Analyst (U)

2'24, (U) The situation development and production analyst-
-
Monitors OS INT products from the MI brigade (theater)/ *MJC* and other OSINT producers.
-
Collects and analyus open-source informaJion based on intelligence requirements.
-
Tips or cues other intelligence disciplines.
-
Alerts the Intelligence noncommissioned officer in charge or OSINT technician of mission-critical
information.
-
Produces current intelligence about the threat, tmain, and civil. consideration's.

## Target Development And Production Analysts (U)

2-25. (U) The target development and production analysts-
-
Monitor OSINT products from the l\11 brigade (theater}/ *MJC* and other OSOO producers.
-
Collect and analyze open-source informadon based on intelligence requirements.
-
Tip or cue other intelligence disciplines.
-
Alert tho intelligence noncommissioned officer in charge or inteUigence technician of missioncritical information.

## (B) (3) Linguists {U)

2-26 .. (U) Linguists perform translation, tnmscription, and interpretation tasks; (See pe.ragraphs 3-39 through
3-42 and paragraplui *.55* through *58* for additionaJ information on language support.)

## Service Organizations (U)

2-27. (U) OSJNT activities are conducted throughollt the national and defense intelligence enterprise. The NationaJ Open-Source Committee (NOSC) is the body of representatives that meet to collaborate on OSfNT
issues and requirements and reports to the Board of Governors. The Defense Open-Source Council (DOS C)
represents OSTNT communities of interest in the defense intelligence enterprise ..

## Army Chief Information Officerig-6 (U)

2-28. (~The Army Chieflnformation Officer/G-6 provides-
-
Guidance and resource planning for OSfNT -unique network and technical requirements.
-
Guidance to Army commands regarding commercial circuit connections to the internet in support
of Army open-source activities.


## Army Deputy Chief Of Staff, G-2 (U)

2-29. (U) The Army. Deputy Chief of Staff, G-2-
-
Serves as the functional proponent for U.S. Anny OSINT policy, strategic planning. and
programming.
- Represents the Army at the NOSC and OOSC and coordinates Army OSINT programs and
activities through them.

-
Provides strategic planning for OSINT activities and resource planning.ror OSINT operations, as
authorized and directed by the Director of National Intelligence and the Secretary or Deputy
Secretary of Defense or the Under Secretary of Defense for Intelligence; coordinates U.S. Army
OSOO functional requirements during millta ry and national intelligence programmatic processes.
- Coordinates with the Army Chief Information offi~er/Deputy Chief of Staff, G-6 for unique
nen.,.ork requirements to support OSrNT activities.
-
En~ures U.S. Army intelligence elements conduct OSINT activities in compliance with U.S. law,
the Director of National Intelligence, DOD,. and Anny policies, guidelines, and restrictions,
particularly those regarding intelligence oversight rules and procedures.

## U.S. Army Intelligence And Security Command, Army Osint Office (U)

~--:-=---:---:-:----:-~(b~),_('-::3~-------_j Army units that want to establish an OSINT
capability should consult the AOO.

2-J I. (FOUO) For the Army, the AOO-

-
Serves as a start point for units interested in OSINT capabilities.
-
Trains, certifies, and provisions Army intelligence professionals.
-
Pro~isio~s Army inteiHgence profes-sionals based-on the Army's operational prio rliles. - -
-
Enables operational OSINT activities for Army intelligence elements,
2-32. (~INSCOM supports each geographic combatant command through its subordinate, regionally focused Ml brigades {theater). Each Ml brigade (theater) addresses intelligence requirements and provides support to Army tactical units deploying to or operating within the supported combatant command's area of responsibility. The reach support provided by Ml brigades (theater) includes OS INT.

## Marine Corps ]N1Elligence A Ct/Vlty (U)

2-33 . (U) The MCIA 'sCenter for Marine Expeditionary Intelligence Knowledge OS!NT Cell is thB OSJNT
hub for the Marine Corps intelligence, .surveillance, and reconnaissance enterprise. MCI.A OS!NT pur .rues profe.ssionalization and development of the OS/NT discipline in the enterprise lhrough the development and maintenance of the OS! NT Community of Practice, doctrine, policy, and the development of innovative OSINT practices and tradecrafl.

## Department Of The Army Intelligence Informatjon Service (U)

2-34. (U) DA US provides a broad spectrum of intelligence suppon functions to Anny intelligence components and international intelligence community partners. I! is the primary dissemination proponent for the Army. DA IIS is an operational element of the Army MI, Intelligence Community Information Management Directorate and administratively assigned to Headquarters, INSCOM.

2-35. (U) DA TIS provides OSINT support to partners conducting foreign Intelligence collection, analysis, and pr~duction missions. It is the Army's open-source reG
ents manager for validating information requirements and managing Ann~ .acco~!lt~_~iQi i.!!Ljfu__@)
and other intelligence community and DOD
capabilities.

{b) (3) -------.. --------
l

## U.S. 'A.Rmv Intelljgence Components (U)

2-37. (U) All commanders of intelligence components authorized to conduct OSINT will, when conducting OSINT activities:

-
(~
Ensure that risk assessments arc conducted to support OSINT collection by command
and subordinate units; that intelligence personnel receive specific OSINT OPSEC training; and,
when conducting risk management level I a~ivi ti es, that intelligence personnel are trained in the
use of managed at1;ribu1ion.
-
(U) Ensure annual intelligence oversight training specific to OSJNT, including the use of social
media is conducted and oversig!:lt of OSINT collection activities occurs.
-
(U) Submit requests for OSJNT informa~ion through I
(b) (3)
I to deconflict existing
requirements and products and post new unit requests as needed. Anny commands with available
intelligence Wlalysis capacity and a mission to conduct analysis activities in support of the
intelligence communi , ooo, or other Army intelligence requirements are encourage1:l to
routinely review
(b) (3)
and provide
answers where possible. The
(b) (3)
and Headquarter5, JNSCOM manages
Army accounts.

## U.S Army Cyber Command (U) Part Two Osint And The Intelligence Process (U)

(U) Part two discusses OSINT within the intelligence process. The Army views the intelligence process as a model that describes how the intelligence warfighting function develops intelligence that facilitates situational understanding and supports decision making. The steps of the intelligence process are plan and direct, collect, produce, and disseminate. Analyze and assess are the two continuing activities that occur continually throughout the process. Chapters 3 through 6 each address an intelligence process step. Since the continuing activities occur during all steps, each chapter incorporates discussions of these activities, placing them in the various contexts in which they occur.

## Chapter 3 Plan And Direct (U)

(U) The plan and direct step of the intelligence process closely corresponds with the plan activity of the operations process. The plan and direct step starts well in advance of detailed planning. It includes activities such as open-source collection, intelligence reach, and analysis. These activities produce the initial intelligence knowledge about the operational environment. After receipt of mission, intelligence analysts prepare planning products for the commander and staff for orders production and execution of operations. OSINT products support the plan and direct step by attempting to provide a context for understanding classified information. OSINT products may also reduce large target sets by quickly filling information gaps and allowing the efficient use of low-density intelligence collection assets.

## Information Collection And Osint (U)

commander's guidance-

.
.
-
Is expressed in terms of describe, visualize, and direct.
-
Provides the cornerstone of guidance used by OSINT practitioners.
-
Validates intelligence and information requirements.
3-3.

(U) Commander's critical information requirement is an information requirement identified by the commander as being critical to facilitating timely decision making (JP 3-0). CCIRs comprise two types of requirements: .

-
Priority intelligence requirement is an intelligence requirement, stated as a priority for
intelligence support, that tbe commander and staff nee'd to understand the adversary or other
aspects of the operational environment (JP 2-0 I).
-
Friendly force information requirement is information the commander and staff need to
understand the status offtiendly force and supporting capabilities (JP 3-0).
3-4.

(U) Open-source information is used to answer specific information requirements developed during planning requirements and assessing collection (see ATP 2-01 and *MCTP .2-JOA)* and IPB (see ATP 2 *01.3/MCRP 2-JOB.J).* The collection of open-source information is a means to analyze mission variables *(METT-TCIME1T-1)* and operational variables (Prv!ESII-PTIPMES/1) . .

## Intelligence Missions And Information Requffiements (U)

3-5. (U) To conduct OSINT activities, the commander or designated authority (for example, the G-2/S-2/R-2, analysis and control element chief, collection ,manager) must ensure the foliowing:

-
The command, organization, or element has obtained authority to conduct OSINT activities.
-
Forward-s~ationed or forward-deployed units establish an OSINT collection plan aligned to the
supported combatant command. This plan is retained for unit leaders and intelligence oversight
officials to review annually.
-
Continental U.S.-based global response forces, regionally aligned forces, reachback.elements, and
other continental U.S:-based support elements planning to conduct OSINT activities must align
their mission to a supported combatant command's intelligence mission, and document the
mission in an established collection plan that is retained for unit leaders and intelligence oversight
officials to review periodically, per DODM 5240.01.
-  The OSINT collection plan must also identify and document information requirements reviewed
from the national intelligence priorities framework, integrated defense intelligence priorities,
theater operation plans, or the commander's P!Rs.

## Planning For Osint Activities (U)

3-6. (U) During the plan and direct step, commanders and staffs consider the following activities, as shown in figure 3-1, regarding open-source information and OS !NT:

-
ldentify information and intelligence requirements.
-
Categorize information and intelligence requirements by type.
-
Identify assets to collect information.
-
Determine collection techniques.

## Ide.Ntify Information And Intelligence Requirements (U)

37. (U) Intelligence and information gaps are identified during IPB. These gaps should be developed and framed in terms of the mission and operational. ~ariables to ensure the commander receives the information required to support all lines of operations or lines of effort. Upon receipt of open-source information, OSrNT
practitioners update lPB products and inform the commander of any relevant changes. Those responsible for producing OSJNT require clearly stated information and intelligence requirements to focus collection and production effectively. These requirements should be incorporated into collection plans.

Note. (U) OSINT cannot eliminate all unknown aspects or uncertainties that concern command~
and slllffs. During planning, the intelligence swff fills gaps with reasonable assumptions. Upon filling gaps with collected information, the intelligence staff develops databases -at the unit level to_make the irormation readily available. Analysts should routinely review requirements through
[
(b) (3)
since information to answer their requirements may exist. This reduces the number of new. requests for information (RF!s) from subordinato units or organizations.



## Categorize Information And Intelligence Requirements By Type (U)

.3-8.

(U) During planning requirements, the intelligence staff categorizes intelligence and information requirements by type based on mission analysis and friendly COAs. (See ATP 2-01 and *MCTP 2-/0A.)* Two important related terms that work in concert with categorizing requirements are PAr and private information;
-
PAl, in context with DODM 5240.01 (see paragraph 13).

## (B) (3)

 *Nore.* (U} The amount of classified information produced on any r e topic con be limited and taken out of context if ~iewed from a. solei classified perspective. _____ j~?._) _ _ _ _ _I
(b) (3)
This strengthens the credibility of OSINT
products that support all-source intelligence. OSJNT validation provides the ability to cue other essets, thus enhancing accuracy and precision.

## Identify Assets To Collect Information (U)

3-9. (U) The intelligence and operations staffs use the commander's guidance and PIRs to complete the information collection plan. The information collection plan is used to assign tasks to -subordinate units or submit requests to supporting intelligence organizations to achieve the desired information collection objectives. Therefore, it is imperative for intelligence and operations staffs to be familiar with the capabilities of any task-organized OSINT cell within their organizations. The information collection plan-

-
Is used to request collection and production support from joint, interagency, intergovernmental,
and multinational organizations.
-
Is used to task-organize and deploy organic, attached, and contracted collection assets.
-
Describes how the unit conducts remote, intelligence reach or distributed information collection
activities.
3-10. (U) When developing information collection tasks for subordinate units, the intelligence and operations staffs use the task and purpose construct for developing task statements to account for the following:

~
Who executes the task?
-
When will the task begin?
-
What is the task?
-
Where will the task occur?

## Determine Collection Techniques (U) . -

3-11. (U) Determining the open-source collection technique involves deciding the most effective way to acquire open-source information. The extent to which open-source collection yields valuable information varies greatly with the nature of the target and the subject involved. Collection techniques, depending cin operation complexities, can enhance the chances of satisfYing intelligence and information requirements.

