# United States Army Inspector General School



# Intelligence Oversight Guide



DEPARTMENT OF THE ARMY INSPECTOR GENERAL AGENCY
TRAINING DIVISION
5500 21ST STREET, SUITE 2305
FORT BELVOIR, VIRGINIA 22060-5935
February 2008



## Table Of Contents ____________________________________ The Intelligence Oversight Guide


Introduction

Chapter 1 - Background Information

Chapter 2 - Intelligence Oversight Inspection Methodology

Appendix A - Summary of AR 381-10

Appendix B - Army G-2 Memorandum: Collecting Information on U.S. Persons

Appendix C - Sample Intelligence Oversight Inspection Directive

Appendix D - Sample Intelligence Oversight Detailed Inspection Plan

Appendix E - Sample Intelligence Oversight Unit In-Brief Presentation

Appendix F - Intelligence Oversight Training Scenario and Practical Exercises

Appendix G - Procedure 15 Reporting Format


## Introduction _____________________________________ The Intelligence Oversight Guide


1. **Purpose.**  The purpose of this guide is to assist Inspectors General (IGs) in preparing, executing, and completing Intelligence Oversight inspections.  The Training Division, U.S. Army Inspector General Agency, uses this guide in teaching Intelligence Oversight at the U.S. Army Inspector General School.  All field IGs can use this guide in their routine Intelligence Oversight inspections.

2. **IG Responsibilities.**  Every IG has a responsibility to provide Intelligence Oversight of intelligence components and activities within his or her command; inspect intelligence components as a part of the Organizational Inspection Program (OIP); and report any questionable activities in accordance with Procedure 15, AR 381-10, to HQDA (SAIG-
IO).  This text provides IGs with a ready reference to assist them in carrying out these responsibilities.  IGs should not use this guide as a stand-alone reference during Intelligence Oversight inspections but instead should use it in conjunction with AR 381-
10, U.S. Army Intelligence Activities; The Inspections Guide; and AR 1-201, Army Inspection Policy.

3.  Relationship to AR 20-1, Inspector General Activities and Procedures, and AR 1-201, Army Inspection Policy.  This guide supports the Intelligence Oversight requirements outlined in AR 20-1 and the Inspections Process described in Chapter 6 of the same document.  This guide further supports the Inspection Principles and the precepts of the Organizational Inspection Program (OIP) as found in AR 1-201.

4. **Relationship to AR 381-10, U. S. Army Intelligence Activities.**  This guide complements and reinforces the information found in this regulation, which is the governing document not just for the conduct of the Army intelligence activities but for Intelligence Oversight as well.


5. **Proponency**.  The U.S. Army Inspector General School (TIGS) is the proponent for this guide.  Please submit recommended changes or comments to the following address:
U.S. Army Inspector General School


ATTN:  SAIG-TR

5500 21st Street, Suite 2305

Fort Belvoir, Virginia 22060-5935
Telephone:

Commercial: (703) 805-3900

DSN: 655-3900
TIGS relies upon the subject-matter expertise of DAIG's Intelligence Oversight Division (SAIG-IO) for the accuracy of information found in this guide.  Specific questions about

the conduct of Intelligence Oversight inspections and other related concerns should be directed to the Intelligence Oversight Division at the following address:
U. S. Army Inspector General Agency


ATTN: SAIG-IO

1700 Army Pentagon

Washington, DC  20310
Telephone:

Commercial: (703) 697-6698

DSN: 227-6698

6.  **Format for Sample Memorandums:** This guide contains sample memorandums that do not adhere to the format requirements outlined in Army Regulation 25-50, Preparing and Managing Correspondence.  In an effort to save space and paper, some of the required font sizes and spacing have been compressed.  Refer to Army Regulation 25-50 for the correct format specifications.

7.  **Updates.**  TIGS will distribute updated versions of this guide as necessary.  TIGS
will notify - and then forward electronic copies to - all IG offices when changes have occurred.

8.  **Summary of Updates.**  This version of the guide incorporates minor administrate changes throughout and changes the standard of five working days for Procedure 15 reports to SAIG-IO to five days in accordance with Army Regulation 381-10, paragraph
15-2 b.



## Chapter 1 _____________________________________ Background Information


1.  **Purpose.**  This chapter provides background information on Intelligence Oversight and the current rules and regulations that pertain to this system.


2.  **Background Information.**  During the 1960s and early 1970s, the Vietnam War strongly polarized many groups within the United States because many Americans opposed our involvement in that Southeast Asian country - often violently.  These protests - and protests brought on by other issues of the 1960s such as the Civil Rights Movement - prompted many leaders at the highest levels of government to view these groups not just as political threats but also as threats to civil order.  Senior leaders within the government ordered U.S. Army intelligence units and other government agencies to collect aggressively information about U.S. citizens who were involved in the anti-war and Civil Rights Movements in the belief that foreign governments were fomenting the actions of these movements.

The public soon learned about this behavior and cried foul.  These intelligencegathering activities - now deemed "Big Brother" activities - led to public demands for curbs on the intelligence community to protect against abuses of the Constitutional provision against unlawful search and seizure.  President Gerald Ford responded to these public and Congressional pressures for reform with an executive order (Executive Order 11905, February 1976) that, for the first time, established rules on the collection, retention, and dissemination of information on U.S. persons.  Successive presidents promulgated their own executive orders refining those rules, culminating in Executive Order 12333, which President Ronald Reagan signed during the opening weeks of his administration in 1981.  Each president since President Reagan has endorsed this same executive order.  The events of September 11, 2001, have not changed these rules (see Appendix B).  Although the abuses that brought about the Intelligence Oversight system occurred more than 30 years ago, Intelligence Oversight requirements remain current and relevant today - especially in light of the ongoing global war on terror.  Information operations, open-source intelligence collection, frequent deployments and stabilization operations, force protection operations, and the sharing of information between intelligence and law enforcement organizations are but a few current situations that are bringing military personnel into contact with U.S. person information and therefore demand increased Intelligence Oversight vigilance.

3.  **The Intelligence Oversight System.**

     a. **Standards.**  Executive Order 12333 is the current Intelligence Oversight executive order.  The Department of Defense implemented and amplified that executive order in Department of Defense (DoD) Directive 5240.1-R, Procedures Governing the Activities of DoD Intelligence Components that Affect United States Persons.  Army Regulation
(AR) 381-10, U.S. Army Intelligence Activities (FOUO) implements the DoD Directive within the Army.  AR 20-1, Inspector General Activities and Procedures, specifies the role of Inspectors General in Intelligence Oversight.

     b. **General.**  AR 381-10 contains both broad policy guidance and very specific directions for approval of specialized investigative and collection techniques.  The Army Deputy Chief of Staff, G-2, is the policy proponent for AR 381-10.  The chapters in AR
381-10 outline 15 procedures and two clarifying chapters that enable DoD intelligence components to perform effectively their authorized functions while ensuring that activities affecting U.S. persons occur in a manner that protects the Constitutional rights and privacy of such persons.  All personnel assigned to, or supervising, intelligence components must, at a minimum, be familiar with Procedures 1 through 4 (General Provisions and Guidance on Collection, Retention, and Dissemination of Information on U.S. persons), Procedure 14 (Employee Conduct), and Procedure 15 (Questionable Intelligence Activities).  Chapter 16 (Federal Crimes) of the regulation concerns the reporting of Federal crimes involving military intelligence (MI) personnel.  Chapter 17 (Support to Force Protection, Multinational Intelligence Activities, Joint Intelligence Activities, and Other Department of Defense Investigative Organizations) provides guidance for MI support of force protection programs as well as intelligence support for missions within a joint, multinational, and interagency environment.  Appendix A to this guide contains summaries of the AR 381-10 chapters.

c. **Applicability.**  AR 381-10 applies to all Army intelligence components or activities as well as any organization, staff, or office used for foreign intelligence or counterintelligence purposes.  AR 381-10 defines *intelligence activities* as all activities necessary for the conduct of foreign relations and the protection of national security pursuant to Executive Order 12333.  Executive Order 12333 defines these activities -
for the foreign intelligence and counterintelligence elements of the Army - as "military and military-related foreign intelligence and counterintelligence [gathering] . . . and information on the foreign aspects of narcotics production and trafficking."  As defined by AR 381-10, *intelligence components* include the following Active Army, Army Reserve, and Army National Guard (ARNG) activities:


(1) Office of the Deputy Chief of Staff, G-2.
(2) U.S. Army Intelligence and Security Command (INSCOM) and subordinate units.

(3) 650th MI Group, Supreme Headquarters Allied Powers Europe.  (This command provides National counterintelligence support to Supreme Allied Commander Europe (SACEUR) and U.S. personnel within the command).
(4) Senior intelligence officers and staffs of Army Commands (ACOMs), Army Service Component Commands (ASCCs), and Direct Reporting Units (DRUs), and other commands and organizations.

(5) G-2 / S-2 offices.
(6) Installation, organization, or facility security offices when carrying out intelligence activities.

(7) Military intelligence units. (8) U.S. Army Intelligence Center and other organizations conducting intelligence
training.
(9) Intelligence systems developers when testing systems.
(10)  Contractors of any Army entity when conducting intelligence activities as defined by AR 381-10.

(11)  Any other Army entity when conducting intelligence activities as defined by AR 381-10. Because military intelligence is exclusively a Federal mission, AR 381-10 controls the activities and training of the Army National Guard when using military intelligence resources and assets that the Federal government has provided, including activities or training that takes place in Title 32 status.  AR 381-10 does not apply to Army intelligence components when engaged in civil disturbance or law enforcement activities.  When Army intelligence activities gather information that leads to a reasonable belief that a crime has been committed, they must refer the matter to the appropriate law enforcement agency in accordance with Procedure 12 and Chapter 16 of AR 381-10.

d. **Responsibilities.**  All personnel conducting, supervising, or providing staff oversight of intelligence activities - or are involved in any other way in intelligence activities - are charged with ensuring that those activities are conducted properly.

    (1) Individuals.  Each individual involved in military intelligence activities will -

- Be familiar and comply with the applicable portions of AR 381-10. - Conduct intelligence activities strictly in accordance with U.S. law, policy, executive orders, DoD 5240.1-R, AR 381-10, and the policy of the appropriate intelligence discipline. - Report any questionable activity in accordance with Chapter (Procedure) 15
of AR 381-10. - Report any Federal crimes upon discovery in accordance with Chapter 16 of AR 381-10


(2) Commanders.  AR 381-10 requires all commanders of units with intelligence missions to designate an intelligence professional in the intelligence operational chain to function as the organization's Intelligence Oversight Staff Officer.  Commanders of units with military intelligence missions will ensure -

- All assigned or attached personnel conducting intelligence activities do so in accordance with U.S. law, regulation, and policy. - Military intelligence (MI) personnel and non-MI personnel conducting intelligence activities are fully aware of and comply with their individual responsibilities as outlined in AR 381-10.