3-12. (U) Research and collection on the internet require a risk assessment. The result ofthe risk assessment affects the techniques used for conducting OSINT activities. While portions of the internet that are publicly available may be open-source, knowledge of the techniques used to collect the information may cause the targeted individual, group, or nation to block, change, deceive, or turn off the source. Thus, techniques used for collecting open-source information must be addressed in the risk assessment.

3-13. (U) Collection requires access to the internet to acquire PAL OSINT practitioners apply the intelligence process to open-source information to produce a product and populate intelligence resources. Units can contact the AOO to identify requirements for *PAl* and open-source data and data sources. The AOO provides approved enterprise capabilities, resources, and solutions.

a ows econ tct10n wt exts mg requtrements an answers.

ew umt- eve s are a e as nee e .

with intelligence analysis capacity and an authorized mission are encouraged to routinely review requirements relevant 'to their area(ofoperations inl (b) (3)
land produce OSINT answers where possible.

Us in~ (b) (3)
!allows users to understand the scope of current OSINT activities in the DOD intelligence enterprise as well as obtain answers to the following:

-
Who has requirements?
-
-
Who needs additional commercial data
sources and what sources are needed?
Who can provide those commercial data
sources?
Who is answering requirements?
What requirements are answered?
Who else has similar requirements?
-  -

## Preparation Considerations For Osint Elements Accessing The Internet (U)

3-16. (U) OSINT cells and intelligence analysis elements conducting OSINT activities need proper preparation in the areas of policies, training, tradecraft, and accesses. Table 3-l identifies OSINT preparation considerations.

## . Unclassified

| - Understanding of the supporting OS INT community                                           | of    | interest.                                                                                     |
|----------------------------------------------------------------------------------------------|-------|-----------------------------------------------------------------------------------------------|
| - Possible co-location                                                                       | of    | unit OSINT analysts with established. OSINT organizations or leveraging reach                 |
| support from military intelligence (MI) brigades (theater), corps/expeditionary Ml brigades. |       |                                                                                               |
| -                                                                                            | OS    | INT training and tradecraft. Review Foundry, Open-Source Tradecraft Division, and the Academy |
| for Defense Intelligence for appropriate OSINT offerings, including those related            | to-   |                                                                                               |
| - Operations security.                                                                       |       |                                                                                               |
| - Intelligence oversight.                                                                    |       |                                                                                               |
| -                                                                                            |       |                                                                                               |
| Basic OSINT tradecraft .                                                                     |       |                                                                                               |
| - Advanced OSINT tradecraft.                                                                 |       |                                                                                               |
- Account access requirements. Contact the Army OSINT Office (AOO)fMC/A or the supported
combatant command:

## Unclassified

3-17. (U) Additional OSJNT considerations includo-
-
Compliance with lawS and policies.
-
Deception and bias.
-
OPSEC.
-
Copyright.
-
s~curity classification guidance.
-
Linguist support.
-
Use of socl~l media for OSINT purposes.
-
CDordination.
(b) (3)

## Compliance Wrrn Laws And Policies (U)

3-IS. (U) OSTNT is governed by EO 12333 as amended, DODM 5240.01, DOD 5240.1-R., and DODI 3115.12. AR 381-10 and MCO *J800.*2B implement these orders and policies for Anny and Marine Corps intelligence activiti~s, respectively. Anny and Marine *Corps* intelligence elements conducting OSINT
actiYities should periodically review DOOM 5240.01, DOD 5240.1-R, AR 381-10, and MCO 3800.28, focusing on authorities and restrictions pertaining to U.S. person information. (See appendix A for additional infonnation on the legal r~strictions and regulatory limitations on OSINT.)

## Operations Security (U)

J-19. (U) lntelligence personnel who collect open-source infonnation must pay careful atlention and comply with OPSEC requin:ments as delined in AR 530-1 !!Ild MCO *3070.2A* to pn:vent disclosure of critical and sensitiYe information in any public domain. Searches and visits to internet websites .leave a virtual footprint exploitable by both technically sophisticated and relatively unsophisticated adversaries. Anny intelligence component commanders should perfonn risk assessments before any internet collection activity with or without the use of secure web browsing techniques. (See appendix B for. information on secure web browsing techniques.) Risk as.ses.smenl!!i assist in balancing the risks and expected benefits of conducring the proposed OSTNT activity. Rlsk a.ssessment results affect how intelligence personnel conduct OSTNT a.GtiYities, as detailed in the infonnation collection plan, and the subsequent classification ofinfunnation.

3-20. ~
The results of risk assessment are instrumental when detennining Anny OSTNT risk management level status in accordance with U.S. Army DirectiYe 2016-37 and are as follows:

-
Risk management level 0: A risk assessment that determines the threat knowledge of the OSINT
activity will not pose a risk to imminent or ongoing military operations or intelligence priorities,
sources, or methods is o. risk management level 0 collection activity. Risk management level 0
activities require annual OPSEC training.
-
Risk management Ievell: A risk assessment that determines the threat knowledge of the OSrNT
activity could pose a risk ro imminent or ongoing military operations or intelligence priorities,
sources, or metnods is a risk management level l collection activity. Risk management level I
activities require that-
-
Intelligence professionals leverage OSlNT dara the intelligence community provides on
_government networks to the greatest extent possible before collecting open-source
infonnation from the intemet.

~~~----~(b~)~
(3~
) ~------~l .
-
Army intelligence components must obtain approval from Headquarters, lNSCOM; a national
intelligence agency; a combat support Rgency; or supported combatant command before
acquiring managed attribution capabilities.
-
Intelligence personnel complete !!Ilnual OPSEC training as well as training in managed
attribution.
3-21. (U) Since collection focuses on answering intelligence requirements, protection of both the type or duta collected and the source from which it is collected is a priority. For example, if a local newspaper or the threat realizes that friendly forces are using the newspaper to develop intelligence, the threat may deny access to the newspaper or manipulate the information it contains. This situation could make friendly forces a deception target or put them at risk by denying them information. Protection of OSINT sources includes discrete use of the sources .to prevent denial of access to the sources. The AOO can support unit requirements to identify and mitigate online risk while conducting OSINT activities.

3-22. ~U~
Personnel who have accessed websites in a risk management Ievell capacity may not acc.ess those same websites using personally owned electronic devices for the purposes ofOPSEC. This restriction does not apply to accessing commercially or publicly owned news media websites (such as CNN or ABC
News). The use of the internet for purely personal interests, which include academic research and news information or subscriptions, is not an OSINT activity.

3-23. (U) Reading classified information and then going to the internet to conduct searches on open-source information based on the classified information may alert the target of friendly force interest. Knowing where friendly forces seek information may cause a target to change its behavior or place a classified source at risk.

In some cases, this knowledge may endanger mission accomplishment or Soldiers'! *Marines'* lives. For this reason, it is important to obtain a current OSfNT classification guide and perform a risk assessment regarding OSINT collection.

## Security Classification Guidance (U)

3-24. (U) Jt is a common misperception that all information residing on the internet is automatically considered unclassified; however, there have been instances iri which-

-
Individuals intentionally leaked classified information to the public domain ..
-
An inadvertent disclosure of information was made available to unclassified sources.
-
Two or more separate pieces of unclassified information, when combined, become classified
information. (For example, a location, such as Abbottabad, and a person's name, such as Osama
Bin Laden, are not classified pieces of information in and of themselves. However, combining
those separate pieces of information~Osama Bin Laden is in Abbottabad-classifies the
information.)
Note. (U) An OSINT practitioner must be aware that collection of a classified document on a DOD
NlPRNET workstation constitutes a security violation.

3-25: (U) The exploitation, processing, and analysis of information holdings may increase the classification level. For example, two unclassified facts, when combined, could increase the classification of infonnation obtained. Furthermore, an OSINT practitioner must be aware that combining site searches may give away information about PIRs. All personnel performing OSINT activities must possess the appropriate security clearance and access.

3-26. (U) Units under the operational command of a combatant command are required to use the combatant command security classification guidance. If there is no security classification guidance relevant to opensource information, information should be unclassified, controlled unclassified, and releasable to foreign partners for official use to the extent possible. However, there are several circumstances for which this infonnation may or must be classified and/or not releasable. Security classification must be determined by judiciously considering all applicable elements- particularly the loss of a source of information or harm to an operational mission should the source be improperly revealed,
.---~--------------
------------------------

## (B) (3) Coord1Natlon (U)

3-28, (U) The collection of open-source information requires coordination with higher and adjacent units to ensure the open-source collection effort is not redundant. Routine deconfliction of open-source collection allows units to focus on infonnation specific to tbeir area of operations.

BCT!MAGTF would focus its open-source collection at 1he district and.neighborhood levels.

329. (U) During planning, the intetligence and operations staffs ensure the synchronization of OSTNT tasks with the scheme of maneuver (especially the scheme of information collection) and the scheme of intelligence. Acquiring open-source infonnation may compromise the operations of other intelligence disciplines or tactical units. Open-source collection that is not synchronized may result in redundant tasking of collection assets and the improper use of forces and equipment, Redundant til.'! king may adversely affect the ability of nonintelligence organizations, such as civil affairs, military police, and public affairs, to accomplish their missions and tasks. Conversely, obvious oontact with an open-source by nonintelligence organizatioJtS can compromise OSJNT tasks and lead to the loss of intelligence.

J-31 . (U) Army intelligen~ organizations, units, and elements authorized to conduct OSINT !l(;(ivities that have RF!s requiring risk. mana ement level ). OSINT collection will coordinate with their collection mana ement team using the
(b) (3)
(b) (3)
to manage OSINT production requirements. If the RFJ_re~ew OSNT oo!lection, the collection manager should articulate it as a collection requirement in~J3UCollection managers must decon-nict existing requirements and. insert new unit-level RFis as needed. Army commands with available intelligence analysis capacity Md a mission to CQnduct analysis activities in support of the inteHigence oommunity, DOD, or other Army intelligence re uiremen!s are encoumged to routinely review global intelli ence information requirements inside
(b) (3)
nnd _provide answers where possible, ~
b 3
and Headquarters, INSCOM manages Army accounts,

## Deception And Bias (U) I (B) (3)

3-33. (U) Normally, collecting open-source information does not require direct observation of activities and conditions within the area of operations. However, some situations may require collection from secondary sources, such as government press offices, commercial news organizetions, end nongovernmental organization spokespersons. These sources can intentionally or uninlcntionall d delete modi

omerwise filter the information released to the  ublic, 1
(b) (3
~~--------------~
It is important to know the
'-.:-::c::r.:gro
= u=nc:r-:o:-r:o=p=en=-=-so=-:u-:-:r=ce=-:s=-11=-=n:-:r.t<=-e-'::pf:.u-='rp=-'=o=s=-:e -=o-:zrith=ec-: p=-=u:-.:b,.i'="c-.-in::-.fii'::o-=rm=at"lo=-=n=-. --...r:-ri s:-Tk.nowledge assists 11naly sts in identifying objectives and factual infonnation, identifying bias, and highlighting deception efforts agsirut the local audience as well os the overall operation. It would be of great value if a linguist had insight into cultural normalcies and identifying propaganda.

## Copyright (U)

3-34. (U) When preparing OSINT products. intelligence personnel must consider intellectual property rights.

Copyright is a form of protection, for published and unpublished works, provided by Title 17, united States Code (USC), to authors of original works of authorship, including literary, dramatic, musical, and artistic works. Intelligence personnel using copyrighted material for which permission from the author has been obtained cite the source of the material.

3~35. (U) There is considerable data available on the internet protected by copyright law. OSINT
practitioners need to be aware of information protected by copyright and ensure their collection does not vi.olate the ownership of the information. Intellectual property is considered any creation of the mind, including but not limited to-

-
Musical works and compositions.
-
Inventions.
-
Artistic displays.
-
Words or phrases.
-
Discoveries.
-
Symbols and designs.
3-36. (U) It is illegal to violate the rights provided by the copyright law to the owner of copyright. One major limitation is the doctrine affair use, which is given a statutory basis in Section 107 of the 1976 Copyright Act (Section I 07, Title 17, USC). According to the U.S. Copyright Office, fair use of a copyrighted work for purposes such as criticism, comment, news reporting, teaching, scholarship, or research is not an infringement of copyright. The use of copyrighted work in intelligence products falls into the category of fair use for scholarship and research. Fair use information should include attribution citations in intelligence products referencing organizations or authors and the originating source title and date. The four factors in determining fair use include-

-
Purpose and character of the use.
-
Nature of the copyrighted work.
-
Amount and substantiality of the portion used in relation to the copyrighted work as a whole.
-
Effect of the use upon the potential market for or value of the copyrighted work.
3-37. (U) Questions for determining whether copyright permission is required or fair use applies should be directed to the local staff judge advocate or other legal counsel. If it is reasonably believed that the material will be publicly released, a written legal opinion by "the supporting staff judge advocate or other legal counsel is required.


3-38. (U) AR 27-60, DOOM 5240.01 and DOD 5240.1-R prescribe policies and procedures for the acquisition, protection, transfer, patent usage, copyrights, and trademarks of intellectual property. Army and Marine *C01ps* policies recognize the rights of copyright owners, consistent with missions and worldwide commitments. OSINT practitioners will not produce or distribute copyrighted works without the permission of the copyright owner unless such use is authorized under U.S. copyright law. There is also a requirement
for OSINT practitioners to forward the material to be published publicly outside of intelligence organizations to the Army Judge Advocate General's Corps/Marine Corps Judge *Advocate Division* for approval and waiver of notice to the copyright holder, if necessary, for OPSEC. (For more information on copyright laws and applicability, access the U.S. Copyright Office website on NIPRNET or contact the local staff judge advocate office.)

## Linguists (U)

3-39. (U) The collection of open-source information often requires. linguists or foreign language translation capabilities or both. Local nationals are often. the best source of linguists able to translate collected information correctly and in the proper context. All locar nationals used for open-source collection niust be vetted thoroughly for OPSEC reasons. (See FM 2-0 for information on language support; AR 11-6 for policy on evaluation and reevaluation of linguist proficiency; and MCO 1550.25A for iriforrnation on the Marine Corps Foreign Language Program.)
J-40. (U) The ability to colle~;t and' analyze foreign material is critical in OSINT exploitation. The effective use and employment oflingu ists, both civilian and military, facilitate this activity. The tasks for which foreign language skills and knowledge proficiency are most critical include-

-
Transcription. Both listening and writing proficiency in the source language are essential for an
accurate transcript. A transcript is ex1remely important when the transcriber's English-language
skills are inadequate for authoritative or direct translation from audio or video into English text.
-
Translation. Bilingual competence is a prerequisite for tr!I.!Ul.lations. Translators must be able~
Read and comprehend the S?urce l1111guage.

Write comprehensibly in English.

Choose the equivalent expression in English that fully conveys and be.st matches the meaning intended in the source language.

-
Interpretation, Interpretation is a specific skill. Not all linguists are trained to perfonn it.
Bilingual competence is a prerequisite for interpretation. Interpreters must be able to-
-
Hear and comprehend the source language.
-
Speak comprehensibly in English.
-
Choose the equivalent expression in English that fully conveys and best matches the meaning
intended in the source language.

## Chapter 4 Collect (U)

(U) There ar.e several means of collecting open-source information during OSINT
collection activities. Intelligence personnel should take advantage of these deep and important open sources of information. The employment ofOSINT resources to collect from intelligence requirements varies by echelon. However, using search techniques is fundamental to OSINT collection and can be implemented in any unit. Exploiting media sources, using s.earch engines, and collecting infonnation specific to rhe operational environment should be standard operating procedures (SOPs) for any OSfNT ceiL These collection procedures should be planned and implemented the same way as those for any other intelligence discipline.

## Osint Collecfion Activities (U)

4-1. (U} OSINT collection, as with otber collection activities, consists of ccllecting, processing, and reporting infonnation in rc~ponse to intelligence requirements. *Soldiers/Marines* and civilians oollect infonnation and data *from* open sources. Intelligence e.nalyst8 subsequently use this information in intelligence production and ultimately support the commander's situational understanding. OSINT collection activities transition as requirements and missions change, operations proceed through different phases, and staffs prepare for future operations.

4-2. (U) Commander's guidance and intelligence and information requirements drive the collection of open-source infonnation. CoUected information is the foundation of inte!ligence databases, intelligence production, and situational awareness.

Note. (U) Staff personnel also acquire PAI from open sources that is incorpornted into the running estimate and used during IPB,
4-3, (U) Analysts conducting OSINT activities perfonn several tasks to establish duties and maintain focus an requirements. The following include examples of tasks perfonned by OSI'NT cells:

-
Monitoring operatloll.!l. This task ensures responsiveness to the current situation and assists the
cell in anticipating future col\ectian,.proeessing. reporting, and synchronization requirements.
 -
Collect information from publicly available open sources.
-
Perform source validation and report screening. Information is verified and validated b!i!ied on
PTRs and the commander's guidance. This action ensures pertinent 11!1d relevWlt information is not
overlooked. lnformation to be: analyzed is screened first to reduce the volume to a workable size.
Validotion should encompass the .clements of timeliness, completeness, and relevance to satisfy
intell igencc requirements.
-
Disseminate Intelligence products Qnd information. OSINT products, information papers,
executive summaries, and country studies are disseminated to customers via ruch means as email,
M3 messaging system,!
(b) (3)
I
-
Cue. *OSTNT* cueing from other intelligence disciplines' information collection assel:3 improves
the information collection effort. Cueing enables the use of a multidiscipline approach to confirm
or deny information by another information source, collection organization, or production activit)'.
It also keeps organizations abreast of emerging unclassified in rormation and opportunities.

## Types Of Open-Source Information (U)

4-4. (U) Identifying the potential source of information is part of planning n:quirements and pssessing collection. Open sources include but an: not limited tl>-

'l q (b) (3)
 1
(b) (3)
-
Commercial and pub lie lnforiiUltion services. Broadcasted, poSted, and printed news on cWT"e<lt
international, regional, and local topics.

- I
(b) (3)
-
lndividuals and groups .. Handwritten, painted, post~, printed, and broadcested information
disseminated *a.s* a~graffiti; leaflets; posters; tattoos; and websites.