- Unit personnel and supporting contractors receive the training described in paragraph 14-1 of AR 381-10 within 30 days of assignment or employment and refresher training as a part of the routine command-training program.  Commands that have signal intelligence elements will ensure those elements obtain appropriate training from qualified personnel on applicable Signal Intelligence directives. - Personnel are protected from reprisal or retaliation because they report allegations of questionable activity or Federal crimes. - Appropriate corrective actions are imposed upon any employee who violates the provisions of AR 381-10 or policies of the appropriate intelligence discipline.


- Inspectors General; the Deputy Chief of Staff, G-2; the DoD and the Army's Office of General Counsel; and the Assistant to the Secretary of Defense for Intelligence Oversight (ATSD-IO) have access to all information necessary to perform their oversight responsibilities regardless of classification or compartmentation.

- Implement a review process to ensure U.S. person information was collected and retained in accordance with this regulation before transferring files to the Investigative Records Repository or information into intelligence databases.

- Implement a review process to ensure U.S. persons information incorporated into intelligence databases is maintained in accordance with ARIMS.

## (3) Inspectors General.


(a)  AR 20-1 charges all Army IGs with providing independent oversight of intelligence components and activities within their commands.  They will -
- In accordance with AR 381-10, provide Intelligence Oversight of intelligence components and activities within their command in accordance with Executive Order 12333 and DoD Directive 5240.1-R.


- Inspect intelligence activities as part of their Organizational Inspection Program. - Report any questionable activities in accordance with Procedure 15, AR 381-
10, to DAIG (SAIG-IO) within five days.


- Ensure that inspected personnel are familiar with the provisions of AR 381-
10, emphasizing Chapters 1 through 4, and Chapters 14 through 17.

(b)  AR 381-10 charges IGs to --

- As part of the inspection program, determine if intelligence elements are conducting foreign intelligence and counterintelligence in compliance with this and other applicable regulations.

- Ascertain whether any organization, staff, or office not specifically identified as an Army intelligence element is being used for foreign intelligence or counterintelligence purposes and, if so, ensure its activities comply with AR 381-10.

- Evaluate leadership awareness and understanding of the authorities for intelligence collection of U.S. person information.

- Ensure that procedures exist within each element for reporting questionable intelligence activities and that personnel are aware of their reporting responsibility.

- Provide advice to the command and intelligence oversight staff officer as needed.

- Describe significant intelligence oversight activities and inspections and suggestions for improvement in the program for TIG's (SAIG-IO) quarterly report to the Assistant Secretary of Defense for Intelligence Oversight (ATSD-IO).

- Determine if intelligence components are involved in any questionable activity and, if such activities have been or are being undertaken, ensure the matter is investigated and corrected in accordance with paragraph 15-3, AR 381-10.  If a unit involved in questionable activities did not report such matters as prescribed by AR 381-
10, ascertain the reason for the failure and recommend appropriate corrective action.


(4) Legal Counsels. The Army's Office of General Counsel (OGC) shares responsibility for Intelligence Oversight with the Army DCS, G-2 and TIG.  Legal counsels at all levels provide legal interpretations of applicable law, regulations, and policies.  Forward questions that cannot be resolved at the local level through command channels to the Army G-2 at Headquarters, Department of the Army, for consideration by the Office of The Judge Advocate General (OTJAG).  Questions that cannot be resolved at that level are referred to OGC.



(5) Army Deputy Chief of Staff (DCS) G-2.  Establishes Intelligence Oversight policy within the Army and serves as the proponent for AR 381-10.

e. Reporting.

    (1) Questionable Intelligence Activities.  Procedure 15 - described in Chapter 15
of AR 381-10 - provides the process for identifying, investigating, and resolving allegations of questionable intelligence activities.  Questionable activity involves conduct during or related to an intelligence activity that may violate law, Executive Order or Presidential Directive, or applicable DoD or Army policy, including AR 381-10.



(a) Units should forward all reports of questionable activity through command channels to DAIG (SAIG-IO).  Allegations of questionable activity must be reported in a timely manner despite the possibility that the allegation might not be substantiated. Employees have the option to report directly to the U.S. Army Inspector General Agency (SAIG-IO), the Army G-2 (DAMI-CDC), or OGC.  Units must forward questionableactivity reports as soon as possible but no later than five days after discovery (see Appendix G for the reporting format).  A reported allegation does not necessarily mean that a person or unit has violated law or policy.  The fact that a questionable activity report has been submitted does not reflect negatively upon a unit; rather, it shows a unit's compliance with AR 381-10.  Whenever in doubt as to whether an activity falls under Procedure 15 requirements, the unit or IG should proceed in reporting the activity for resolution at the higher levels.



(b) TIG forwards reports of questionable activity through OGC to the Assistant to the Secretary of Defense for Intelligence Oversight (ATSD-IO).  The reporting policies directed by Procedure 15 are specifically designed to ensure that only questionable activities are reported to the Intelligence Oversight system and are in addition to command and organizational responsibilities to investigate and respond to the questionable activity in accordance with appropriate laws, policies, and regulations. Procedure 15 provides a streamlined and expeditious reporting method to demonstrate that the Army continues to police the MI community and take appropriate action to correct issues.  However, a Procedure 15 report is not a substitute for other required reporting requirements such as a Serious Incident Report (SIR), counterintelligence incident report, or a security violation report.

    (2) **Federal Crimes by Intelligence Personnel.**  Chapter 16, AR 381-10, also requires the reporting of any facts or circumstances that indicate that a member or employee of an Army intelligence component may have violated a Federal law.  This chapter also applies when violations of Federal law by others comes to the attention of intelligence personnel.  This Federal crime reporting is distinct from questionable-activity reporting, and AR 381-10 provides for both of these processes.  IGs do not have to become involved in Federal crime reporting unless such crimes also constitute a questionable activity.  The regulation lists examples of questionable intelligence activity constituting a crime in paragraph 15-4 and reportable Federal crimes in paragraph 16-3.
Forward reportable Federal crimes to the DCS, G-2 (DAMI-CDC) not later than five days after discovery or receipt at the Army Command (ACOM), Army Service Component Command (ASCC), or Direct Reporting Unit (DRU) level.

    (3) **Quarterly Report of Intelligence Oversight Activities.**  TIG prepares and forwards a Quarterly Report of Intelligence Oversight Activities through OGC to the ATSD-IO.  The report is a compendium of questionable activity reported during the quarter, follow-up reports of ongoing investigations or inquiries regarding questionable activities, and a summary of inspections conducted by SAIG-IO during the quarter. ATSD-IO uses this report in the preparation of its own report to the President's Intelligence Oversight Board.  Procedure 15, paragraph 15-6, requires specified major commands to provide input for this report to TIG.



## Chapter 2 _____________________________________ Intelligence Oversight Inspection Methodology


1.  **Purpose.**  This chapter discusses Intelligence Oversight inspections and provides Inspectors General with a recommended methodology for conducting Intelligence Oversight inspections.

2.  Intelligence Oversight and the Organizational Inspection Program (OIP).
AR 20-1 mandates that all IGs conduct Intelligence Oversight inspections as part of their OIP.  Each commander's OIP will normally determine the frequency of intelligence oversight inspections.  However, IGs should inspect the intelligence components within their organizations a minimum of once every two years.  IGs should orient Intelligence Oversight inspections primarily on compliance with AR 381-10, applicable Intelligence Oversight policies, applicable intelligence regulations (AR 381-20 and AR 381-12), and individual knowledge.  IGs at all levels provide independent oversight of Army intelligence components within their command.  The Intelligence Oversight Division
(SAIG-IO) of the U.S. Army Inspector General Agency (DAIG) inspects certain sensitive intelligence activities and a sampling of intelligence activities throughout the Army's active and reserve intelligence components.

3.  **Major Tenets of an Intelligence Oversight Inspection.**  At a minimum, an Intelligence Oversight inspection should identify command intelligence components and other offices and staffs performing intelligence functions.  The inspection should also determine if an Intelligence Oversight program exists and how the unit educates its personnel on applicable AR 381-10 requirements.  The inspection must identify any questionable activities; determine how violations are reported; and, if necessary, report violations found during the inspection.  Lastly, IG inspectors must ensure that the responsible personnel know where they can obtain expert advice.  The following paragraphs describe the major parts of an Intelligence Oversight inspection.


     a.  **Identify command intelligence components.**  Chapter 1 of this guide contains of list of the various active and reserve component activities that AR 381-10 defines as intelligence components.  To identify intelligence components and personnel performing intelligence functions, ask the following questions:  Where are the Military Intelligence
(MI) operational units and G-2 / S-2 offices?  Who (and where) are your supporting counterintelligence (CI) units?  Where are the less obvious intelligence components such as security personnel, intelligence systems designers and testers, military intelligence (MI) schools, or contracted employees that perform intelligence functions?

     b.  **Intelligence Oversight programs.**  Most intelligence components develop formal Intelligence Oversight programs and assign Intelligence Oversight responsibilities to individual units and key personnel.  If a unit has such a formal program, that program should be tailored to the function and mission of the unit and the MI disciplines (such as signals intelligence) involved.  Some items a local Intelligence Oversight program should address are the measures or instructions necessary to ensure U.S. person information is properly collected, retained, and disseminated; the commander's program for Intelligence Oversight training; Intelligence Oversight requirements for deployments (pre-, during, and post-deployment); Intelligence Oversight reviews for operational planning, to include any methodology to determine Intelligence Oversight risk; the availability of standardized references; the process to ensure intelligence files are reviewed annually; and the procedures for reporting questionable activities.  AR 381-10 requires commanders of units with intelligence missions to designate an intelligence professional in the intelligence operational chain to function as the organization's Intelligence Oversight Staff Officer.  The Intelligence Oversight program's guidance should outline the duties and responsibilities of this officer.  Soldiers and leaders within the command should know who the Intelligence Oversight officer is and the responsibilities inherent in that position.  The Intelligence Oversight officer's understanding of the cooperative role shared between the IG and the Staff Judge Advocate (SJA) in the oversight of intelligence activities requires examination as well. The IG has specific oversight responsibilities as outlined in AR  20-1, and the SJA must understand AR 381-10 in order to ensure that the units stay within the boundaries of both law and policy.

     c.  **Intelligence Oversight education.**  AR 381-10, Procedure 14, paragraph 14-1
requires personnel to be familiar with AR 381-10, with emphasis on Chapters 1 through 4 and 14 through 17.  All personnel assigned to intelligence components must know that Army policy prohibits intelligence components from collecting, retaining, or disseminating U.S. person information without the duly assigned mission or authority.
All personnel must know that they should question intelligence activities that may violate law or policy and report possible violations to the chain of command or to the Inspector General.  Intelligence personnel who employ specialized collection techniques need detailed knowledge on the approvals, authorities, and restrictions outlined in AR 381-10.
Inspectors should check for compliance with the regulation, review training materials, and determine if personnel understand how to apply Intelligence Oversight in operational missions.  See Appendix F for an Intelligence Oversight training scenario and practical exercises.  The Army G-2 maintains an Intelligence Oversight Web page with additional training scenarios (http://www.dami.army.pentagon.mil/).


     d.  **Identify and report questionable activities.**  Determine if individuals in intelligence components know how to report a questionable activity in accordance with AR 381-10, Chapter (Procedure) 15.  If you discover questionable activities during your inspection, or you are in doubt whether an intelligence component has or has not performed a questionable activity, have the intelligence component submit a Procedure 15 report as required by the regulation.  DAIG's Intelligence Oversight Division
(SAIG-IO) will resolve the issue with appropriate proponents and legal experts and then provide you with a response.