!
(b) (3)
Note. (U) Information and intelligence. requirements that require confidential sources are not assigned to OSINT cells. Confidential sources consist of any persons, groups, or systems that provide information with the expectalion that the: information, relationship, or both are prott:"cte<l against public diSG!osure.

## Osint Collection (U)

4-5. (U) Collection implies gathering, by a variety of means, data and information from which finillized intelligence is then created or synthesized and disseminated. After determining the collection technique (as discussed in paragraphs J-11 through 3-15), OSINT practitioners conduct collection to satisfy intelligence requirements.

4-6. (U) OSfNT collectio~

-
Leads to information used to populate intelligence databases and assist in developing OSINT
products. These dwbases enable OSINT practitioners to respond to changes in the area of
operations by providing accurate infonnation to satisry requirements.
-
Is used to collect open-source infonnation that contributes to understanding the area of operations.
-
Is used to generate: intelligence knowledge before and during deployments.
4-7,
(U) PAl can be collected through several methods, two of which include-:-
-
Nontnditional--the practice of using the internet for information (such  *a.s* open-source
information from the world wide web),
-
Traditional-the practice of searching for open-source information that does not use any
technologicaJ processes (for example, researching solely in books, l!bro.rios, broadcasting,
newspapers, magazines).
4-8.

(U) All inquiries begin with detennining a re~uirement and developing a plan.

## Deter.Minf, The Couection Requirement (U)

4-9.

(U) COllection begins with detennining a collection requirement. When considering OSINT collection, the requirement can be framed in terms of the mission variables {l\1ETT *TCIMEIT-1)* or op~::rational variable,s (PMESil-PT/PMES/1). The collection requirement is refined through the devel(lpment of intelligence requirementS to be satisfied. Requirements that cannot be satisfied using open-sources are identified and tasked to another collection asse1.

## Develop The Osint Collection Plan (U)

4 1 0. (U) Different facets of a question may be expressed as information and. intelligence requirements.

These requiremen\.s fonn the basis for the OSINT collection plan, which can us~ both nontraditionAl and traditional collection methods. T.he OSINT eollection plan.eonsists ofthe fol lowing:


-
Identification of open sources.
-
Description of how to access those sources.
-
Fonnatfor compiling the data . .
-
Collection methodology.
-
Dissemination plan.

## Implement The Osint Collection Plan (U)

4-11. (U) Utilizing open-source media (the means of sending, receiving, and recording information), components, and associated elements (see table 4-1 ), OSINT practitioners implement the OSlNT eollectlon plW1, The following includes the primary media used to implement a collection plllJl:

-
Public documents.
-
Public broadcasts.
-
Internet websites.
Note. (U) Table 4-1 does not illustrate an aJI-inclusivll list of opon~souroe media types but rather the categories of open-source media to consider when collecting OSINT.



## Public Document! (U)

4-13. (U) Publicly available documents can be discovered in a variety of places. An OSJNT practitioner must
comply with all provisions of intelligence oversight when acquiring public documents. Examples of publicly
va;Jr, doc"m'"" inolod bo~,.  , '{b} {
3
)


-
Do~uments from newspaper stands, book stores, and publishers.

## Broadcast Services (U)

4-14. (U)
Broadei~st scrvice3 refers to tht: transmission of audio
~ndlor vidoo infonnalion in the electromagnetic wave frequency fonnat OSTNT practitioners can obtain broadc~t services freely from civilian resellcrs or from the enterprise. (Fpr information on collecting information from public broadcasts, access the Open Source Enterprise website on NlPRNET.)

## Internet Websitea (U)

4-15. (U) OS!NT practitioners' ability to search the internet safoly and securely is an essential skill for collecting open-source infonnation. The internet provides ru:cess to websites and databases that hold a wide range of information on current, planned, and potential aroas of operations. (~  appendix C for more information on using internet websites.)
4-17. (U) rntelligenco prof~ssionals  directly accessing open-source information to satisfy specific intellig~nce reguiremcnts arc conducting Wl OSTNT activity. All OSlNT activities must be supported by an officially approved collection plan. An intelligence professional is prohibited from creating or using a personal socin.l media account when conducting OSINT activities and will not create a false persona.

Engagement (for example conversing, exchanging information) witll individuals or personas is an interactive activity not authorized under OSINT authorities.

This page intentionally left blank.

## Chapter 5 Produce (U)

(U) Intelligence professionais produce the intelligence resulting from open sources and integrate it into the larger holdings of intelligence data. OSINT, as with all intelligence disciplines, produces specific products as its contribution to intelligence production.

The goal of these products is to provide timely and accurate intelligence that answers an intelligence requirement.

## Processing Information (U)

5- J.. (U) During OSINT processing and exploitation, collection is converted and/or reduced to forms that can be readily used by commanders, decision makers at all levels, intelligence analysts, and other consumers.

Processing and exploitation include-

-
First phase exploitation.
-
Data conversion and correlation.
-
Document and media translation.
-
Reporting of action results to analysis and production elements.
5-2. (U) Processing and exploitation may be federated or performed by the same element that collected the data. Federated exploitation planning is typically conducted during planning based on anticipated singlesource analytic throughput. It ensures the appropriate inteHigence systems architecture is in place to route the collection to predetermined exploitation nodes. An example of processing and_ exploitation occurs when the collection is compared and associated with the known state actor. Rather than providing an analyst with an dverwhelming amount of information, the analyst only receives the essential facts.

5-3. (U) Open-source information may answer intelligence and information requirements. Based on the type of information and how it was received, it must be processed before being reported and disseminated as finalized OSINT. Personnel convert open-source information into.a form suitable for exploitation by-

-
Digitizing.
-
Transcribing and translating.
-
Reviewing.

## Digitizing (U)

5,4, (U) . Documents collected from the internet using enterprise tools and practices do not require digitization. For physical documents, personnel create a digital record of documents by scanning or taking digital photographs. Pertinent information about the document must be annotated to ensure accountability and traceabi'lity. Digitization enables dissemination of a document to external databases and organizations.

It also aHows the use of machine translation tools to screen documents for keywords, names, and phrases.

## Transcribing And Translating (U)

5-5,
(U) A ~ranscript refers to a written verbatim, native language rendering ofthe spoken words in an audio or video recording. Both listening and writing proficiency in the source language are essential for an accurate transcript. The transcript includes descriptions ofthe activity, background, and conditions that the transcriber hears in the audio and observes in the video. The linguist uses online dictionaries, gazetteers, working aids, and software to improve the transcript. Once completed, the transcription is sent to a quality control linguist.

5"6.

(U) A translation is not verbatim but an approximation of the literal and implied meaning of th~
forei n langua e,
(b) (3)
(b) (3)
{See paragraphs 3-40 through 3-42 for more in nnat1on on trans auon an machine language translation.)
57. (U) During processing, a linguist creates either an extract, a summary, or a ru!l translation of the original document or transcript into a standardized format established by unit SOPs. The linguist uses online dictionaries, gazetteers, working aids, and software to improve the translation. Once completed, the translation is sent to a quality control linguist.



## Reviewing (U)

5-8.

(U) Linguists perform quality control reviews of each transcription and translation to ensure both quality and consistency with established unit SOPs. A U.S, Government or milirery linguist should review all information lhat a non-U.S. Government linguist processes, with exceptions involving long-term muftinational partners of the United States and U.S. contractors with the requisite skills and the confidence of the command. Linguistic quality control is an important facet of processing foreign open-source information. Each tran.Kription and translation undergoes two levels of review:

-
Quality control-a qualified linguist ensures the transcription or translation is accurete, complete,
free of bias, and in aCCQrdance with reporting and dissemination standards. The t:.S. linguist
returns the transcript or translation fur correction, adds or corrects missed content, or corrects
minor format errors, Upon completion of quality control, the transcription or translation is
availab!'e to use in OSINT production.
-
Quality assurance-a qualified U.S. linguist or OSINT analyst reviews the transcript or
translation to ensure it contains all required information and reuds naturally in English. Once
reviewed, the completed transcription or translation is saved to internal datll.bases and available
for further use.

## Types Of Intelligence Products (U)

5-9.

(U) Personnel engaging in open-source activities typically gather and receive information, conduct collection, and report and disseminate information In accordance with local SOPs. OSINT may be incorporated into ~ny of the full owing intelligence products:


-
Intelligence estimate is the appraisal, expressed in writing or orally, of availo.ble intelligence
relating to a specific situation or condition with a view to determining the courses of action open
to the enemy or adversary and the order of probability of their adoption (JP 20).
-
Intelligence summary refers to the current assessment of the threat situation and civil
considerations. Information and intelligence used to develop the intelligence summary are
ultimately applied to develop and update the staff estimate.
-
Jntelllgenctl running estimate details the ability of the intelligence stllff to support current and
future operations.

5-10. (U) OSINT products may also be categorized by intended use and purpose. Categories can overlap, and some PAI and open-Surce information can be used in more than one product. (See ADRP 2-0 and MCDP 2 for information on the types ofintelligenc~ products.)
5-11 . (U) In addition to contrib_uting to the intelligence products listed in yaragrap_h St: OSINT practitioners also prepare open-source Lntelhgence reports (referred to as OSIRs). Thts report ts a  standard template for OSlNT serialized reporting, and is a national and defense enterprise standard to momlDr, track, and access serialized OSINT reporting . The OSINT summary, llke the intelligence summary, does not have an established format. However, the OSINT summary should minimally include translated reports appljcahle to intelligence requirements and an evaluation of the source of the information.

## Evaluating Information (U)

5-12. (U) After information translation, collection, and exploitation, OSTNT pt8Ctitioners use indicators, such as volume, velocity, variety, viscosity, vitality, and availability, to evaluate the information. It is impor1ant to evaluate the reliability of open-source information to distinguish objective, factual infonnation from biased and deception efforts. The information rating is based on the subjective judgment of the evaluator and the accuracy of the previous information produced by the same source. The types of *sources* are-

-
Primary souree, which hB.!i direct access to the informlllion and conveys the infunnat.ion directly
and completely:
-
Secondary source, which conveys information through intermediary sou~es using the verne.cu(ar
and summarizes or paraphrases infonnation.


## Primary Source (U)

 5~ 13. (U) A primary source refers to a document, person, or physical object that was sampled dlll'ing the time under study: These sources are present during an experience or time-period and offer an inside view of a particular evenl.

## Secondary Source (U)

5-14. (U) A secondary so\lrce interprets, analyzes, cites, und builds upon primary sources. Secondary 5ources may contain pictures, quotes, or graphics from primary sources. Some types of secondary sources include publications such as-


- JoumaJs that interpret findings.
- Magazine articles .
- Histories.
- Encyclopedias .
- Textbooks.
- Commentaries .
- Criticisms .
Note. (U) It is often difficult to distinguish primary from secondary sources since both are subjective. A primary source is not necessarily more of an authority or better than a secondary source. For any source, primary or secondary, it is important for OSJNT practitioners to evaluate the information for deception and bias.

## Open-Source Reliability (U)

5-15. (U) To avoid bias, OSINf practitioners must assess the reliability and credibility of information independently. When evaluating sources of information to determine reliability and credibility, analysts consider-
5-16. (U) When accessing a website, OSI'NT practitioners should consider the-

## Chapter 6 Disseminate (U)

(U) Commanders must receive combat information and intelligence products timely and in an appropriate format to facilitate situational understanding and support decision making. Timely dissemination of intelligence is critical to the success of operations.

Effective dissemination is deliberate and ensures consumers receive the intelligence they need to conduct operations.

## Dissemination (U)

6-1.

(U) Intelligence and information requirements satisfied through open-source information should be reported immediately, as specified in unit SOPs. Reporting and dissemination are not synonymous. The disseminate step does not include the passing of information through normal reporting and technical channels by intelligence organizations and units during the intelligence process. Rather, it involves the passing of products based on intelligence analysis to users requiring that intelligence. (See ADRP 2-0 and MCDP 2.)
6-2.

(U) OSINT products provided to other intelligence and operational elements facilitate all-source intelligence, targeting, and cueing of other collectors.

Note. (U) Close cooperation between OS TNT practitioners and other staff members who collect open-source information fosters a supportive environment about what and how to report information of potential operational or intelligence value through the proper channels.

6-3.

(U) OSINT must be timely, accurate, and properly disseminated to commanders and other customers in a useable form. Disseminating OSINT products includes but is not limited to incorporating the products into-

-
Single discipline or multidiscipline estimates or assessments.
-
Statements of facts.
-
Evaluations of threat capabilities and limitations.
-
Threats' likely COAs.

## Dissemination Methods And Techniques (U)

6-4. (U) There are numerous methods and techniques for disseminating information and intelligence. The appropriate technique in any particular situation depends on many factors such as capabilities and mission requirements. Information and intelligence must be disseminated in accordance with unit SOPs and joint force guidelines. Dissemination methods and techniqu~s include-

-
Direct electronic dissemination (a messaging program).
-
Instant messaging.
-
Web posting (with notification procedures for users).
-
Recording information on removable media and sending it via a secure mail service.
-
Recording information on removable media and sending it via electronic means.
-
Sending hardcopy documents via mail or fax.
6-S.
(U) The basic standards for reporting and disseminating information are-
-
Timeliness. Information should be reported to affected units without being delayed for the sole
purpose of ensuring the correct format.
-
Relevance. Information must contribute to answering intelligence requirements. Relevant
infoi:JTiation reduces collection, organization, and transmission times.
o
Complet~ness. Using prescribed formats and following SOPs contribute to the completeness of
transmitted information.

## Reporting Methods (U)

6-6.
(U) The three reporting methods used to convey intelligence and information are-
-
Written. Written. methods include formats (such as spot reports), tactical reports, and information