4.  **Sample Inspection Methodology.**  The following inspection methodology (normally developed as part of the Plan-in-Detail step of the Inspections Process) is recommended for the conduct of all Intelligence Oversight inspection visits.  Like all inspections, the visit should begin with an in-briefing and end with an out-briefing.

a.  **In-briefing.**  The inspecting IG team chief should briefly describe the conduct, techniques, and scope of the Intelligence Oversight inspection, list the inspected units, and outline to whom and when the inspection report is due.  See Appendix E for an example of an IG in-briefing to the intelligence component.

   b.  Inspected **Unit brief.**  The inspected unit should brief the IG inspection team on the unit mission, organization, operations, intelligence files, and any Intelligence Oversight policy or program.  Elements of importance include the existence of an intelligence oversight program - beyond simply a written program - and a designated Intelligence Oversight Staff Officer.

    c.  **The IG Intelligence Oversight Inspection.**

(1) Check to ensure that the unit has a copy (or an electronic version) of AR
381-10 and any applicable changes.  Also, check for any relevant Army Command (ACOM), Army Service Component Command (ASCC), Major Subordinate Command (MSC), or unit regulations or policies that require intelligence components to maintain an Intelligence Oversight policy book.  Review any policy requirements to ensure that they meet the unit's needs and the intent of the regulation.  For IGs inspecting subordinate units with IGs, review the unit's OIP memorandum or regulation to ensure that the IG portion of the program includes Intelligence Oversight, and review OIP
records to ensure that Intelligence Oversight inspections are occurring.

(2) Examine training records to determine whether personnel receive training on AR 381-10.  Chapter (Procedure) 14 requires all personnel to receive tailored unit training within 30 days of assignment and refresher training as part of the routine command-training program.  Remember that the regulation specifies that all personnel assigned to an intelligence component must be familiar with AR 381-10 and not just personnel with intelligence specialties.  The regulation also requires that contractors who work on intelligence systems or conduct intelligence activities must receive Intelligence Oversight training since AR 381-10 and DoD Directive 5240.1-R consider them to be employees.  The IG inspector should also review the command or unit's training package. (3) Review the unit's OIP documents to ensure intelligence oversight is part of the command's inspection program (i.e. command inspections and staff inspections). Determine if the unit has procedures in place to follow up on deficiencies.  Physically check the results of previous inspections to determine if the unit corrected problematic areas and reported and resolved matters of questionable activity in accordance with Chapter 15 (Procedure 15) of AR 381-10.

(4) As a method to determine individual knowledge, IGs can pass out copies of Intelligence Oversight training scenarios and practical exercises to intelligencecomponent personnel and have them brief their answers (see Appendix F).  Be sure to include as many different answers as time allows.  Hold discussions on why individuals answered as they did, referring to AR 381-10 and applicable Intelligence Oversight policies on each point. (5) Review the unit procedures for handling all intelligence information (written and electronic), specifically focusing on how individuals handle U.S. person information. Determine if individuals can identify what U.S. person information is and what they would do if they come across U.S. person information.  Ask how and from whom the unit receives intelligence documents, how the unit analyzes this information and produces its own intelligence products, and how and to whom the unit disseminates the products.

(6) Physically check the intelligence files for U.S. person information.  Look at both paper and electronic files.  Concentrate on threat files, particularly Force Protection files, Operational Plans (OPLANs), and Intelligence Summaries (INTSUMs).  Crosswalk unit intelligence files with disciplinary and derogatory files involving intelligence personnel to determine whether a relationship to questionable activity existed and whether the unit complied with the provisions of AR 381-10.

(a)  Unauthorized collection by corps and division intelligence components often occurs when Force Protection or antiterrorism information is incorrectly included in the intelligence products.  Military Intelligence units may be trying to do the Provost Marshal's job.  Unless authorized under Chapter 12 (Procedure 12) of AR 381-10, military intelligence components do not have a mission to retain information on U.S. domestic threats; those threats are a law enforcement and Provost Marshal function.
The G-2 / S-2 is not involved in antiterrorism on the domestic front, which is an operations function as outlined in AR 525-13.  This delineation of responsibility does not mean that Military Intelligence components should not pass information of this type to the appropriate authorities; the key point is that intelligence components should not collect, retain, and disseminate this kind of information for Military Intelligence purposes.

(b)  There may be circumstances where the retention of an intelligence file with U.S. person information is appropriate.  For instance, the Military Intelligence component may keep Information about a "non-targeted" U.S. person acquired incidentally to an otherwise authorized collection as long as the information meets the retention criteria of Chapter 3 (Procedure 3) of AR 381-10.  Also, Military Intelligence components may temporarily retain U.S. person information for up to 90 days solely to determine if the information is, in fact, retainable under AR 381-10.  The 90-day period starts upon the unit's receipt of the information. (c)  Personnel security information is NOT Military Intelligence information.
This information is considered administrative in nature by AR 381-10 and is governed by AR 380-67.  Unit S-2s and garrison intelligence and security divisions are authorized to retain information necessary to support the processing of security clearances.

(7) Check for an annual review of intelligence files and databases.  AR 381-10, Chapter 3 (Procedure 3), directs intelligence components to review intelligence files and databases annually.  The review - which the unit can conduct incrementally as long as all holdings are reviewed annually - ensures that any retention of U.S. person information is only for authorized functions, is not held beyond the established disposition criteria, and is not retained in violation AR 381-10.  These reviews should normally be conducted in concert with a review of files required by AR 25-400-2, The Army Records Information Management System (ARIMS).  The unit should maintain a record of these reviews and identify the specific U.S. person information they must retain for approved mission purposes.

(8) Military Intelligence support to Civilian Law Enforcement Authorities (CLEA).
Pay particular attention to files relating to support given to civilian law enforcement and to domestic-threat assessments for Continental United States (CONUS) military installations.  Except for emergencies, approval for support to CLEA and the Federal Bureau of Investigation must come from the Secretary of Defense.  Units that have provided support to civilian law enforcement agencies are particularly vulnerable to violations of AR 381-10 - especially when after-action reports and threat assessments are brought back from the support missions and incorporated into U.S. Army intelligence files.  When the intelligence personnel are on authorized missions supporting a civilian law enforcement agency, they may collect certain information on U.S. persons.  That information, however, remains the property of the law enforcement agency, and the intelligence component may not retain this information in intelligence files.  Individuals with a military intelligence Military Occupational Specialty (MOS) may be detailed to support law enforcement efforts based upon their specific skills, but their activities should not be co-mingled with work in their military intelligence field or create the perception that a U.S. Army Military Intelligence component is collecting U.S. person information.

(9) Finally, determine if the intelligence component knows how to report a questionable activity in accordance with AR 381-10, Chapter (Procedure) 15, and reportable Federal crimes under Chapter 16.  Does an Intelligence Oversight Point of Contact (POC) exist for the command or in the intelligence component?  Do unit members know who the Intelligence Oversight POC is and the role of the Intelligence Oversight Staff Officer?  Do they understand the IG role in Intelligence Oversight?  Is the command's Staff Judge Advocate (SJA) knowledgeable regarding Intelligence Oversight and the reporting of questionable activities and Federal crimes?  If the intelligence component discovers or suspects questionable activities, the unit must submit a Procedure 15 report immediately.



    d. **Out-briefing.**  Discuss any possible Intelligence Oversight issues identified during the inspection with the intelligence component's leadership.  Inform the unit that these issues are just issues and not findings or observations until you can crosswalk (or verify) them.


5.  **DAIG Tip**:  The underlying principle for Intelligence Oversight is to ensure that we uphold each individual's Constitutional rights and maintain the good name of the Army. The rules for Intelligence Oversight apply throughout the Army:  the Army may only maintain personal information that is necessary to accomplish a purpose or mission of the Army as required by Federal statute or executive order (also see AR 340-21, The Army Privacy Program, paragraph 4-1).  AR 381-10 simply provides for additional oversight as well as procedures that allow intelligence components to handle U.S.

person information when it is necessary to accomplish the intelligence mission.  When IGs encounter U.S. person information in the files of an intelligence component, the two primary questions that the component must answer are as follows: (1) What is your mission? and (2) *What is your authority*?  Intelligence Oversight is usually a matter of individuals trying to do the right thing and not understanding the correct authority that governs their mission.


Appendix A
_____________________________________
Summary of AR 381-10
1. **Purpose.**  This appendix provides a summary of the 17 Intelligence Oversight chapters outlined in AR 381-10.


2. Chapter 1 **(Procedure 1) - General Provisions.**  Chapter 1 describes the purpose, responsibilities, and the applicability of the regulation and the general principles governing intelligence activities.

a.  Department of the Army (DA) intelligence components must:
    (1) Not infringe upon the Constitutional rights of any United States (U.S.) person;
    (2) Protect the privacy rights of all persons entitled to such protection;
    (3) Be based on a lawfully assigned function;
    (4) Employ the least intrusive, lawful techniques; and
    (5) Comply with all regulatory requirements.

b.  AR 381-10 does not in itself authorize intelligence activity.  The Army element must first have the mission and authority to conduct the intelligence activity and, when duly authorized, must comply with the provisions of AR 381-10.  Also, the fact that a collection category exists does not convey authorization to collect.  There must be a link between the U.S. person information and the element's assigned mission and function, to include the exploitation of open-source data.


c.  Participation of military intelligence components in special activities (See definition of special activities in Glossary of AR 381-10) is prohibited unless the President, Secretary of Defense, and Service Secretary have approved the special activity.  Assassinations are specifically forbidden for MI personnel as is requesting any other party to perform an activity that MI personnel are prohibited from performing.

d.  AR 381-10 does not apply to law enforcement activities, including civil disturbance operations.  Procedure 12 requires Secretary of Defense concurrence with support to civilian law enforcement authorities by intelligence components.  When intelligence components collect information that provides a reasonable belief that a crime has been committed, they are obligated to report that information to the appropriate law-enforcement agency in accordance with Procedure 12 and Chapter 16.



e.  A person or organization outside the U.S. - or an alien within the United States -
is presumed not to be a U.S. person unless the intelligence component obtains specific information to the contrary.