intelligence reports. OSINT publications, while not having an established format, should also.
provide analysis ofthe sources discussed. These assessments can assist in evaluating the reliability
of the information.

-
Graphic. Web-based report dissemination is an effective technique to ensure the widest awareness
of written and graphical information across echelons. OSINT practitioners can collaborate and
provide statuses of intelligence requirements through websites. Information can also be uploaded
to various databases to support future open-source missions and operations. Graphics should also
display, if from a local sourc'e, the areas that the information impacts. For instance, a newspaper
written in Quetta, Pakistan, will have a higher distribution amongst the Pashtun population than it
 would in a highly populated Tajiki area of Afghanistan.
-
Verbal or voice. The most common way to disseminate intelligence and information verbally is through a military briefing. Based on the criticality, sensitivity, and timeliness of the information,
ad hoc and. impromptu verbal communications methods are the most efficient to deliver
information to commanders.
,:

## Appendix A Legal Restrictions And Regulatory Limitations (U)

 (U) Open-source information covers a wide range of areas. Exploring, assessing, and
collecting PAl and information from open sources has the potential to adversely affect
organizations that conduct OSINT missions. As with all intelligence activities, OSINT
activities must comply with intelligence oversight law, policy, and regulation. For the
Army, the AOO, in coordination with tl:le U.S. Anny Forces Command, ensures
intelligence collection authority and appropriate mission orders are documented for
U.S. Army Forces Command units provisioned with AOO OSINT capabilities.
Note. (U) EOs, Army regulations, *Marine Corps policies,* a!ld guidance change frequently.

Appendix A discusses the legal restrictions and regulatory limitations at the time of this writing.

It is imperative that readers ensure adherence to the most recent laws and regulations.

## Executive Order 12333 (U)

A-1. (U) All OSINT activities performed by intelligence personnel must comply with the legal restrictions, policies, and guidelines outlined in EO 12333 as amended and other associated regulations, instructions, or directives.

A-2. (U) EO 12333 as amended was implemented in response to operations and activities conducted by the intelligence community against U.S. persons, especially those involved in civil rights and anti-Vietnam war movements during the 1960s and 1970s. At that time, intelligence personnel, including DOD intelligence personnel, used overt and covert means to collect information on political activities ofU.S. persons, retained that information in intelligence files, and disseminated that information to other intelligence and law enforcement organizations. The purpose of EO 12333 as amended is to enhance-

-
Human and technical collection techniques, especially those undertaken abroad.
-
The acquisition of significant foreign intelligence.
-
Detection and countering of international terrorist activities, the spread of weapons of mass
destruction, and espionage conducted by foreign powers.
A-3. (U) EO 12333 as amended is also intended to achieve the proper balance between the acquisition of essential information and protection of individual interests. Accurate and timely information about the capabilities, intentions, and activities offoreign powers, organizations, and subordinate agents is essential to informed national defense decisions. Collection of such information is a priority objective, pursued in a vigorous, innovative, and responsible manner consistent with the U.S. Constitution and applicable laws and principles.

## Assigned Functions (U)

A-4. (U) Based on EO 12333 as amended, the assigned intelligence functions of the Army are to-

-
Collect, produce, and disseminate defense and defense-related foreign intelligence and.
counterintelligence to support Army and DOD requirements, and as appropriate, national
requirements.
-
Conduct counterintelligence activities.
-
Monitor the development, procurement, and management of tactical intelligence systems and
equipment and conduct related research, development, and test and evaluation activities.
-
Conduct MI liaison relationships and MI exchange programs .

## .  Interpretation And Implementation (U)

A-5. (U) AR 381-10 and *MCO 3800.2B* interj,ret"and implement EO 12333 as amended and DOD 5240.1-R.

DODM 5240.01 is the most current guidance on intelligence oversight. AR 381-10 and DODM 5240.01
enable the Army intelligence community to perfonn authorized intelligence functions in a manner that protects the constitutional rights of U.S. persons. However, the regulation does not authorize intelligence activity. An Army intelligence unit or organization must have the mission and the authority to conduct any intelligence activity, and particularly those directed against U.S. persons. Anny intelligence personnel operating under the authority ofTitle 10, USC, or Title 50, USC, must comply with the Posse Comitatus Act
(Section 1385, Title 18, USC) and have prior approval by the Secretary of Defense when involved with civipan law enforcement.

## U.S. Person Information (U)

A-6. (U) Army intelligence personnel *:will* conduct OSINT activities in accordance with the J;equirements
of EO 12333 as amended, DODM 5240.0 I, and AR 381-10 in a manner that ensures legality and propriety.

and preserves arid respects the privacy and civil liberties of U.S. persons. All Army intelligence personnel conducting OSINT activities will complete intelligence oversight training as required in DOD 5240. l-R and AR 3 81-10. For OSINT .collection purp_oses, U.S. person information may only be retained if the information is reasonably believed to be necessary for the performance of an authorized OSINT mission and the infonnation is publicly available. If, during authorized OStNT collection, U.S. person information is incidentally collected (it was not the target of the OSINT collection), all such information may be temporarily retained, evaluated for pennanent retention, and disseminated only in accordance with DODM 5240,01, Proc~dures 3 and 4, and AR 3 81-10.

## Army Regulation 381-10 (U)

A-7. (U) AR 381-10 requires any Army component perfonning authorized intelligence functions to execute those functions in a manner that protects the constitutional rights of U.S. persons. It also provides guidance on collection techniques used to obtain infonnation for foreign intelligence and counterintelligence purposes.

This regulation does not authorize specific intelligence activity.

## Collection Of U.S. Person Information (U)

A-8. (U) In accordance with AR 381-10, a U.S. person is-

-
A U.S. citizen.
-
A U.S. permanent resident alien.
-
An unincorporated association substantially composed of U.S. citizens or permanent resident
aliens.
-
A corporation or subsidiary incorporated in the United States that is not directed or controlled by.
a foreign government.

A-9. (U) The following are presumed to be non-U.S. persons unless the intelligence component obtains specific information to the contrary:


-
A person or organization outside of the United States.
-
A person not a citizen or permanent resident alien of the United States.
A-1 0. (U) Collection, in accordance with DODM 5240.0 l, concerns information that is received by a Defense Intelligence Component, whether or not it is retained by the Component for intelligence purposes or other purposes. Collected information includes information obtained or acquired by any means, including information that is volunteered to the Component. Collected information does not include-

-
Information that only temporarily passes through a computer system of the Component.
-
Information on the internet or in an electrol)ic forum or repository outside the Component that is
simply viewed or accessed by a Component employee but is not copied, saved, supplemented, or
used in some manner.
-  Information disseminated by other Components or elements of the Intelligence Community.
-
Information that is maintained on behalf of another U.S. Government agency and to which the
Component ~oes not have access for intelligence purposes ..
A-I 1. (U) Action must be taken to demonstrate the intended use of the collected information, such as producing an intelligence information report, incident report, or adding the information to an intelligence database. There must be a link between the collection of the U.S. person information and the intelligence agency assigned mission. This link is particularly important when dealing with PAl, open-source information, and information data exploitation.


A" 12. (U) Army intelligence components may collect U.S. person information by lawful means; however, collection must be limited to the least intrusive means feasible and shall not violate the law. (See DODM 5240.01.) The least intrusive means must be attempted before requesting or utilizing more intrusive collection means.

b 3
A-13. (U) Within the United States, foreign intelligence concerning U.S. persons may be collected only by overt means, unless all of the following conditions are met:

A-14. (U) AR 381-10 does not authorize the collection ofany information relating to a U.S. person solely because of personal lawful advocacy of measures opposed to government policy. The rules in EO 12333 as amended and AR 381-10 protect U.S. persons' rights und'er the.First Amendment to the Constitution of the United States.

## Retention Of U.S. Person Information (U)

A-15. (U) In this context, retention is the maintenance of information in either hardcopy or electronic format regardless of how the information was collected or how it was disseminated to a Defense In~elligence Component by another Component or element of the Intelligence Community (DODM 5240.0 I). DODM
5240.01, Procedure 3, authorizes the retention ofU.S. person information.

A-.16. (U) In accordance with DODM 5240.01, incidental collection of U.S. person information refers t<>---
.

(a) Collection about a person reasonably believed to be in the United States. A defense intelligence

component may intentionally collect information about a person or object that, at the time of collection, is in the United States or about a place in the United States. If a component does so and
incidentally may have collected U.S. person information about a person other than the subject of intentional collection, the component may retain all of the collected information for evaluation for
up to .five years. The component head or a single delegee may approve an extended period in
accordance with Paragraph 3.3.c.(5).

## Appendix A

(b) Collection about a person reasonably believed to be outside the United States. A defense
intelligence component may intentionally collect information about a person or object that, at the
time of collection, is outside the United States or about" a place outside the United States. If a
component does so and incidentally may have collected U.S. person information about a person
other than the subject of intentional collection, the component may, subject to Paragraph
3.3.c.(5)(b),retain all of the incidentally collected information for evaluation for up to 25 years.
A-17. (U) Other information retained by Anny intelligence components must be reported for oversight purposes and for necessary subsequent proceedings.

A-18. (U) Access to U.S. person information retained in intelligence files, databases, an:d repositories is limited to those with a need to know the information. U.S. person information in intelligence files, databases, and repositories is retained in accordance with disp(Jsition criteria in AR 25-400-2. Intelligence components will review intelligence files and databases annually. Intelligence components will specifically review U.S.

person information to ensure its retention is still necessary to an assigned function. This ensures the information is not held beyond established disposition criteria, is retained for an authorized function, and was not retained in violation of this regulation. This does not apply to the Investigative Records Repository or other authorized long-term records holding areas.

## Dissemination Of U.S. Person Information (U)

A-19. (U) In this context, disscmi~ation is the . transmission, communication, sharing, or passing of information outside a Defense Intelligence Component by any means, including oral, electronic, or physical means: Dissemination includes providing any access to information in a Component's custody to persons outside the Component (DODM 5240.01).

## (B) (3) Questionable Intelligence Activity (U)

A-20. (U) Questionable intelligence activity occurs when intelligence operations (in this context, all intelligence or counterintelligence tasks) potentially violate laws, EOs, Presidential directives, and DOD or Army policies.


A-21. (U) Intelligence personnel should report questionable intelligence activity through the chain of command, the inspector general, or directly to the Assistant to the Secretary of Defense for Intelligence
 Oversight in accordance with AR 381-10. The following are examples of questionable intelligence activity regarding improper collecting, retaining, or disseminating of U.S. person information:

-
Collecting and gathering information about U.S. domestic groups not comiected with a foreign
power or intemational terrorism.
-
Producing and disseminating intelligence threat assessments containing U.S. person information
without a clear explanation of the intelligence purpose for which the information was collected.
-
Coll.ecting and gathering U.S. person infonnation for force protection purposes without
determining if the intelligence function is authorized.
.
.
-
Collecting and gathering U.S. person information from open sources without a logical connection
to the mission of the unit."
A-22. (U) AR 381-10 directs intelligence organizations to refer questions concerning the interpretation of the instructions on collection, retention, and dissemination of U.S. person information to the local staff judge advocate's office. (For rriore information on EO 12333 as amended and intelligence oversight, access the DOD Senior Intelligence Oversight Official website on NIPRNET.)

## Marine Corps Order 3800.2B (U)

A-23. (U) MCO 3800.28 establishes policy, procedures, and responsibilities governing the inspection and oversight of activities of Marine Corps intelligence and the reporting requirements regarding those activities.

## Collection, Retention, And Dissemination Of U.S. Person Information (U)

A-24. (U) The collection. retention, cind dissemination of information concerning U.S. persons by Marine Corps intelligence components will be governed by the requirements set forth in references EO 12333 as amended, DODM 5240.01, DOD 5240.1-R change J,.SECNAVINST 3820.3E, and MCO 3800.28.

A-25. (U) MCO 3800.28 defines a U.S. person as one of the following-

-
A citizen of the United States.
-
An alien known by the intelligence agency concerned to be a permanent resident alien.
-
An unincorporated association substqntia//y composed of U.S. citizens or permanent resident
~~
.
-
A corporation incorporated in the United States, except for a corporation directed and controlled
by a foreign government or governments ..
A-26. (U) Marine Corps intelligence activities shall be carried out in a manner that protects the constitutional rights and privacy of u.s. persons, and shall not request any person or entity to underiake unauthorized activities.

A-27. (U) Marine Corps intelligence units and staffs can collect, retain, and disseminate intelligence on U.S.
persons, provided they adhere to a very specific set of criteria and restrictions. Information that identifies a
U.S. person may be collected by a Marine Corps intelligence component only ifit-
(1) Is necessary to the conduct of a function assigned to the collecting component.
(2) Falls within one of the 13 categories authorized under DODM 5240. OJ. Extracts of information
categories are provided in MCO 3800.28, Enclosure (2).

A-28. (U) Collection techniques authorized by DODM 5240.01 will be limited to those necessary to perform assigned functions. The least intrusive means of collection will always be the preferred collection method.

A-29. (U) Special considerations exist for intelligence support to command antiterrorism/force protection programs 'ivithin U.S. territory and/or involving information. regarding U.S. persons. DODM 5240.01
provides specific guidance.

A-30. (U) Intelligence training, or support to unit training, in an off-base domestic civilian environment demands due diligence to .ensure that not only intelligence personnel but also other key personnel (for example commanders, controllers, or nonintelligence Marines who may be conducting intelligence activities) are aware ofintel/igence oversight provisions. Specific guidance is provided in MCO 3800.28, Enclosure (4).

A -31. (U) Use of the internet by intelligence components to conduct intelligence activities presents unique challenges beyond traditional collection methods. To maximize. the use of the internet while properly applying the provisions of EO 12333 as amended, intelligence personnel must understand how to analyze ..

as well as characterize, information collected via the internet. The DOD Office of General Council (known as OCG) memo, "Principles Governing the Collection of Internet Addresses by DOD Intelligence and Counterintelligence Components," dated 06 FebruG/y 2001, addresses internet-based collection activity against the network (as opposed to network content). Commanders can access the memo on the Inspector General ofthe Marine Corps website on N1PRNET.



## Questionable Intelligence Activity (U)

A-32. (U) MCO 3 800.28 defines questionable activity as any conduct that constitutes, or is related to, an intelligence activity that may violate U.S. laws, statutes, Executive Orders, Presidential directives, applicable Department of Defense directives, and Department of the Navy or other Services' policies.

This page intentionally left blank.

## Appendix B Security Awareness (U)

(U) . Personnel conducting open-source collection must be aware of the digital operational environment by minimizing and reducing digital footprints, practicing effective OPSEC, using safe online browsing techniques and habits, andunderstanding that embedded metadata can be contained in documents.

## Situational Awareness And Security (U)

B-1. (U) Awareness is the beginning of effective security. When searching the internet, a computer will transmit machine identification data to the site being visited. (Machine identification data may include the .

operating system, version type of each enabled program, security levels, a history ofwebsites visited; cookie information, user preferences, internet protocol [IP] addresses, enabled languages, and the referring uniform resource locater [URL].) Visitors are frequently redirected to alternative websites based on the search criterion, location, language, and time the search is conducted.

B-2. (U) Collection involving open-source information could unintention~lly reveal PJRs. The internet is a network of networks. It encompasses hundreds of thousands of interconnected networks consisting of millions of computers. Computers and users connected to the internet are identified by a system-specific IP
address that designates location. The IP address identifies the address where transferred information and data are delivered. Therefore, by visiting nonstandard or questionable internet websites on U.S. Government computers, sensitive unit information could inadvertently be revealed.

B-3. (U) There are OPSEC and computer security risks to searching and interacting with internet websites.

Searching the internet may compromise the intelligence mission by leaving machine data (also called digital footprints) on visited websites. Browsing internet websites can compromise computer security by exposing the computer and network to malicious software (such as viruses, worms, and Trojan horses) or unauthorized access. Intelligence personnel must be vigilant to potential threats, use only authorized hardware and software, and comply with established unit.OPSEC measures.

B-5. (U) URL information from the previous website visited is frequently an OPSEC issue because it identifies the user's characteristics and interests. While necessary, the use of specific and.focusedsearch terms also has potential OPSEC implications. For example, If the user enters the search terms [bradley us arn1y}, the referring URL
from the search engine would be:
http://www.[search engine name] .com/search?hl,;,en&q= bradley+us+army. This tells the visited site that the user is searching in English
(hl=en) for information on Army General of the Army Omar N. Bradley or the U.S. Army's Bradley infantry fighting. vehicle.

e-6. (U) A!l actions on a website are logged and saved. The information is saved and linked to what is .

referred to as cookie data. User actions recorded include but are not limited to-

-
Words typed in search parameter fields.
-
Drop-down menu choices.
-
Che\lk boxes.
-
Website movement patterns such as changing domain name or website address.
B-7 ~ (U) On many websites, information that users provide or fill in becomes part of ttie website and is searchable. Key information to avoid sharing includes but is not limited to-

-
Military plans.
-
Operations.
-
Exercises.
-
Maps and chaJ:ts.
-
Locations.
-
Schedules.
-
Equipment vulnerabilities, capabilities, and shortfalls.
Telephone numbers .
Birth dates .
Identification numbers .
-
Names and related numbers:
-
-
B-8. (-FeBeJ Threats, such as regular, irregular, terrorist forces, and criminal elements, are disruptive and use cyberspace to execute operations against the Army. Often, these threats are innovative, networked, and technologically adept.. They capitalize on emerging technologies to establish and maintain a cultural and social advantage, leveraging areas that include but are not limited to mission command, recruiting, logistics, fund raising, money laundering, information operations, and propaganda.

B-9. (U) Units engaged in OSINT exploitation using computer systems and internet usage should develop cyberspace awareness assessments. These assessments sho.uld cover areas including but not limited to network vulnerabilities, network threats (physical and virtual), and future risks. For information about-

-
Cybersecurity awareness, access the U.S. Army Cyber Command website on NIPRNET.
-
Cybersecurity threats and tips, access the U.S. Computer Emergency Readiness Team's website
on NIPRNET.
-
Threat and vulnerability assessments and counterintelligence-cybe~ elements that perform internet
open-source collection and provide support to DOD and Army network and system analysis to determine OPSEC vulnerabilities, see ATP 2-22.2-l.

## Secure Web Browsing (U)

B-10. (U) Oftentimes, information on U.S. Government networks is insufficient to answer intelligence requirements. Intelligence professionals must conduct OPSEC risk mitigation and use secure web browsing capabilities to protect information requirements, information gaps, and/or collection activities from adversaries and threats.

B-11. (U) A best practice for intelligence professionals using the internet is to use a U.S. Government
assigned computer with secured protocols. Army units with a requirement to conduct secure web browsing on the internet to support intelligence requirements or activities should contact the AOO to obtain training on and access to the approved enterprise capabilities.

This page intentionally left blank.

## Glossary (U)

(U) For Army terms and definitions, (Army) precedes the definition. For Marine Corps terms and 'definitions, (Marine *Corps)* precedes .the definition.

## Section I - Acronyms And Abbreviations (U)

.Army doctrine publication
Ar;n~ doctrine _reference publication
ADP
ADRP
Army Open-S6urce Intelligence (OSINT) Office
AOO
Army regulation
Army techniques publication
AR
ATP
brigade combat team
BCT
commander's critical information requirement
CCIR
course of action
COA
Department of the Army Intelligence Information Service
DA liS
Distributed Common Ground System-Army
DCGS-A
Defense lntelligence Agency
Department of Defense
DIA
DOD
Department of Defense instruction
DODI
Department of Defense manual
Defense Open-Source Council
DODM
nose
executive order
EO
field manual
FM
intelligence staff officer (Army)
G-2
G-2/S-2/R-2
intelligence staff section (Army)
signal staff officer (Army)
G-6
United States Army Intelligence and Security Command
INS COM
internet protocol
IP
IPB
intelligence preparation of the battlefield (Army)/ intelligence preparation of
the battlespace (.Marine Corps)
joint publication
JP
Marine Corps air-ground task force (Marine Corps)
MAGTF
Marine Corps doctrinal publication (Marine Corps)
MCDP
Marine Corps Intelligence Activity (Marine Corps)
MCIA
Marine Corps order (Marine Corps)
MCO
Marine Corps planning process (Marine Corps)
MCPP
Marine Corps reference publication (Marine Corps)
MCRP

## Glossary {U}

| Marine                                   | Corpl                       |
|------------------------------------------|-----------------------------|
| training                                 |                             |
| publication                              | (Marine                     |
| MCJP                                     |                             |
| Marine Corps                             |                             |
| warjight~ng                              |                             |
| publication (Marine                      | Corps)                      |
| MCWP                                     |                             |
| MDMP                                     |                             |
| METT-T                                   |                             |
| military decision-maldrig process (Army) |                             |
| mission,                                 | enemy,                      |
| terrain                                  |                             |
| and                                      |                             |
| weather,                                 |                             |
| troof)3                                  | and support a'Klilable-f/me |
| available (Morine                        |                             |
| Corps)                                   |                             |
|                                         |                             |
| mission, enemy, terrain                  | and                         |
| METT-TC                                  |                             |
| . available                              | and                         |
| military intelligence                    |                             |
| MI                                       |                             |
| MIC                                      |                             |
| Marine Corps air-ground task force       | (MAGTF)                     |
| ~enter                                   |                             |
| (Marine                                  |                             |
| Corps)                                  |                             |
| MSC                                      |                             |
| NIPRNET                                  |                             |
| major                                    | IJUbordinate                |
| Nonsecure                                |                             |
| Internet                                 |                             |
| ProtoCol                                 |                             |
| Router                                   |                             |
| Network                                  |                             |
| National Open-Source Committee           |                             |
| NOSC                                     |                             |
| operations security                      |                             |
| OPSEC                                    |                             |
_(b)(~J -
open-source intelligence
OSIN"T
PAl
PED
publicly available information
processing, exploitation, and diss~mination
priority intelligence requirement
PIR
PMESlt
political, military, economic, social, information, and inftastructure (Marine
Corps)
PMESII-P.T
political', military, economic, social, infonnation, infrastructure, physical
environment. and time (operational variable1l) (Army)
RFI
SECNAVINST
request for information .
Secretary of the Navy instruction
standa.rd operating procedure
uniform resource locater
United States
United States Code
SOP
URL
u.s.
usc

## Section Ii- Terms (U)

collection (U)
(U) (DOD) InformaJion is collected when it is received by a Defense 1ntelligence Component, whether or not it is retained by the Component for intelligence purpOses or other purposes. ColleCted information includes information obtained or acquired by any means, including information that is volunteered to the Component. Collected information does not include: information that only momentarily pa~es through a computer system of the Component; information on the internet or in a.n electronic forum or repository 'outside the Compon'ent that is simply .,.jeweJ or accessed by a Component employee but is not copied, saved, supplemented, or used fn IKJme manner; information dissemingted by other Components or elements oftht: ln.te[ligence Community; or information that is maintained on behalf of another U.S. Government agency and to which the Component does not have access for intelligence purposes. (DOOM 5240.01)
commander's critical information requirement (U)
,
(U) (joint) An information requirement identified by the commander as being critical to facilitating timely decision making. (JP 3-0)

cyberspace (U)
(U) Uoint) A global domain within th.e information environment consisting of the interdependent
. network of information technology infrastructures and resident data, including the internet, .
telecommunications networks, computer systems, and embedded processors and. controllers.

-{JP .3-12[R]) .

dissemination (U)
(U) (DOD) The transmission, communication, sharing, or passing of information outside a Defense Intelligence Component by any means, including oral, electronic, or physical means. Dissemination includes providing any access to information ina Component's custody to persons outside the Component. (DOOM 5240.0 1)

## . Friendly Force Information Requlreme~T (U)

(U) (joint) Information the commander and staff need to understand the status of friendly force and supporting capabilities. (JP 3-0)
intelligence (U) .

(U) (joint) 1. The product resulting from the collection, processing, integration, evaluation, ar1alysis, and interpretation of available information concerning foreign nations, hostile or potentially hostile forces or elements, or areas of actual or potential operations. 2. The activities that result in the product. 3. The. organizations engaged in such activities. (JP 2-0)
(U) (Marine Corps) Knowledge about the enemy or the surrounding environment needed to support decision making This knowledge is the result o/the collection, processing, exploitation, evaluation, integration, analysis, and interpretation of available information about the battlespace and threat.

Intelligence is one of the sixwarflghtingfunctions. (MCRP I -10.2)
intelligence estimate (U)
(U) Uoint) The appraisal, express.ed in writing or orally, of available intelligence relating to a specific situation or condition with a view to determining the courses of action open to the enemy or adversary and the order of probability of their adoption. (JP 2-0)
intelligence preparation of the battlefield (U)
(U) (Army) The systematic'process of analyzing the mission variables of enemy, terrain, weather, and
. civil consideratipns in an area of interest to determine their effect on operations. (ATP 2-0 1.3)
intelligence preparation of the battlespace (U)
(V) (Marine Corps) The systematic, continuous process of analyzing the threat and environment in a specific geographic area. '(MCRP 2-IOB.l)
intelligence reach (U)
(U) (Army) The activity by which intelligence organizations proactively and rapidly access information from, receive support from, and conduct direct collaboration and information sharing with other units and agencies, both within and outside the area of operations, unconstrained by geographic proximity, echelon, or command. (ADRP 2-0)
intelligence warfighting function (U)
(U) (Army) The related tasks and systems that facilitate understanding the enemy, terrain, weather, civil considerations, and other significant aspects of the operational environment. (ADRP 3-0)

## Marine Corps Planning Process (U)

(U) (Marine Corps) A six-step methodology which helps organize the thought processes of the commander and staff throughout the planning and execution of military O(Jerations. It focuses on the mission and the threat and is based on the Marine Corps philosophy of maneuver warfare. It capitalizes on the prirrciple of unity of command and supports the establishment and maintenance of tempo. The six steps consist of problem framing, course of action developm.ent, course of action war game, course of action comparison and decision, orders development, and transition. (MCRP 1-10.2)

## Military Decision-Making Process (U)

(U) (Army) An interactive planning methodology to understand the situation and mission, develop a course ofaction, and produce an operation plan or order. (ADP 5-0)

##  Open-Source Information (U)

(U) Qoint) Information that any member of the public could lawfully obtain by request or observation as .well as other unclassified information that has limited public distribution or access. (JP 2-0)