3.  **Chapter 2 (Procedure 2) - Collecting U.S. Persons Information.** a.  This chapter specifies the kinds of U.S. person information that MI components may collect and the general means by which information may be collected.  The core tenet of AR 381-10 is that MI components may collect U.S. person information only when necessary to fulfill an assigned function and the collection activity falls into one of 13 categories listed in Procedure 2.



b.  The definition of collected can cause confusion.  AR 381-10, Glossary, defines collection as follows:


Information is *collected* when an intelligence employee gathers and receives the information in the course of official duties and the employee intends to use the information for intelligence purposes.  An employee must take an action that demonstrates an intent to use or retain the information, such as producing an intelligence information or incident report or adding the information to an intelligence database.  Data acquired by electronic means (for example, telemetry, signals traffic analysis, and measurement and signatures intelligence) is "collected" only when it has been processed from digital electrons into a form intelligible to a human.  Information held or forwarded to a supervisory authority solely for a collectability determination, and not otherwise disseminated within the intelligence component, is not "collected."


c.  A U.S. Person is any entity meeting one of the following criteria:

(1) A U.S. citizen, (2) An alien known by the intelligence component to be a permanent resident alien, (3) An unincorporated association substantially composed of U.S. citizens or permanent resident aliens, or (4) A corporation incorporated in the United States that is not directed or controlled by a foreign government.

d.  When authorized, MI components may collect U.S. person information by any lawful means but must exhaust the least intrusive collection means before requesting a more intrusive method.  The least intrusive means would involve using publicly available sources or information with the U.S. person's consent.  Only when information cannot be gained from open sources, or with the consent of the U.S. person, will more intrusive means be used to the extent of the law.  Within the United States, only overt means


may be used to collect foreign intelligence information on U.S. persons unless stringent tests are met as specified in paragraph 2-4, Chapter (Procedure) 2. e.  Absolutely nothing in Procedure 2 can be interpreted as an authority to collect information relating to a U.S. person solely because of that person's lawful (protected under the Constitution's First Amendment) advocacy of measures opposed to Government policy.

4.  **Chapter 3 (Procedure 3) - Retaining U.S. Person Information.**

a.  Information is defined as *retained* only if it can be retrieved by the person's name or other personal identifying data.

b.  Retention of U.S. person information is authorized under the following criteria:

(1) The Information was properly collected under Procedure 2.


(2) The information was acquired incidentally to an otherwise authorized collection and such information -


(a) Could have been collected under Procedure 2,

(b) Is necessary to understand or assess foreign intelligence or counterintelligence,

(c) Is foreign intelligence or counterintelligence collected from authorized electronic surveillance, or

(d) Is incidental to authorized collection and may indicate involvement in activities that may violate Federal, State, local, or foreign law.

c.  Access to U.S. person information will be restricted to certain individuals on a need-to-know basis.  Intelligence components will review their intelligence files annually. This review will specifically focus on U.S. person information to determine whether continued retention serves the purpose for which it was retained and that continued retention is necessary to an assigned function.

5.  Chapter 4 (Procedure 4) - Dissemination of Information About U.S. Persons.

a.  This chapter governs the types of information regarding U.S. persons that may be disseminated - without the person's consent - outside of the Army intelligence component which collected and retained the information.  This procedure does not apply to information collected solely for administrative purposes or disseminated pursuant to law or proper court authority.

b.  Nonsignals intelligence information about a U.S. person may be disseminated without that person's consent under the following conditions:  (1) The information was collected or retained under the provisions of Procedures 2 and 3; or (2) The recipient is

reasonably believed to have a need for the information to fulfill a lawful assigned governmental function and that recipient is a member of one of the agencies listed in paragraph 4-2 of Chapter (Procedure) 4.


6.  **Chapters (Procedures) 5 through 10** deal with limitations on -- and approval procedures for -- specialized collection techniques.  The specific techniques covered are electronic surveillance, concealed monitoring, physical searches, searches and examination of mail, physical surveillance, and undisclosed participation in organizations.

7.  **Chapter 11 (Procedure 11) - Contracting for Goods and Services.**

a. MI elements can enter into contracts with academic institutions only if an intelligence component informs the appropriate officials of that sponsorship. b. MI elements may contract with commercial organizations, private institutions, or individuals within the U.S. without revealing their intelligence affiliation only if:
(1) The contract is for published material available to the general public or for routine goods and services necessary for the support of approved activities, or
(2) The Secretary or Under Secretary of the Army makes a written determination that sponsorship must be concealed to protect an intelligence activity.

8.  Chapter 12 (Procedure 12) - Assistance to Civilian Law Enforcement Authorities.


a.  Upon approval of the Secretary of Defense, MI components may assist Civilian Law Enforcement Authorities (CLEA) for the following purposes:
(1) Investigating or preventing clandestine intelligence activities by foreign powers, international narcotics activities, or international terrorist activities.


(2) Protecting DoD employees, information, property, facilities, and information systems.

(3) Preventing, detecting, or investigating other violations of law.


b.  MI components may assist civilian and military law enforcement with the following activities:
(1) Disseminating incidentally acquired information believed to indicate a violation of Federal, state, or foreign law.


(2) Providing specialized equipment and facilities to Federal authorities and, when lives are endangered, to state and local authorities in accordance with DoD
Directive 5525.5.


(3) Providing intelligence personnel to Federal authorities and, when lives are endangered, to state and local authorities in accordance with DoD Directive 5525.5 and Army General Counsel concurrence.

(4) Providing assistance to foreign government or foreign law enforcement and security services in accordance with theater policy and applicable Status of Forces Agreements (SOFA).

9.  Chapter 13 (Procedure 13) - Experimentation on Human Subjects for Intelligence Purposes. MI experimentation with human subjects may only be performed with the consent of the subject in accordance with established medical guidelines and with the approval of the Secretary of the Army, Under Secretary of the Army, Secretary of Defense, or Deputy Secretary of Defense as appropriate.

10.  **Chapter 14 (Procedure 14) - Employee Conduct.**

a.  Training.  All personnel conducting, supervising, or providing staff oversight of intelligence activities will be familiar with AR 381-10 with emphasis on Chapters 1 through 4 and 14 through 17.  Those employees involved in the activities described in Chapters 5 through 13 will be familiar with the provisions of those procedures as well.

(1) MI employees must receive tailored training within 30 days of assignment or employment and refresher training as part of the routine command training program.

(2) Commands that have signal intelligence cryptologic elements must obtain appropriate training from qualified personnel on applicable Signal Intelligence directives. b.  Individual Responsibilities.  All employees will -
(1) Conduct intelligence activities in accordance with applicable law and policy, AR 381-10, and the policy of the appropriate intelligence discipline.

(2) Familiarize themselves with this regulation and applicable Signal Intelligence directives.


(3) Report questionable intelligence activities and Federal crimes in accordance with Chapters 15 and 16.

c.  Command Responsibilities.  Commanders will ensure -
(1) Personnel are protected from reprisal and retaliation because they report allegations in Chapters 15 and 16.

(2) Appropriate sanctions are imposed upon any employee who violates the provisions of this regulation and Signal Intelligence directives.

(3) The field IG; the DCS, G-2; TIG; the Army General Counsel; and the Assistant to the Secretary of Defense for Intelligence Oversight (ATSD-IO) have access to information necessary to perform their oversight responsibilities regardless of classification or compartmentation.

(4) Employees cooperate fully with the President's Intelligence Oversight Board.

(5) All proposals for intelligence activities that may be unlawful - in whole or in part - or may be contrary to policy will be referred to the Army General Counsel.

11.  **Chapter 15 (Procedure 15) - Questionable Intelligence Activities.**

a.  Employees and supervisors will report questionable intelligence activities upon discovery through command or inspector general channels to DAIG Intelligence Oversight Division (SAIG-IO) with an information copy to the DCS, G-2 (DAMI-CDC).
These reports will reach these offices within five days from discovery.  Reports may be by e-mail, facsimile, message, or hard copy, and the reports may be classified at any level, to include special-access program caveats as necessary. b.  The reporting command will submit status reports on the questionable activity every 30 days until they complete the investigation.  Status reports are not required when the allegation is referred for a counterintelligence or criminal investigation.


c.  A command may choose to conduct an inquiry of the questionable activity under the provisions of AR 15-6 or through the appropriate IG.  All reports must receive a legal review to confirm or refute the allegation and assess whether the reported activity is consistent with applicable policy.  Other than counterintelligence or criminal investigations, commands will complete the inquiries within 60 days of the initial report and inform SAIG-IO of the inquiry's results. d.  As part of their oversight inspections, IGs will seek to determine if intelligence components are involved in questionable activities and, if so, report such activities under Procedure 15.

##

12.  Chapter 16 - Federal Crimes.



a. Reports of Federal crimes involving MI personnel must be forwarded through command channels to the DCS, G-2 (DAMI-CDC); the Provost Marshal General; and the U.S. Army Criminal Investigations Command.  These reports will reach DCS, G-2, within five days after discovery or receipt at the Army Command (ACOM), Army Service Component Command (ASCC), or Direct Reporting Unit (DRU) level.

b.  Federal crimes that are also questionable intelligence activities will be reported as a Procedure 15 report with an explanation of why the activity meets both criteria.  If the unit initially reported the Federal crime under AR 190-40, the Serious Incident Report
(SIR) date-time group will be provided or a copy attached.

13.  Chapter 17 - Support to Force Protection, Multinational Intelligence Activities, Joint Intelligence Activities, and Other Department of Defense Investigative Organizations.


a.  MI support to force protection is limited to identifying, reporting, analyzing, and disseminating intelligence regarding *foreign* threats in the Army.  Civilian Federal, State, and local law enforcement authorities have the primary responsibility for information collection to protect U.S. military forces within the United States.  The U.S. Army Criminal Investigations Command (USACIDC) special agents serve as the Army's primary liaison representative to U.S. civilian law enforcement authorities (CLEA) for exchanging criminal intelligence, and the Army counterintelligence personnel serve as the primary liaison representative to U.S. CLEA for exchanging foreign threat information.

b.  Within multinational commands, U.S. intelligence personnel may not participate in activities prohibited by law, policy, or regulation.  Also, a U.S. Army commander of a multinational unit may not direct non-U.S. personnel to conduct activities that are prohibited by U.S. law, policy, or regulation.  A U.S. judge advocate with intelligence law experience or training must review multinational intelligence activities for U.S. legal sufficiency.

c.  Army personnel assigned to a joint command must be familiar with the policies of DoD and other military intelligence organizations.  Army MI components will comply with their own service component policies unless otherwise specified in writing by the joint force commander.

d.  Army counterintelligence (CI) may cooperate with DoD investigative organizations (i.e., USACIDC) for CI functions, criminal cases involving classified defense information, or other investigations in which these law enforcement elements have the lead.

## 14.  Ar 381-10 Flow Chart. Appendix B _____________________________________ Army G-2 Memorandum: Collecting Information On U.S. Persons


1. **Purpose.** This appendix provides a precise copy of the Army G-2's (then the Deputy Chief of Staff for Intelligence, or DCSINT) memorandum on Collecting Information on U.S. Persons (dated 5 November 2001).

2. **Specific Text.**  The specific text of the memorandum is as follows: DAMI-CDC (25-30q)


05 Nov 01 MEMORANDUM FOR SEE DISTRIBUTION SUBJECT:  Collecting Information on U.S. Persons 1.  The 11 September 2001 terrorist attack on America presented the United States and the U.S. Army with unprecedented challenges.  Both our nation and our Army are responding vigorously to these challenges and will ultimately be victorious over international terrorism.  Achieving this victory will not be easy, however.  Our adversary is not a clearly defined nation state with fixed borders or a standing army.  It is, instead, a shadowy underworld operating globally with supporters and allies in many countries, including, unfortunately, our own.  Rooting out and eliminating this threat to our freedom and way of life will call upon every resource at our disposal.  I am proud to say that Army Military Intelligence (MI) will play a pivotal role in helping to defeat this threat. 2.  Many of the perpetrators of these attacks lived for some time in the United States.
There is evidence that some of their accomplices and supporters may have been U.S.

persons, as that term is defined in Executive Order (EO) 12333.  This has caused concern in the field regarding MI's collection authority.  With that in mind, I offer the following guidance:
a.  Contrary to popular belief, there is no absolute ban on intelligence components collecting U.S. person information.  That collection, rather, is regulated by EO12333 and implementing policy in DoD 5240.1-R and AR 381-10.

b.  Intelligence components may collect U.S. person information when the component has the mission (or "function") to do so, and the information falls within one of the categories listed in DoD 5240.1-R and AR 381-10.  The two most important categories for present purposes are "foreign intelligence" and "counterintelligence." Both categories allow collection about U.S. persons reasonably believed to be engaged, or about to engage, in international terrorist activities.  Within the United States, those activities must have a significant connection with a foreign power, organization, or person (e.g., a foreign based terrorist group). 3.  EO 12333 provides that "timely and accurate information about the activities, capabilities, plans, and intentions of foreign powers, organizations, and persons, and their agents, is essential to the national security of the United States.  All reasonable and lawful means must be used to ensure that the United States will receive the best intelligence possible."  That said, my staff has received reports from the field of wellintentioned MI personnel declining to receive reports from local law enforcement authorities, solely because the reports contain U.S. person information.  MI may receive information from anyone, anytime.  If the information is U.S. person information, MI may retain that information if it meets the two-part test discussed in paragraph 2b, above.  If the information received pertains solely to the functions of other DoD components, or agencies outside DoD, MI may transmit or deliver it to the appropriate recipients, per Procedure 4, AR 381-10.  Remember, merely receiving information does not constitute "collection" under AR 381-10; collection entails receiving "for use."  Army intelligence may always receive information, if only to determine its intelligence value and whether it can be collected, retained, or disseminated in accordance with governing policy. 4.  Military Intelligence must collect all available information regarding international terrorists who threaten the United States and its interest, including those responsible for planning, authorizing, committing, or aiding the terrorist attacks of 11 September 2001. We will do so - as EO 12333 directs -  "in a vigorous, innovative and responsible manner that is consistent with the Constitution and applicable law, and respectful of the principals upon which the United States was founded."

5. Key ODCSINT numbers for intelligence oversight questions are (703) 601-1958 / 1551, or through the 24-hour Intelligence Watch at (703) 697-5484 / 5485.



ROBERT W. NOONAN, JR.



Lieutenant General, GS


Deputy Chief of Staff

  For Intelligence DISTRIBUTION: DAMI MACOMs USAICFH

CF: ATSD(IO), SAIG-IO SAGC, DAJA-IO

# Appendix C _____________________________________ Sample Intelligence Oversight Inspection Directive

DEPARTMENT OF THE ARMY
HEADQUARTERS, 66th INFANTRY DIVISION
FORT VON STEUBEN, VIRGINIA  12345 AFVS



14 April ____
MEMORANDUM FOR THE INSPECTOR GENERAL SUBJECT:   Directive for Inspection (Intelligence Oversight Program) 1.   You are directed to evaluate the compliance of the 66th Infantry Division's Intelligence Oversight Program with an emphasis on integration of Intelligence Oversight in daily operations. 2.  The assessment will focus on the following objectives:
a.  Determine if military intelligence components within the Division are complying with the provisions of AR 381-10.

b.  Determine if military intelligence (MI) components are effectively training all assigned, attached, and contracted MI personnel on intelligence oversight.

c.  Determine if intelligence oversight is integrated into the unit's Organizational Inspection Programs (OIP).


d.  Determine if questionable activities or Federal crimes committed by intelligence personnel are reported and resolved in accordance to AR 381-10. 3.  You are authorized to task the Division staff and subordinate headquarters for those resources required to ensure the successful accomplishment of this assessment. 4.  Within the limits of your security clearances, you are authorized unlimited access to Division activities, organizations, and all information sources necessary to perform your oversight duties, regardless of compartmentation. 5.  You will provide me with a mid-course progress review at the end of July followed by a written report not later than 1 September.

6.  Upon discovery, you will notify me of any questionable activity or Federal crimes found during the inspection.

MOTTIN De La BLAME

Major General, USA

Commanding

# Appendix D _____________________________________ Sample Intelligence Oversight Detailed Inspection Plan



DEPARTMENT OF THE ARMY
HEADQUARTERS, 66TH INFANTRY DIVISION
FORT VON STEUBEN, VIRGINIA 12345
AFVS-IG
2 May ____ MEMORANDUM FOR SEE DISTRIBUTION SUBJECT:  Detailed Inspection Plan for the Intelligence Oversight Inspections 1.  DIRECTIVE:  On 14 April ____, the Commanding General (CG) directed the Inspector General to conduct General Inspections of the Intelligence Oversight Programs within the 66th Infantry Division.  Unlike most Inspector General (IG) inspection reports, the IG will not redact unit names from the final written report to the CG because this inspection will be a general inspection to determine if intelligence components are in compliance with Intelligence Oversight policies.  However, the IG will not release the final written report to anyone beyond the CG unless directed by The Inspector General of the Army. 2.  INSPECTION PURPOSE:  The purpose of these inspections is to evaluate the compliance of the 66th Infantry Division's Intelligence Oversight Programs with an emphasis on integration of Intelligence Oversight in daily operations. 3.  OBJECTIVES:  The objectives for these inspections are as follows:
a.  Determine if military intelligence components within the Division are complying with the provisions of AR 381-10.

b.  Determine if military intelligence (MI) components are effectively training all assigned, attached, and contracted MI personnel on intelligence oversight.

c.  Determine if intelligence oversight is integrated into the unit's Organizational Inspection Programs (OIP).

d.  Determine if questionable activities or Federal crimes committed by intelligence personnel are reported and resolved in accordance to AR 381-10.


 4.  TASK ORGANIZATION:  An inspection team from the Inspections Branch of the
66th Infantry Division Inspector General Office will conduct the inspections by inspecting five active-duty divisional units.  The composition of the team and each person's security clearance is as follows:
MAJ List (Team Leader) - Top Secret


CPT Numero (Deputy Team Leader) Top Secret

MSG Smith (Team NCOIC) - Top Secret

SFC Bergerac - Secret

CW3 Cloak (MI augmentee) - Top Secret

MSG Dagger (MI augmentee) - Top Secret


5.  INSPECTED UNITS:  The inspection will involve the following units and staff agencies on the dates indicated:
20 July:  Company B (MI), 2nd STB


22 July:  Company B (MI), 3rd STB

26 July:  Company B (MI), 1st STB

30 July:  Division G-2 and ACE

1 August:  Company B (MI), 4th STB
 6.  INSPECTION APPROACH:  The inspection team will spend one day inspecting each unit.  The respective unit will draft an itinerary for the Inspection Team based upon guidance outlined in paragraph nine of this document.  The basic inspection approach at each location will be to in-brief the unit leaders and staff members; receive a briefing from the inspected unit on Intelligence Oversight compliance efforts; review relevant documents related to Intelligence Oversight; survey Commanders, Intelligence Oversight Staff Officer or Points of Contact (POC), junior officers, NCOs, and Soldiers through interviews and sensing sessions; and physically check paper and electronic intelligence files for U.S. person information.

a.  Personnel to Interview (see paragraph seven below for specific requirements):


- Company Commander / XO / 1SG / Intelligence Oversight Staff Officer or
POC
- Junior Officers / Warrant Officers - NCOs (E-5 to E-7) - Soldiers


b.  Documents to Review:

- Division, Brigade, Battalion, Company Intelligence Oversight Program
documents
- Results of any command or staff inspections of Intelligence Oversight
- Results of annual review of intelligence files and databases - Intelligence files (paper and electronic) - Records of intelligence oversight training
- Records of any previous Procedure 15 reports and investigations

7.  INTERVIEW REQUIREMENTS:
a.  The following table outlines the specific interview and sensing-session requirements for a standard MI company:

| NCOs          | Soldiers    | Junior    |
|---------------|-------------|-----------|
| Officers      |             |           |
| Commander 1SG | XO          | IO Staff  |
| Officer /     |             |           |
| POC           |             |           |
| 1             | 1           | 1         |
| Individual    |             |           |
| Interviews    |             |           |
|               |             |           |
| Sensing       |             |           |
| Session:      |             |           |
| Junior        |             |           |
| Officers /    |             |           |
| Warrant       |             |           |
| Officers      |             |           |
|               |             |           |
| Sensing       |             |           |
| Session:      |             |           |
| NCOs          |             |           |
|               |             |           |
| Sensing       |             |           |
| Session       |             |           |
| Soldiers      |             |           |
| 1             | 1           | 1         |
| Contacted     |             |           |



b.  Classroom and Interview Location Requirements.  Each sensing session will require a classroom or similar facility that is removed from the unit's normal work location.  The area must be relatively quiet and free from interruptions and telephone calls.  In addition, the room will need no fewer than eight chairs or desks formed in a circle or "U" shape.  The unit should schedule 90-minute blocks for each sensing session.  Individual interviews can occur in the interviewee's office or in a similar location that is free from interruptions and telephone calls.  The unit should schedule these interviews to last no more than one hour.