## Open-Source Intelligence (U)

(U) (DOD) Intelligence that is produced from publicly available infonnation and is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a. specific intelligence requirement. (Public Law I 09-163)

## Priority Intelligence Reqqirement (U)

(U) Qoint) An intelligence requirement, stated as a priority for intelligence support, that the commander and staff need to understand the adversary or other aspects of the operational environment.

(JP 2-01)

## Publicly Available Information (U)

(U) (POD) Information that has been published or broadcast for public consumption, is available on request to the public, is accessible online or otherwise to the public, is available to the public by subscription or purchase, could be seen or heard by any casual observer, is made av~ilable at a meeting open to the public, or is obtained by visiting any place or attending any event that is open to the public.

Publicly available information includes information generally available to persons in a military community even though the military community is not open to the civilian general public.

(DOOM 5240.01)

## Questionable Activity (U)

(U) (Marine Corps) Any conduct that constitutes, or is related to, an intelligence activity that may violate U.S. laws, statutes, Executive Orders, Presidential directives, applicable Department of Defense directives, and Department of the Navy or other Services' policies. (MCO 3 800.2B)

retention (U)

(U) (DOD) The maintenance of infonnation in either hardcopy or electronic format regardless of how the information was collected or how it was disseminated to a Defense Intelligence Component by another Component or element of the Intelligence Communi~. (DOOM 5240.01)

U.S. person (U)
(U) (Army) A U.S. citizen; an alien known by the intelligence component to be a permanent resident alien; an unincorporatedassociation substantially composed of U.S. citizens or permanent resident aliens; a corporation or subsidiary incorporated in the United States that is not directed or controlled by a foreign government. A corporation or a subsidiary incorporated abroad is not a U.S. person even if partially or wholly owned by a corporation incorporated in the United States. (AR 381- I 0)
(U) (Marine Corps) A citizen of the United States; an alien known by the intelligence agency concerned to be. a permanent resident alien; an unincorporated association substantially composed of U.S. citizens or permanent resident aliens; or a corporation incorporated in the United States, except for a corporation directed and controlled by a foreign government or governments. (MCO 3800.2B)

## References (U)

(U) All URLs accessed on 15 June 2017.

## Required Publications .(U)

(U) These sources must be available to intended users of this publication.

## Joint And Department Of Defense Publications (U)

(U) Most joint publications are available online: www.dtic.miUdoctrine/new pubs/jointpub.htm.
(U) Most DOD publications are available at the DOD Issuances website: www.dtic.mil/whs/directives.
(U) DOD 5240.1 -R. Procedures Governing the Activities of DOD Intelligence Components That Affect
United States Personnel. 07 December 1982.
(U) DOD Dictionary of Military and *Associated Terms.* May 20 17.
(U) DODI 3 I 15.12. *Open Source Intelligence (OSINT).* 24 August 2010 ..
(U) DOOM 5240.0 I. Procedures Governing the Conduct of DOD Intelligence Activities.
 08 August 2016.
(U) JP 2-0. *Joint Intelligence.* 22 October 2013.

## Army Publications (U)

(U) Most Army doctrinal publications are available online: www.apd.army,mil.

(U) ADRP 1-02. Terms and Milita1y *Symbols.* 16 November 2016. (U) AR 381-10. U,S. *Army Intelligence Activities.* 03 May 2007.
(U) U.S. Army Directive 2016-37. U.S. *Army Open-Source Intelligence Activities.* 22 November 2016.

## Marine Corps Publications (U)

(U) Most Marine Corps doctrinal publications are available online: https://doctrine.usmc.mil/.  (U) Most MCOs are available online: http://www.marines.mil/News/Publications/ELECTRONIC-
LIBRARY.aspx.
(U) MCO 3800.2B. Oversight of Intelligence Activities. 30 Apri/2004. (U) MCRP 1-10.2. Marine Corps Supplement to the DOD Dictionary of Military and Associated
Terms. 16 November 201 I.

## Other Publications (U)

(U) EO 12333. *United States Jntidligence Activities.* 4 December 1981. Amended by EO 13284 (2003)
and 13470 (2008). Available online: http://www.archives.gov/federalregister/codi fication/executive-order/1233 3 .html.

## Related Publications (U)

(U) These sources contain relevant supplemental information.

## Joint And Department Of Defense Publications (U)

(U) Most joint publications are available online: www.dtic.miVdoctrineJnew pubs/jointoub.htm. (U) Most DOD publications are available at the DOD Issuances website: www.dtic.miVwhs/directives. (U) JP 2-01. Joint and National Intelligence Support to *Military Operations.* 05 January 2012.
(U) JP 3-0. *Joint Operations.* 17 January 2017.  (U) JP 3-12(R). *Cyberspace Operations.* 05 February 2013.

## Army Publications (U)

(U) Most Army doctrinal publications are available online: www.apd.army.mil. (U) ADP 5-0. The *Operations Process.* 17 May 2012. (U) ADRP 1-03. The Army Universal Task *List.* 02 October 2015. (U) ADRP 2-0. *Intelligence.* 31 August 2012. (U) ADRP 3-0. *Operations.* 11 November 2016. (U) ADRP 3-90. Offense and *Defense.* 31 August 2012 .
. (U) ADRP5-0. *The Operations Process.* 17 May 2012.
(U) AR 11-6. *Army Foreign Language Program.* 18 February 2016.
(U) AR 25-400-2. *The Army* Recor~s *Information Management System (ARJMS).* 02 October 2007. (U) AR 27-60. *Intellectual Property.* 01 June 1993.
(U) AR 380-5. Department of the Army *Information Security Program.* 29 September 2000.
(U) AR 530-1. *Operations Security.* 26 Septemb~r 2014.
(U) ATP 2-01. Plan Requirements and *Assess Collection.* 19 August 2014.
(U) A TP 2-0 l .3.Intelligence Preparation of *the Battlefield!Battlespace.* 10 November 2014.
(U) ATP 2-22:2-1. Counterintelligence Volume I: Investigations. Analysis imd Production, and
Technical Services and Support Activities *(U).* 1 I December 20 15.
(U) FM 2-0. Intelligence Op*erations.* 15 April ~014 . (U) FM 3-55. *Information Collection.* 03 May 2013.
(U) FM 3-90-2. Reconnaissance, Security, and *Tactical Enabling Tasks Volume* 2. 22 March 2013.
(U) FM 27-10. The Law of *Land Warfare.* 18 July 1956 .

## . Navy And Marine Corps Publications (U)

(U) Most Marine Corps doctrinal publications are available online: https://doctrine.usmc.mil/.
(U) Most MCOs are available online: http://www.marines.mil/News/Publications/ELECTRONIC-
LIBRARY.aspx.
(U) MCDP 2. Intelligence: 07 June 1997.

{U) MCO.l550.25A. Marine Corps Foreign Language Program. 06 March 2012.
{(/) MCO 3070.2A. The Marine Corps Operations Security (OPSEC) Program. 02 July 2013.
(U) MCO 3500.26A. Universal Naval Task List (UNTL). 30 January 2007.
(U) MCO 3900.20. Marine Corps Capabilities Based Assessment. 27 September 2016. (U) MCRP 2-10A.6. Ground Reconnaissance Operations. 25 November 2015. (U) MCRP 2-10A.8: Multi-Service Tactics, Techniques, and Procedures for Intelligence, Surveillance,
and Reconnaissance Optimization. 14 Apri/2015.
(U) MCRP 2-JOB.l. Intelligence Preparation of the Battlefleld!Battlespace. 10 November 2014.
.
.
. .
'
...
.
.
.
(U) MCTP 2-IOA .. MAGTF Intelligence Collection. OJ July 2004.
(U) MCTP 3-20G. Air Reconnaissance. 21 July 2003. (U) MCWP 5-l 0. Marine Corps Planning Process. 24 August 2010.
(U) SECNA VINST 3820.3E. Oversight of Intelligence Activities Within the Department of the Navy
(DON). 21 September 2005, Available online: http://www.secnav.nayy.mil.

## Other Publications {U)

(U) Constitution of the United States of America. 1787. Available online:
http://www .archives. gov/exhib its/ charters/ constitution .htm 1.'
(U) "Principles Governing the Collection of Internet Addresses by DOD Intelligence and
Counterintelligence Components." 06 February 2001. Available online through the Inspector
General of the Marine *Corps* web,site: .http://www.hqmc.marines.mil/igmc/Units!Intelligence-
Oversight-/References/.
(U) National Security Act of 1992. Available online: https://www.gpo.gov/fdsys/granule/CRI-
1992/CRI-1992-NATIONAL-SECURITY -ACT/content-detail.html.

## United States Law (U)

(U) Most USCs are available online: http://uscode.house.gov/.
(U) Public Law 109-163. National Defense A utho'rization Act for' Fiscal Year *2006.* 06 January 2006.
A vail able online: https://www.gpo.gov/fdsys/pkg/PLA W -1 09publ163/contenf-detail.html.
(U) Title 10, USC. Armed Forces.
(U) Title 17, USC. Copyrights.
(U) Title 18, USC. Crimes and Criminal Procedure.
(U) Title 50, USC. War and National Defense.

## Websites (U)

(U) Inspector General of the Marine Corps. http:llwww.hqmc.marines.mil/igmc!
(U) Open Source Enterprise. http://www.opensource.gov/.

(U~ Open-Source Resources. See appendix D of this publication for the list ofwebsites for the opensource resources.

(U) U.S. Army Cyber Command. http://www.arcyber.army.mil.

(U) U.S. Computer Emergency Readiness Team. http://www.us-cert.gov/.

(U) U.S. Copyright Office. https://www.copyright.gov/.

## Prescribed Forms (U)

(U) This section contains no entries.

## Referenced Forms (U)

(U) Unless otherwise indicated DA forms are available on the Army Publishing Directorate website:
www.apd.arrny.mil.

(U) DA Form 2028. Recommended Changes to Publications and Blank Forms.

This page intentionally left blank.

## Index (U)

(U) Entries are by paragraph number unless indicated otherwise.

## F A

| comman.                              | der             | 's critical information    |
|--------------------------------------|-----------------|----------------------------|
| requirement (CCIR),                  | 3-1-3-3         |                            |
| access, granting.                    |                 |                            |
| See                                  |                 |                            |
| Army                                 | foreign         | in                         |
| Community On-Line Intelligence       |                 |                            |
| OSINT Office.                        |                 |                            |
| A-                                   |                 |                            |
| 2,                                   | A-4, A-7, A-13  |                            |
| all-source analysis, 1-3, 1-8, 2-2,  |                 |                            |
| System                               |                 |                            |
| fo                                   | r End-Users and |                            |
| Managers (COLISEUM), 3-31            |                 |                            |
| friendly force information           |                 |                            |
| requirement, 3-3                     |                 |                            |
| 6-2                                  |                 |                            |
| counterintelligence, A-4, A-20, B-9 |                 |                            |
| Army Regulation (AR) 381-10, A-7     |                 |                            |

## G

cueing, 1-3, 4-3, 6-2
cybersecurity, B-9
generate intelligence knowledge,
1-27, 1-31, 4-6
cyberspace, 2-37, 2-38, B-8, B-9,
C-36
I
information collection plan, 3-9,

## D

3-10
collection of U.S. person
information, (A-8-A-14)
dissemination of U.S. person
information (A-19)
retention of U.S. person
information (A-15-A-18)
questionable intelligence
Dark Web. See world wide web.
Information collection, 3-1- 3-4
activity, A-20-A-22
deception (and bias). See. OSINT.
information requirement, 3-5, 4-4,
Deep Web, 3-13. See *also* world
wide web.
Army Chief Information
Officer/G-6. *See* OSINT
activities.
Defense Intelligence Agency
6-,1
categorizing, 3-6, 3-8
identifying, 3-6, 3-7
Army Deputy Chief of Staff, G-2.
(DIA), 1-17
information sharing, 1-20, 1-21
See OSINT activities.
INSCOM, 2-30-3-32, 2-34, 2-37.
Army intelligence component,
Defense Open-Source Council,
2-27, 2-28
intelligence
Departmen't of the Army
2-34, 2-37, 3-19, 3-20, A-12,
A-17
Marine *Corps* definition, 1-9
Marine Corps *functional* tasks,
Army OSINT Office (AOO), 2-2,
Intelligence Information Service
(DA liS), 2-34-2-36, 3-15
1-12
digitation, 5-3, 5-4
2-30-2-32
granting access, 1-19
Marine Corps refationships,
1-18

## 8

dissemination, A-19
methods and techniques, 6-4,

intelligence enterprise, 1-14, 1-15

brigade combat team (BCT), 2-6,
6-5

Intelligence estimate. See

2-18
OSINT products, 6-3
intelligence products, types.
bias (a~d deception). *See* OSINT.

Distributed Common Ground intelligence mission, 3-5

broadcast services, 4-11 , 4-14
System-Army (DCGS-A), 1-21 ,
2-35

intelligence preparation of the battlefield/batt/espace. *See* IPB.

## C

division. *See* OSINT cell.

civil considerations, 1-31

## E

Intelligence process, 1-4, 3-2, 3-6,
3-13

classified information, 3-8, 3-23,
3-24

intelligence products, types, 5-9-
5-1 1

collection, 1-3, A-10, B-2
intelligence reach, 1-16-1-18
intelligence requirement, 1-13, .
collection asset
identifying, 3-6, 3-9, 3-10
technical or human, 1-7, 3-B
Executive Order (EO) 12333, A-1-
A-3, A-14
Army intelligence functions,
A-4
Interpretation and
implementation, A-5
collection requirement, 4-9
expeditionary PED. See PED.
4-4, 6-1
categorizing, 3-6, 3c8
identifying, 3-6, 3-7
intelligence running estimate. See
intelligence products, types.
collection technique, 3-6, 3-11-
3-15
based on MCO *3800.28,* A-28

## (U) Entries Aro By Paragraph Number Unless Indicated Otherwibe.

MDMP/MCPP, 1-26, 1-27
intelligence summary. See
and themisslon and
intelligence products, types.
operational variables, 1-29
Intelligence warflghlng fUnction,
usa of open-soun::e
inrormation, 1-29
1-2, 1-13-113
 contribution to the intelligence
Ml brigade (theater), 2-32
enterprise, ~ -~4
tBsks, 1-11
intelligence raach coordination,
1-16
interneL See *also* world wide web.
leveraging tor *reach* OS! NT,
2-4
mllJtary decision-making process.
See MDMP/MCPP.
internatlonal websftes, C-34
OPSEC vulnerabilities, C-36
search considerations, C-35 search engine tools, C-3~
C-33
mission variables
search techniques, C-8, C-7
seCI.lre web brewing, B-3,
(METI-TCIMETT-n. 128,
1-31, 3-4, ~
6-10, B-11
situational awareness and
security, B-1- a:_g
National Geospatlal-lnteiligence
Agency, 1-17

websites, 4-11, 415-417
websltes for exploiting open-
National Ground Intelligence
source information, C-14-
C-29
.
Interpretation. See linguist.
IPB, 131, 3-4
Center, 1-16, 1-17
National Open-Source Committee,
. 2-27, 2-28
National Sacur1ty Agency, 1-17
 definition (Army and Marine
Corps), 1-30
support to running estimates
and the *MDMPIMCPP,* 1-13
offlcar in charge, 211 , 2-12
Open Source Enterprise, 1-17,

L

1-21, 4-14
li nguis~ 2-22, 2-26, 3-39-3--42
quality controVquallty
assurance reviews, 5-6

## (B)(3) J M

| open-source Information,    | '!..J        | ,                 |
|-----------------------------|--------------|-------------------|
| macl1ine                    |              |                   |
| foreign                     |              |                   |
| language                    |              |                   |
| 129,                       |              |                   |
| A11                        | .            |                   |
| translation,                |              |                   |
| 3-41;                       |              |                   |
| 3-42,                       |              |                   |
| 5-6                         |              |                   |
| Marln9 air-ground           | task         |                   |
| forca                       |              |                   |
| (MAGTF),                    |              |                   |
| 2-11                        | , 2-         | 18                |
| MAGTF intelligence center   | (MJC)        | .                 |
| "                           | 1-16         | ,                 |
| 1-19,                       | 2-11         |                   |
| and                         | OPSEC,       | 1-5               |
| collection coordinati       | on,          | 3-28-             |
| . 3-31                      |              |                   |
| collection                  |              |                   |
| of,                         |              |                   |
| 3-4                         |              |                   |
| evaluation                  |              |                   |
| of,                         |              |                   |
| 5.-12,                      |              |                   |
| 5-15,                       | 5-16         |                   |
| exploiting                  |              |                   |
| via                         | websites,    |                   |
| C-                          | 14-          | .                 |