8.  SPECIAL AREA OF INTEREST.  The Inspection Team will not address a Special- Interest Item (SII) during this inspection. 9.  INSPECTION ITINERARIES: The Inspection Team requests a draft itinerary that meets the requirements listed in paragraphs six and seven no less than 10 days before

the day of the scheduled inspection.  These itineraries should go directly to the Team Leader (see paragraph four).  The Team Leader will work with each unit to determine which itinerary best allows the Inspection Team to meet the objectives listed in paragraph three.  The intent of each inspection team is to conduct this assessment with minimal disruption to ongoing training.  The team requires no special calendar arrangements except for the scheduling of group sensing sessions, interviews, and inand out-briefings.  A sample itinerary for a one-day unit inspection is as follows:

|           | 0800-0815                                                 | In-Brief Commander and Unit Leaders                                |
|-----------|-----------------------------------------------------------|--------------------------------------------------------------------|
|           | 0815-0900                                                 | Inspected Unit Brief                                               |
|           | 0900-1000                                                 | Interview Commander                                                |
| 0900-1030 | Sensing Session with Junior Officers and Warrant Officers |                                                                    |
| 0900-1200 | Review Documents                                          |                                                                    |
| 1000-1100 | Interview First Sergeant                                  |                                                                    |
| 1030-1200 | Sensing Session with NCOs                                 |                                                                    |
| 1100-1200 | Interview Executive Officer                               |                                                                    |
|           | 1300-1400                                                 | Interview Intelligence Oversight Staff Officer or Point of Contact |
| 1300-1430 | Sensing Session with Soldiers                             |                                                                    |
| 1300-1530 | Review Intelligence Files                                 |                                                                    |
|           | 1530-1630                                                 | Inspection Team In-Process Review (IPR)                            |
|           | 1645-1715                                                 | Out-Brief Commander and Unit Leaders                               |

 10. PRE-INSPECTION DOCUMENT REQUEST: The Inspection Team requests that each unit send the following documents -- as they apply -- to the inspection Team Leader:

- Division, Brigade, Battalion, and Company Intelligence Oversight Program
documents
- Results of any command or staff inspections of Intelligence Oversight - Results of annual review of intelligence files and databases - Records of any previous Procedure 15 reports and investigations
 The intent of this document request is to view only those documents that relate to Intelligence Oversight.  Avoid sending documentation that does not apply to Intelligence Oversight.  These documents are due to the Inspection Team Leader not later than 10 days before the scheduled inspection.  Electronic versions of these documents sent via email are acceptable.  Contact the Team Leader if any of the pre-inspection documents requested by the IG contain classified or compartmented information. 11.  RESOURCES: The Inspection Team will travel to each unit using a locally procured TMP van.  The team members do not require any additional transportation.  The unit will provide other special equipment to the team members as required. 12.  ADMINISTRATIVE SUPPORT REQUIREMENTS: The Inspection Team will require the following administrative support assistance from each unit:


a. Desk space for three or more people

b. Access to a computer

c. Printer and copying support
 13.  REPORT COMPLETION TIMELINE: The results of each intelligence component's inspection will be contained in a written report provided to the Division Commander.
The schedule to complete the report is as follows:

a. Out-brief the Commanding General: 14 August ____


b. Complete report: 1 September ____
 14.  SUSPENSE SUMMARY: A summary of the suspenses contained in this document is as follows:
a. Draft itineraries due to the Inspection Team no less than **10 days** before the date of the scheduled inspection.

b. Requested documents due to the Inspection Team no less than **10 days** before the day of the scheduled inspection. 15.  POC for this inspection is MAJ List, (703) 123-5678 or DSN: 555-5678, frank.list@ignet.army.mil. Encl WALLY L. RIGHTWAY
Inspection Directive LTC, IG

Inspector General DISTRIBUTION: G-2 Commander, 1st BCT Commander, 2nd BCT Commander, 3rd BCT Commander, 4th BCT Commander, 1st STB Commander, 2nd STB Commander, 3rd STB Commander, 4th STB CF: SJA

## Appendix E _____________________________________ Sample Intelligence Oversight Unit In-Brief Presentation Intelligence Oversight Inspection General Inspection Of The Intelligence Oversight Program Inspection In-Briefing Company B (Mi) 1St Special Troops Battalion (Stb) 20 July _____

66th Infantry Division Inspector General - INSPECTIONS BRANCH

## Intelligence Oversight Inspection Inspection Purpose

The purpose of these inspections is to evaluate the compliance of the
66th Infantry Division's Intelligence Oversight Programs with an emphasis on integration of Intelligence Oversight in daily operations.

66th Infantry Division Inspector General - INSPECTIONS BRANCH


## Intelligence Oversight Inspection Inspection Objectives

1. Determine if military intelligence components within the
Division are complying with the provisions of AR 381-10.
2. Determine if military intelligence (MI) components are
effectively training all assigned, attached, and contracted MI personnel on intelligence oversight.
3. Determine if intelligence oversight is integrated into the
unit's Organizational Inspection Programs (OIP).
4. Determine if questionable activities or Federal crimes
committed by intelligence personnel are reported and resolved in accordance to AR 381-10.

## Intelligence Oversight Inspection Ig Ground Rules

- Always on the record - Can look into any violation of law or regulation - Available for IG assistance - Here to help; our goal is to --
- Be value added
- Identify issues affecting mission / operations - Identify systemic issues

## Intelligence Oversight Inspection Ig Reporting

- Unlike most Inspector General (IG) inspection
reports, we will attribute our findings to specific units in the final written report to the Commanding General.
- We will not release the final written report to
anyone beyond the CG unless directed by The Inspector General of the Army.
- We will report the discovery of questionable
activities or Federal crimes in accordance with
AR 381-10.

## Intelligence Oversight Inspection Ig Task Organization

- MAJ List (Team Leader) - Top Secret - CPT Numero (Deputy Team Leader) Top Secret - MSG Smith (Team NCOIC) - Top Secret - SFC Bergerac - Secret
- CW3 Cloak (MI augmentee) - Top Secret
- MSG Dagger (MI augmentee) - Top Secret

## Intelligence Oversight Inspection Inspection Methodology

The basic approach for today's inspection will be to

 Receive a briefing from the inspected unit on Intelligence
Oversight compliance efforts
 Review relevant documents related to Intelligence Oversight  Survey Commanders, Intelligence Oversight Staff Officers
or Points of Contact (POC), junior officers, NCOs, and Soldiers through interviews and sensing sessions
 Physically check paper and electronic intelligence files for
U.S. person information

## Intelligence Oversight Inspection Personnel To Interview

Individual Interviews (POC is MAJ List):
- Company Commander - First Sergeant - Executive Officer - Intelligence Oversight Staff Officer or POC
Sensing Sessions (POC is MSG Smith):
- Junior Officers / Warrant Officers - NCOs (E-5 to E-7) - Soldiers

## Intelligence Oversight Inspection Documents To Review (Poc Is Cw3 Cloak And Msg Dagger)

- Division, Brigade, Battalion, and Company Intelligence
Oversight Program documents
- Results of any command or staff inspections of
Intelligence Oversight
- Results of annual review of intelligence files and
databases
- Records of intelligence oversight training
- Records of any previous Procedure 15 reports and
investigations
- Intelligence files (paper and electronic)

## 66Th Infantry Division Inspector General - Inspections Branch Intelligence Oversight Inspection Inspection Itinerary

0800-0815   In-Brief Commander and Unit Leaders 0815-0900   Inspected Unit Brief 0900-1000   Interview Commander 0900-1030   Sensing Session with Junior Officers and Warrant Officers 0900-1200   Review Documents 1000-1100   Interview First Sergeant 1030-1200   Sensing Session with NCOs 1100-1200   Interview Executive Officer
1300-1400   Interview Intelligence Oversight Staff Officer or Point of Contact 1300-1430   Sensing Session with Soldiers 1300-1530   Review Intelligence Files 1530-1630   Inspection Team In-Process Review (IPR) 1645-1715   Out-Brief Commander and Unit Leaders
66th Infantry Division Inspector General - INSPECTIONS BRANCH

## Intelligence Oversight Inspection Questions? Intelligence Oversight Points Of Contact

- IG, LTC Rightway, (703) 123-5677 or DSN: 555-5677,
wally.rightway@ignet.army.mil
- IG Inspections Chief, MAJ List, (703) 123-5678 or
DSN: 555-5678, frank.list@ignet.army.mil
- IG Inspections NCOIC, MSG Smith, (703) 123-5678 or
DSN: 555-5678, john.smith@ignet.army.mil
- Staff Judge Advocate, COL Beagle, (703) 123-3401 or
DSN: 555-3401

## Intelligence Oversight Inspection Back-Up Slides Intelligence Oversight Inspection Intelligence Oversight Intelligence Oversight

(AR 381
(AR 381--10)
10)
- Implements Executive Order (EO 12333) - Provides procedures on:
- Collection, dissemination, or retention of
information on U.S. persons by intelligence components.
- Use of intrusive collection techniques
(surveillance, bugging, phone taps).
- Assistance by intelligence components to law
enforcement.
- Employee Misconduct.  Reporting violations,
investigating, and taking corrective action.

## Intelligence Oversight Inspection Command Intelligence Oversight Command Intelligence Oversight Requirements Requirements

In accordance with AR 20-1 and AR 381-10:

- Identify, investigate, and report questionable activities
- Provide oversight of intelligence activities - Determine if non-intelligence components are being
used for foreign or counterintelligence purposes
- Ensure procedures exist for reporting questionable
intelligence activities

## Intelligence Oversight Inspection Purpose Of Purpose Of Intelligence Oversight Intelligence Oversight


Enables military intelligence components to carry out their functions in a manner that protects the constitutional rights of U.S. persons.

Regulates particular collection
techniques to obtain information for foreign intelligence or counterintelligence purposes.

## Intelligence Oversight Inspection Intelligence Oversight Intelligence Oversight Applies To Applies To... ...

- Named Military Intelligence components - Any organization, staff, or office used for military
intelligence purposes
- Both active and reserve components
- Members of the Army National Guard when
performing Federal duties or engaging in activities directly related to a Federal duty or mission
- Contractors performing intelligence activities

## Intelligence Oversight Inspection Why Intelligence Oversight? Why Intelligence Oversight? 1960 & 1970S

Vietnam-era abuses:
- Infiltration of college campuses - Involvement in domestic political issues
IO Mission
IO Mission
- Surveillance of anti-war protestors
The establishment of Intelligence Oversight has allowed military intelligence components to focus on their mission of collecting information related to foreign intelligence and counterintelligence purposes.

The establishment of Intelligence Oversight has allowed military intelligence components to focus on their mission of collecting information related to foreign intelligence and counterintelligence purposes.