| major                       | suOon:Jlna/9 | command           |
| C-29                        | , tables     |                   |
| 0-1-015                    |              |                   |
| (MSC)                       | .            | Sea               |
| OSINT                       |              |                   |
| cell.                       |              |                   |
| MBrintt                     |              |                   |
| Corps                       |              |                   |
| lnta/1/gence                |              |                   |
| Actfvity                    |              |                   |
| (MCIA),                     |              |                   |
| 1-16,                       |              |                   |
| 1-19,2-33                   |              |                   |
| optlmiling                  |              |                   |
| collection,                 |              |                   |
| 1-7                         |              |                   |
| procasslng                  |              |                   |
| of                          | ,            | 5-3               |
| providing                   | foundation   |                   |
| Marine Corps intelligence   |              |                   |
| information, 1 7           |              |                   |
| component,                  |              |                   |
| A-24, A-27,                 |              |                   |
| A-31                        |              |                   |
| satisfying requirements, 1  | -7           |                   |
| searching                   | via          | open              |
| Marine Corps                | Order        |                   |
| (MCO)                       |              |                   |
| C-6                         |              |                   |
| types,                      |              |                   |
| 4-4                         |              |                   |
| 3800.29,                    |              |                   |
| A-23                        |              |                   |
| questionable                | actiYity,    |                   |
| A-32                        |              |                   |
| U.S.                        |              |                   |
| parson                      |              |                   |
| lnformarton,                |              |                   |
| A-24-                       |              |                   |
| open-source                 |              |                   |
| resources                   | .            |                   |
| See                         |              |                   |
| A-31                        |              |                   |
| appendix                    |              |                   |
| o                           |              |                   |
| MMne                        |              |                   |
| expedilionaty force ,       |              |                   |
| 1-16,                       |              |                   |
| operations 1 environment,   | 1-13,        |                   |
| 1-                          | 18,2-17      |                   |
| 1-28,                       | 2-38,        | 3-1               |
| Merine                      | Corps        | planning process. |
| See                         |              |                   |
| MDMPIMCPP                   | .            |                   |

lndex-2
ATP 222.9/MCRP 2-10A.J

operational variables
(PMES!IPT/PMES/1), 1-28,
1-31,2-19,3-4, ~
operations security. *See* OPSEC.
OPSEC, 1-5, 1-6, 3-19-3-23, 8-3-
B--5, B-9, B-10, C~36
open-source Intelligence (OSINl).
See OSINT.
OSINT, 1-2, <H3
end copyrighted inrormetion,
3-34-,3-38
and Intelligence requirements.
1-4
N
and the MDMP/MCPP, 1-26
capability, 2-1-2-4 characteristics, 1-7,1-8
compliance with laws and
policlBS, 318
contribution to the Intelligence

enterpri&e, 1-15
deception and bias, J-32, 3-33,
5-12,5-:14,5-15
PED, 1-22, 125
preparation cl>nsideratione,
3-16,3-17
processing and axplottet1on,

0

5-1-5-3
regional communities of
Interest, 1-17
99tisfylng intelligence
requirements, 1-31
supporting slt(!tlonal
unde~tand i ng, 1-6
OSINT activities: 1-2
and classlric:atlon guide, 3-23
and the National Open-Source
Commtttee and Defense
Open-Source Councll, 2-27
Army Chief Information
OHicer/G-6, 2-28, 2-29

Army Deputy Chief of Staff,
G2, 2-29

Arm:; Intelligence components,
2-37
.

Army OSINTOffice, 2-30-2-32
DA liS, 2-34-2-36
MCJA. 233
performing risk assessment,

3-23
planning for, 36
requirements to conduct. 3-5
search engines es primary

tool, C-6, C7, C-30-C-33
U.S. Army Cyber Command,

2-38
OSINT *analyst,* 211 , 2-15 .

. 30 June 2017

## (U) Entries Are By Paragraph Number Unless Indicated Otherwise. T

| OS                          | I    | NT                | ce         | ll         |
|-----------------------------|------|-------------------|------------|------------|
|                            | BCT  | and               | below, 2-6 |            |
| divisi                      |      |                   |            |            |
| on                          | and  | above/MSC level,  |            |            |
| public documents,           | 4-11 | , 4-              | 13         |            |
| public speak                | ing  | forum, 4-11, 4-12 |            |            |
| publicly                    |      |                   |            |            |
| ava                         | il   | able              | in         | formation. |
| See                         |      |                   |            |            |
| PAl.                        |      |                   |            |            |
| target development analyst, | 2-6, |                   |            |            |
| 2-9                         |      |                   |            |            |
| target development          | and  | product           |            |            |
| 2-17-2-19                   |      |                   |            |            |
| divisi                      |      |                   |            |            |
| on                          | and  | above/MSC .       |            |            |

## Q

| questionable Intelligence activi   | ty                         | .                   |
|------------------------------------|----------------------------|---------------------|
| personnel, 2-22                    |                            |                     |
| M/C,                               |                            |                     |
| 2-11                               |                            |                     |
| tasks performed during             |                            |                     |
| collecti                           |                            |                     |
| on,                                | 4-3                        |                     |
| See                                |                            |                     |
| Army Regulation 381-10.           |                            |                     |
| See                                | Marine                     | Corps               |
|                                   |                            |                     |
| 3800.28.                           |                            |                     |
| OS/NT chief,                       |                            |                     |
| 2-11,                              | 2-14                       |                     |
| OSINT collection, 4-5-4-17         |                            |                     |
| R                                  |                            |                     |
| reach                              | PED.                       |                     |
| SeePED                             | .                          |                     |
| activit                            | ies                        | 2-21                |
| U.                                 | S.                         | person information, |
| . analyst, 2-22, 2-23              |                            |                     |
| targeting,                         |                            |                     |
| 1-2                                | , 6-2                      |                     |
| team lead                          |                            |                     |
| and                                | requirements               |                     |
| collecti                           |                            |                     |
| on                                 | manager, 222,             | 2-23                |
| theater army, 1-                   | 16                         | , 2-17              |
| threat,                            |                            |                     |
| 3-1,                               | B-8,                       | C-36                |
| transcription, 2-26, 3-40,         | 5-3,                       | 5-                  |
| 5-B                                |                            |                     |
| reg                                | ional communities of inter | est.                |
| translation, 2-26, 3-39-3-42,      | 5-1,                       |                     |
| See                                | OSINT.                     |                     |
| s-3,                               |                            |                     |
| o-4,                               |                            |                     |
| 5-e-s-8, s-12                      |                            |                     |
| OSINTcollection                    | plan,                      | 3-5                 |
| developing, 4-10 .                 |                            |                     |
| implementing,                      | 4-11                       |                     |

## U

| U.                         | S.                 | Army Cyber Command, 2-38,    |
|----------------------------|--------------------|------------------------------|
| OSINT collector,           |                    |                              |
| 2-11,                      | 2-16               |                              |
| OSINT practitioner. 2-1,   | 2-4,               | 2-20,                        |
| B-9                        |                    |                              |
| 2-                         | 21,3-7,3           | -                            |
| 3-38,                      | 4-5,4-15,          | 5-6                          |
| U.                         | S.                 | Army Intelligence            |
| reporting, informati       | on                 | or                           |
| intelligence,              |                    |                              |
| 6-6                        |                    |                              |
| requirements manager, 2-6, | 2-8                |                              |
| retention, A-15            |                    |                              |
| ri                         |                    |                              |
| sk                         | assessment, 3-20  |                              |
| OSINT report (referred     | to                 | as                           |

Security Command .. See
INSCOM.

OSIR}, 5-11 , A-19

U.S. person, A-5, A-7
Army definition, A-8, A-9
Marine Corps definition, A-25

OSINT subject matter expert,
2-11,2-13
p

U.S. person informatlon,A-6, A-21 ,

| and                           | co       | ll             | ection techniques, 3-12    |
|-------------------------------|----------|----------------|----------------------------|
| risk management levels, 2-37, |          |                |                            |
| 3-20,                         |          |                |                            |
| 3-22,                         | 3-       | 27,            | 3-                         |
| running esti                  | mate,    | 1-14, 1-29, 4- | 2,                         |
| 5-9                           |          |                |                            |
| s                             |          |                |                            |
| secondary source, 3-33, 5-12, |          |                |                            |
| 5                             | --       | 14-5           | -                          |
| PAl                           | ,        | 1-3,           | 3-B,                       |
| and                           | OPSEC,   | 1-6            |                            |
| collecti                      |          |                |                            |
| on                            | methods, | 4-7            |                            |
| uses,                         | 1-13     |                |                            |
| section leader,               | 2-6,     | 2-7            |                            |
| security classification       |          |                |                            |
| gu                            | idance,  |                |                            |
| 3-24-3"26                     |          |                |                            |

A-22. See also Marine Corps
Order 3800.28.
collection of, A-8-A-14
dissemination of, A-19
retention of, A-15-A-18
w

| PED,                              | 1-2      |
|-----------------------------------|----------|
| expeditionary                     |          |
| PED                               | ,        |
| OSINT                             | PED      |
| reach                             |          |
| PED,                              |          |
| 1-23,                             | 1-25     |
| plan requireme n                  |          |
| ts                                | and      |
| collecti                          |          |
| on,                               | 1-13,    |
| primary source, 5                 |          |
| -1                                | 2-5-16  |
| priority intelligence requirement |          |

web browse(ing), 3-16, 3-19, 3-42,
B-3, B-1 0, B-1, I C-12, C-15,
C"35, C-36
world wide web, C-1, C-2
. Dark Web, C-2, C-5
Deep Web, C-2, C-4, C34,

|                             |                  |         | (P!R), 1-   | 7,    |
|-----------------------------|------------------|---------|-------------|-------|
| 3-                          | 3,               | 3-5,    | 3-9,        | 3-25, |
| C-                          | 36               |         |             |       |
| Surface Web, C-2-C-4        |                  |         |             |       |
| .,                          | 4-3,             | B-2     |             |       |
| private information, 3-8    |                  |         |             |       |
| situation development       | ana              | l       | yst,        |       |
| 2-6, 2-9                    |                  |         |             |       |
| situation development       | and              | product |             |       |
| analyst,                    |                  |         |             |       |
| 2-22,                       | 2-24             |         |             |       |
| situation development, 1-13 |                  |         |             |       |
| situational                 |                  |         |             |       |
| unde                        | rstanding, 1 "13 |         |             |       |
| social media, 3-27, 4-      | 17               |         |             |       |
| special operations, 1-      | 17               |         |             |       |
| Surface Web.                |                  |         |             |       |
| See                         |                  |         |             |       |
| world wide                  |                  |         |             |       |
| processing, exploitation,   | and              |         |             |       |
| disseminatio                | n.               |         |             |       |
| See                         |                  |         |             |       |
| PED                         | .                |         |             |       |
| web.                        |                  |         |             |       |

This page intentionally left blank.

By order of the Secretary of the Army:
Official:
v Administrative Assistant to lhe Secretery of the Atmy
1718004
By Direction of the Commandant of the Marine Corps:
b6
ROBERTS. WALSH
Lieutenant General, U.S.

Marine Corps Deputy Commandant Combat .Development and

Integration

## Distribution:

Active Army, the Army Nariona/ Guard, and I he United Slates Army *Reserwt.* Not to be distributed; electronic media only.

PIN: 102813-000
MARINE CORPS.PCN: 144 000278 00
FOR OFFICIAL USE ONLY