## Intelligence Oversight Inspection Relevance In The 21St Century Relevance In The 21St Century Intelligence Oversight Inspection Intelligence Oversight Triangle Intelligence Oversight Triangle

A system of checks and balances to mitigate risk

## Intelligence Oversight Inspection General Inspection Of The Intelligence Oversight Program Inspection In-Briefing Company B (Mi) 1St Special Troops Battalion (Stb) 20 July _____ Appendix F _____________________________________ Intelligence Oversight Training Scenario And Practical Exercises


1. **Purpose.** This appendix provides Inspectors General with a notional scenario and a variety of practical-exercise situations that they can use when conducting Intelligence Oversight inspections.

2.  **Scenario Background.**  You are a Military Intelligence (MI) officer / noncommissioned officer assigned to the 21st Infantry Division (Airborne), Fort Fremont, California.  The division has a contingency mission to deploy to the island republic of Cortina to restore democracy in the event the current regime is overthrown.  You are assigned to the 121st Military Intelligence (MI) Battalion as the OIC / NCOIC of the division Analysis Control Element (ACE).  The ACE provides analytical support to the division G-2.  Recently, you attended the weekly staff meeting in the G-2 office.  LTC
Alsorse, the division G-2, briefed the importance of force protection to the Division Commander -- especially in view of the recent bombing of the Federal Building in Sacramento.  You briefed the current situation in Cortina and provided your assessment that an economic downturn, coupled with increased activity by the anti-U.S. Cortinian Liberation Army (CLA) in the mountainous interior of the island, increases the likelihood that the division may be deployed.  Because of the tense situation caused by the bombing in Sacramento, getting the staff members' attention proved difficult --
especially in view of the Division Commander's guidance:  "Get a handle on this, people.  I don't want any bombings to happen here."
3. **Situation 1:**  Upon returning to your office, you find a note from the G-2.  He directs you to use all appropriate resources to obtain information on threats to the force.  The G-2 wants to ensure that he is ahead of the power curve in the event that the Division Commander questions him.  You call the ACE personnel together for a brainstorming session to determine the actions you can take to comply with the Division Commander's guidance.  All agree that the first and most basic step to take is to search available online resources, both classified and unclassified, for threat information.  SP4 Candu (MOS 96B), who is a whiz on the Worldwide Web, says that he will research unclassified sources.  SSG Cipernette (MOS 97B) handles the searches on the classified systems.  Later that afternoon, they return to you with the results of their searches:
- Cortinian dissidents are believed to have recruited a number of agents in the vicinity of Fort Fremont and the port at Oakland.  Their mission is to provide early warning to the Cortinian Liberation Front in the event the division is mobilized.

- The Bear State Militia, a right-wing extremist group located in the rural north, has proclaimed the 21st Infantry Division to be an occupation force and has vowed to expel it from the State -- by force if necessary.



- SP4 Candu reports that he has also developed a list of IP addresses, email addresses, and URLs relating to Cortinian Support Groups.  He wants permission to do more collection.

How do you handle this information?  What Procedure(s) of AR 381-10 applies? What do they say?  Are there any other offices / staffs / agencies that need to be involved?  (Note:  You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.) IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight Web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________ Date / time / location: _________________________________ HQDA, Army G-2 solution: Add the Cortinian information to your OB database.  This information is legitimate intelligence data on a foreign intelligence capability.  Procedure 1 applies because it's your mission.  Pass the Bear State data to the Provost Marshal and USACIDC either verbally or in writing.  If you write it, you can retain a copy in your administrative files (Military Correspondence Files).  Do not add the information to intelligence databases.  Make everyone involved read AR 525-13 so that they understand that U.S. domestic terrorism is not a Military Intelligence (MI) responsibility.
You cannot retain this information EVEN IF IT'S OPEN-SOURCE MATERIAL!!  The G-2 is not "database central" for all threats to the division.

The request to retain / collect on Internet addresses:  All three categories (IP addresses, email addresses, and URLs) fall into the AR 381-10 framework.  An IP address, without further information, does not identify or consist of information about a U.S. person.  If further analysis on a specific IP is conducted, a reasonable and diligent inquiry must be conducted to determine if a U.S. person association exists.  Email addresses are usually associated with an individual.  Normally, the name will not provide sufficient information to identify the individual as a U.S. person.  Sometimes, though, the name to the left of the "@" will provide persuasive evidence that the email address is associated with a U.S. person. The person may be a well-known public figure or the service provider may be closely affiliated with the U.S.  Therefore, any email account should be presumed to be associated with a U.S. person.  Once analysis begins, the component must make an effort to determine whether the addresses are associated with U.S. persons.  URLs specify the location of an object on the Internet, typically a Web page. The key factor to consider in determining whether a URL identifies a U.S person is the information to the right of the domain (the dot).  Components may maintain URL addresses as long as the collection is within the scope of an authorized intelligence / counterintelligence activity.  They may also open the Web sites associated with the URLs if part of an authorized mission.  If the component wants to collect the information beyond what is available on the site, the component must determine whether the person about whom they are collecting is a U.S. person and, if so, comply with AR 381-10.

DAIG comment:  No questionable activity if the Bear State Militia information is not used for intelligence purposes.
4. **Situation 2:** In response to command emphasis on Force Protection, you visit the local resident office of the supporting strategic counterintelligence (CI) group.  This group, which has its headquarters at Fort Meade, has worldwide strategic CI responsibility for the Army.  They advise you that they meet regularly with local authorities, to include the local office of the FBI, to exchange CI threat information. They appreciate the information you provide on CLF intelligence activity and assure you that they are on top of the situation.  They also inform you that during a recent visit to the California Highway Patrol, they learned that some members of the Bear State Militia have come to believe that United Nations (U.N.) troops are using the Fort Fremont training area.  These members believe that this alleged U.N. training situation is part of a larger conspiracy to put the U.S. under foreign control.  They vow to march on Fort Fremont, locate the U.N. soldiers, and arrest and try them in the name of the Bear State.  Six persons comprise the group, and they are armed.

How do you handle this information?  What Procedure(s) of AR 381-10 applies? What do they say?  Are there any other agencies / staffs / offices that need to be involved?  (Note:  You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.)
IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight Web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD
Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________ Date / time / location: _________________________________ HQDA, Army G-2 Solution:  Ask the CI folks if USACIDC and the division Provost Marshal have the information.  If not, or if the CI folks don't know, decide which of you will tell them.  But make sure you tell them! Advise your G-2 of what you did and why (keep him or her informed and educated). Do not add the information to intelligence databases or threat assessments. DAIG comment:  If the Provost Marshal notifies your MI unit that this group poses a threat to unit personnel, the unit may retain the information in Force Protection or physical security files but not in intelligence mission files.  For example, you may not include this information in order-of-battle files.  Situations 3 and 4 make similar points.

4. **Situation 3:**  Following your visit to the supporting CI resident office, you return to find a note from LTC Alsorse, the division G-2.  He has heard that the local Federal Bureau of Investigation (FBI) office is working to determine possible links between the Bear State Militia, other domestic terrorist groups, foreign agents, and individuals involved in  area criminal activities.   LTC Alsorse has received a request for support from the Special Agent in Charge (SAC) of the local FBI office for intelligence personnel with the skills to do this kind of predictive analysis work.  LTC Alsorse wants to support them and is sure the Division Commander will agree since the information may help protect soldiers on Fort Fremont.  He wants you to coordinate with the SAC and send over two soldiers right away -- "the sooner they start, the better."
How do you handle this information?  What Procedure(s) of AR 381-10 applies?
What do they say?  Are there any other agencies / staffs / offices that need to be involved?  (Note:  You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.)
IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________ Date / time / location: _________________________________ Solution:  Inform the G-2 that Procedure 12 requires that assistance provided by DoD intelligence component personnel to Federal law enforcement authorities must be coordinated with the service Office of the General Counsel for approval by OSD.  Notify the local CI resident office and the Provost Marshal.  If the local CI or PM office also received a request from the SAC, determine who might be the best element to provide the support, and ensure that that element gets the appropriate approval from HQDA and / or DoD.

5. **Situation 4:** During the weekly battalion staff meeting, you learn that some soldiers in another unit -- and in a different state -- confronted and killed a civilian couple who were walking in the vicinity of the installation.  A subsequent investigation revealed that these soldiers were members of a white supremacist group, and their motivation was racial.  The investigation also established that the soldiers had displayed distinctive tattoos and jewelry associated with their group prior to the killing.  You learn that the Division Commander has reiterated his policy that he will not tolerate hate groups in his division.  Later that day, the battalion CSM visits your section.  He tells you that the Division Commander is charging all leaders on post, down to squad leaders and section chiefs, to identify soldiers who display logos and insignia associated with hate groups.  You must report any such soldiers in your section to the appropriate Company Commander.  To assist you in this requirement, the CSM gives you a pamphlet containing pictures of logos and insignia associated with hate groups along with a short summary of the group.  The following is a typical entry:
The Bear State Militia:  A right-wing extremist group dedicated to the "liberation"
of California from Federal control.  This group is loosely associated with a number of hate groups in California, to include white supremacist groups.  The group is against everyone who is not of Northern European heritage and is particularly opposed to the use of any language but English outside the home.  Members have been known to vandalize foreign-language signs and intimidate foreign-language speakers in public places.  Their logo is a bear. How do you handle this information?  What Procedure(s) of AR 381-10 applies?  What do they say?  Are there any other staffs / offices that need to be involved?  (Note:  You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.)

IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight Web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________ Date / time / location: _________________________________ HQDA, Army G-2 Solution:  AR 381-10 does NOT apply.  This activity is a normal command function governed by the 600-series regulations.  MI units must comply with these regulations just like any other Army unit. Do it and report back through your chain of command. Do not file or use the information as intelligence.  Instead, file the information in command administrative files (if you wrote the information down).

6. **Situation 5:** You receive through normal distribution a copy of the most recent Counterintelligence Appendix to the Intelligence Annex to the Division OPLAN.  The appendix was prepared by CPT Bond, the CI Officer, and distributed directly from his office.  You note that the format of the appendix has changed somewhat from the previous version.  Now, under "Opposing Forces," there is a sub-section entitled "Local Threats."  One of the paragraphs in this sub-section is the following:
- The Bear State Militia, a right-wing extremist group located in the rural north, has proclaimed that it considers the 21st ID to be an occupation force and has vowed to expel it from the State, using force if necessary.  It also believes that the division is part of a larger conspiracy to put the U.S. under foreign, i.e., U.N., control.  This group could interfere with road movements by the division if it believes the division is deploying to participate in U.N. operations.

How do you handle this information?  What Procedure(s) of AR 381-10 applies?  What do they say?  Are there any other offices /staffs / agencies that need to be involved?  (Note:  You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.)
IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight Web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________ Date / time / location: _________________________________
HQDA, Army G-2 solution:  Notify CPT Bond and the unit Intelligence Oversight officer that the appendix appears to be in violation of AR 381-10, Procedure 1 (not your mission) because it's in violation of AR 525-13, paragraphs 2-17, 2-24, and 4-6 among others. Report as questionable activity.  Procedure 15 applies. Notify the Provost Marshal so that he can include the information where appropriate in a non-intelligence annex.

7. **Situation 6:** As part of his planning guidance, the Division Commander informs his staff that he views the immediate disarming of the CLA as essential to the success of the division's mission to restore stability and democracy to Cortina.  He wants as much information as possible on the CLA prior to deployment, to include full identification of the leadership, their names, backgrounds, attitudes toward U.S. forces, and current whereabouts.  The G-2 translates the commander's information needs into priority intelligence requirements (PIR) for the ACE.  As part of your intelligence preparation of the Cortinian battlefield, you begin to search all available resources for information on the CLA leadership.  You quickly learn that several high-ranking members of the CLA are U.S. citizens or green-card holders who recently returned to Cortina to take up arms against the legitimate government.  You also learn that one high-ranking member of the CLA, Yosep Calle, previously lived in the San Francisco area and is suspected of involvement in narcotics trafficking and money laundering. How do you handle this information?  What Procedure(s) of AR 381-10 applies?  What do they say?  Are there any other offices / staffs / agencies that need to be involved?  (Note:  You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.)
IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight Web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________ Date / time / location: _________________________________
Solution:  Refer to Procedure 2, AR 381-10.  If you need the U.S. person information to accomplish your Cortinian mission, then you can collect it. Get a sanity check from your division Operational Law Attorney.  Make sure the G-2 understands and agrees with your logic.  Keep the division Provost Marshal informed on all criminal information; he is also a consumer of foreign intelligence.  The U.S. persons who are in Cortina taking up arms are not legitimately of foreign intelligence interest.

8. **The Situation Continues:** The situation in Cortina continues to deteriorate.  The government collapses.  Two warring factions dominate the island.   These factions are
(1) the **Mainlanders** (descendents of immigrants from the mainland who controlled the now defunct government and dominate the economic and cultural life of the island and
(2) the **Indiginees**, who are culturally and linguistically distinct from the Mainlanders.
Many of the Indigenees see themselves as the rightful rulers of the island and resent the favored position of the Mainlanders.  Others Indiginees are more favorably disposed to the Mainlanders and only want a voice in an ordered and democratic society.  The situation is becoming increasingly polarized and the atrocities, in which both sides engage, are making reconciliation more difficult.  Your division now deploys into this environment with the mission of keeping the warring factions apart while more moderate elements attempt to build a popular government and a stable society.


The G-2 expects the ACE to give the commander and staff a full picture of the attitudes and activities of both factions, to include what threat, if any, they may pose to the division, its mission, and its personnel.  The MI battalion deploys IMINT, SIGINT, and HUMINT to meet these information needs; all sources begin providing valuable intelligence.  The G-2 also expects the battalion CI assets to identify any attempt by the factions to collect on -- or infiltrate -- the division.

Because the division has very few members who can speak either of the two major Cortinian languages, the Army G-2 creates a local-hire program to provide interpreters and translators to the division.  The CI team, with assistance from the Provost Marshal, G-1, and the supporting U.S. contractor, is tasked to pre-screen all applicants and weed out those individuals who may not be suitable for employment or might somehow pose a threat to the force.  The CI team also sees this pre-screening activity as an opportunity to identify individual Cortinians who might assist in monitoring their colleagues; these Cortinians could identify and report attitudes or activities that might be inconsistent with employment by the division.  Additionally, the CI team is tasked to report any positive intelligence incidentally obtained in accordance with the division collection plan.  (HQDA, Army G-2 Note:  All linguist acquisition falls under the purview of Army G-2 and is not a local matter.  The Army is the DoD Executive Agent for managing DoD-wide linguist acquisition.  Except for a very few Dari and Pashto linguists being recruited directly into the Individual Ready Reserve, a U.S. corporation under Army contract hires and manages all contract linguists.)
9. **Situation 7:** The division has now been in Cortina for four weeks and is set up in what had previously been a Cortinian Army compound. You are still the ACE Chief. Your analyst, SSG Cipernette, advises you that she has just received a spot report from the CI team.  The report states that a local-hire employee reported that members of the Indiginee Liberation Army (ILA) and / or the Mainlander Defense Force (MDF) are contacting her and several of her co-workers in their homes and routinely debriefing them on the activities of U.S. Forces.  You immediately contact CPT Bond, the division CI officer and acting G-2.  He contacts the CI team and advises them of their responsibilities under AR 381-12, Subversion and Espionage Directed Against the U.S. Army (SAEDA), to report this information through sub-control-office channels to the Army Central Control Office.  He also reminds you of the requirement in paragraph 3- 4.b (3), AR 381-12, to take no further action or make further dissemination unless directed or approved by a control office.  After several days, you receive a response through control-office channels:  "The Control Office declines to open a case.  Subject not under U.S. Army investigative jurisdiction. No further investigative activity authorized."
What do you do now?  What options, if any, are open to you?  How do you handle this information?  What Procedure(s) of AR 381-10 applies?  What do they say? Are there any other offices / staffs / agencies that need to be involved?  (Note: You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.)
IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight Web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________
Date / time / location: _________________________________

Solution:  The key to this situation is correctly identifying the subjects, which, in this case, are the members of the ILA and MDF.  You do not need investigative authorities to debrief your own employees or to collect on foreign activities in this situation.  You should ensure that the division collection plan includes these requirements; that plan is your source of authority (see Chapter 6 of AR 381-20). If you suspect the local-hire employees of cooperating clandestinely with a local faction, the determination of whether to investigate them under the provisions of Chapter 4, AR 381-20, or collect on them under the provisions of Chapter 6, AR
381-20 (and / or division collection requirements), will depend upon the situation and should be made in consultation with supporting INSCOM elements in country
(if any) and your Operational Law Attorney.

10. **Situation 8:** The G-2 is very pleased with the quality of information that his "INTs"
are providing.  The HUMINT teams are particularly productive, having built good relationships with key personnel in both factions.  Each faction is eager to provide intelligence on the activities of the other -- particularly any intelligence that puts the other faction in a bad light.  As time goes on, you notice that individual HUMINT team members are arguing among themselves over which faction really is "guilty."  They seem to have a psychological need to identify "good guys" and "bad guys." This need seems strange to you because none of them has any pre-existing ties to Cortina or any of its factions.  The attitudes of team members are entirely a result of relationships developed and information gathered since arrival on the island.  This situation, while initially amusing, becomes serious when you learn that one of the HUMINT team members, SGT Arnold, MOS 97E, has passed -- on his own volition -- information to the MDF that one of the other team members obtained from the ILA.  He made no secret of his intention to pass this information, stating to everyone within earshot that he was fed up with ILA terrorist activities.  The information involved the leadership and organizational structure of the ILA and included the location of base camps, which the Indiginees provided to U.S. Forces with the understanding that the locations would not be disseminated outside of U.S. channels.  The information was not otherwise classified.  You notify the G-2, the division CI officer, and the MI Battalion Commander.
The CI officer directs the CI team to submit a SAEDA report.

What options are open to the division, the Battalion Commander, and the G-2? What role should the division CI team play?  What Procedure(s) of AR 381-10 apply?  What do they say?  Are there any other offices / staffs / agencies that need to be involved?  (Note:  You may use any references available to you and consult with other unit personnel as you formulate a response.  You must brief the IG on your solution prior to the completion of the inspection.  You may bring any resources you desire to the briefing.  You will have 10 minutes to brief your solution.)

IG Suggestion:  Check out the HQDA Army G-2 Intelligence Oversight Web page at http://www.dami.army.pentagon.mil/offices/dami-ch/io/io_home.html and the DoD
Intelligence Oversight Web page at http://www.dod.mil/atsdio/. Briefer: ____________________________________________

Date / time / location: _________________________________

Solution:  This situation illustrates a case that would appear to have no connection to Intelligence Oversight.  In addition to the SAEDA report, the command could have also conducted a security investigation if classified information had been involved.  The connection to Intelligence Oversight is the HUMINT team member's questionable activity during the conduct of intelligence activity under the provisions of Procedure 14, AR 381-10, and should be reported in accordance with Procedure 15, AR 381-10.  As a command versus an AR 381-10 issue, the team member's continued viability as a field HUMINTer demands further evaluation.

FOR TRAINING PURPOSES ONLY. ALL SCENARIOS AND PERSONS ARE FICTITIOUS.

## Appendix G _____________________________________ Procedure 15 Reporting Format


1.  **Purpose.**  This appendix provides a format for reporting questionable activity through Procedure 15 up to DAIG Intelligence Oversight Division (SAIG-IO).

2.  **Questionable Activity.**  A questionable activity is the violation of any law or regulation by personnel engaged in Military Intelligence activities and not simply violations of AR 381-10 (see Chapter 1).  Any soldier actively engaged in a Military Intelligence activity and who violates an Army regulation while in the conduct of that activity constitutes a questionable activity.  This questionable activity must be reported to DAIG's Intelligence Oversight Division (SAIG-IO) within five days.  Procedure 15
reports are not punitive in nature but instead allow the Army to police Military Intelligence activities from within to avoid public embarrassment or breaches in public confidence.  Violations of Army regulations may be punitive, however.

3.  **Procedure 15 Reporting Format:** Procedure 15 reports may be in written (i.e., memorandum) or electronic format.  The report should include the following items:

a. Identification of the personnel committing the alleged questionable activity by rank or civilian grade; security clearance and access; unit of assignment, employment, attachment or detail; and assigned duties at the time of the activity.  Do not identify individuals by name or other personal identifier unless the DCS, G-2 (DAMI-CDC) or TIG (SAIG-IO) so requests. b. When and where the activity occurred. c. A description of the activity and how it constitutes questionable intelligence activity.  Cite the applicable portion(s) of AR 381-10 and other applicable law or policy.


d. Command and / or investigative agency actions planned or ongoing, if applicable.

4.  Transmit reports via e-mail, facsimile, message, or hard copy as long as they meet the five-day requirement.  An original signature is not required; electronic transmittal is the preferred method of delivery.

5.  **Investigating a Questionable Activity:** Each report of questionable activity must be investigated to determine the facts necessary to assess whether the activity is legal and consistent with public policy.  An IG Investigation is not required; a Commander's Inquiry or AR 15-6 investigation will suffice.  When the investigation is complete, the investigating command must forward a copy of the final investigation report (with any disciplinary or corrective action taken) to SAIG-IO.  The status of investigations exceeding one month in duration must be reported to SAIG-IO every **30 days** until complete.