## Department Of Defense Instruction

May 4, 2012
Incorporating Change 3, Effective December 7, 2020
USD(I&S)
SUBJECT:  Countering Espionage, International Terrorism, and the Counterintelligence (CI)
Insider Threat References:  See Enclosure 1
1. PURPOSE.  This Instruction:
a. Establishes policy, assigns responsibilities, and provides procedures for CI activities to counter espionage and international terrorist threats to DoD in accordance with the authority in DoD Directive (DoDD) 5143.01 (Reference (a)).

b. Implements policy in DoDD 5240.02 (Reference (b)) and DoD Instruction (DoDI) O-
5100.93 (Reference (c)) to identify and counter foreign intelligence entities (FIEs).

c. Establishes policy and assigns responsibilities for the CI Insider Threat Program in support of other DoD Insider Threat programs consistent with the Secretary of Defense Memorandum (Reference (d)) and Executive Order 13587 (Reference (e)).
d. Establishes the Insider Threat CI Group (ITCIG).

2. APPLICABILITY.  This Instruction applies to OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD
Field Activities, and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

3. DEFINITIONS.  See Glossary. 4. POLICY.  It is DoD policy that:
a. In accordance with Reference (b) and DoDI 2000.12 (Reference (f)), countering espionage and international terrorism shall be an integrated CI mission to detect, identify, exploit, assess, and deny efforts by FIEs to recruit DoD-affiliated personnel.
b. Countering insider threats are coordinated CI, security, information assurance (IA), law enforcement (LE), and antiterrorism and force protection (AT/FP) activities that shall be accomplished in accordance with References (b) through (f) and DoDI 5240.05, DoDD 5240.06, DoDI O-5240.10, DoDI 5240.19, DoDD 5210.48, DoDI 8500.01, the Assistant to the President for National Security Affairs Memorandum, and Intelligence Community Standard 700-2 (References (g) through (n)).

c. CI insider threat information shall be shared within the Intelligence Community (IC) and with other departments and agencies in accordance with Executive Order 12333 (Reference (o)).

5. RESPONSIBILITIES.  See Enclosure 2. 6. PROCEDURES.  See Enclosure 3. 7. INFORMATION COLLECTION REQUIREMENTS.  The report of anomalies associated with CI insider threats referenced in paragraph 2.a. of Enclosure 3 of this Instruction does not require licensing with a report control symbol in accordance with Paragraphs 3 and 8of Volume 1 of DoD Manual 8910.01 and the Secretary of Defense Memorandum (References (p) and (q)).

8. RELEASABILITY.  **Cleared for public release.**  This volume is available on the Directives Division Website at https://www.esd.whs.mil/DD/. 9. SUMMARY OF CHANGE 3.  This administrative change:
a. Changes the title of the Under Secretary of Defense for Intelligence to the Under Secretary of Defense for Intelligence and Security in accordance with Public Law 116-92 (Reference (r)).

b. Administrative changes in accordance with current standards of the Office of the Chief Management Officer of the Department of Defense

c. Updates references.
10.  EFFECTIVE DATE.  This instruction is effective May 4, 2012.



Michael G. Vickers Under Secretary of Defense for Intelligence Enclosures

1.  References

2.  Responsibilities

3.  Procedures Glossary

## Enclosure 1 References

 (a) DoD Directive 5143.01, "Under Secretary of Defense for Intelligence and Security
(USD(I&S))," October 24, 2014, as amended

(b) DoD Directive 5240.02, "Counterintelligence (CI)," March 17, 2015, as amended
(c) DoD Instruction O-5100.93, "Defense Counterintelligence (CI) and Human Intelligence
(HUMINT) Center (DCHC)," August 13, 2010
(d) Secretary of Defense Memorandum, "(U) Information Security and Assurance Measures to
Mitigate Unauthorized Removal of Information from Classified Networks,"

February 10, 2011
(e) Executive Order 13587, "Structural Reforms to Improve the Security of Classified
Networks and the Responsible Sharing and Safeguarding of Classified Information," October 7, 2011
(f)
DoD Instruction 2000.12, "DoD Antiterrorism (AT) Program," March 1, 2012, as amended
(g) DoD Instruction 5240.05, "Technical Surveillance Countermeasures (TSCM),"
April 3, 2014, as amended
(h) DoD Directive 5240.06, "Counterintelligence Awareness and Reporting (CIAR),"
May 17, 2011, as amended
(i)
DoD Instruction O-5240.10, "Counterintelligence (CI) in the DoD Components,"
April 27, 2020
(j)
DoD Instruction 5240.19, "Counterintelligence Support to the Defense Critical
Infrastructure Program (DCIP)," January 31, 2014, as amended
(k) DoD Directive 5210.48, "Credibility Assessment (CA) Program," April 24, 2015, as
amended
(l)
DoD Instruction 8500.01, "Cybersecurity," March 14, 2014, as amended
(m) Assistant to the President for National Security Affairs Memorandum, "Early Detection of
Espionage and Other Intelligence Activities Through Identification and Referral of Anomalies," August 23, 1996
(n) Intelligence Community Standard Number 700-2, "Use of Audit Data for Insider Threat
Detection," June 2, 2011
(o) Executive Order 12333, "United States Intelligence Activities," December 4, 1981 (as
amended)
(p) DoD Manual 8910.01, Volume 1, "DoD Information Collections Manual:  Procedures for
DoD Internal Information Collections," June 30, 2014, as amended
(q) Secretary of Defense Memorandum, "Track Four Efficiency Initiative Decisions,"
March 14, 2011
(r)
Public Law 116-92, "National Defense Authorization Act for Fiscal Year 2020," December
20, 2019
(s)
DoD Manual 5240.01, "Procedures Governing the Conduct of DoD Intelligence
Activities," August 8, 2016
(t)
DoD Instruction 5240.04, "Counterintelligence (CI) Investigations," April 1, 2016, as
amended
(u) DoD Directive 8140.01, "Cyberspace Workforce Management," August 11, 2015, as
amended
(v) DoD Directive 5230.20, "Visits and Assignments of Foreign Nationals," June 22, 2005
(w) DoD Manual 5200.01, Volume 3, "DoD Information Security Program:  Protection of
Classified Information," February 24, 2012, as amended

## Enclosure 2 Responsibilities

1.  UNDER SECRETARY OF DEFENSE FOR INTELLIGENCE AND SECURITY (USD(I&S)).  The USD(I&S) shall:
a.  Monitor implementation of this Instruction and establish additional policy and provide direction as necessary.

b.  Oversee the integration of CI Insider Threat Program activities with other DoD insider threat programs.


2.  DIRECTOR FOR DEFENSE INTELLIGENCE (INTELLIGENCE AND SECURITY).  The Director for Defense Intelligence (Intelligence and Security), under the authority, direction, and control of the USD(I&S), shall:
a.  Develop and recommend CI and security policy to counter espionage, international terrorism, and the CI insider threat.

b.  Provide policy oversight of all activities covered by this Instruction.

c.  Represent the USD(I&S) at DoD and national-level forums concerning countering espionage, international terrorism, and the CI insider threat.

d.  Ensure CI insider threat education is within security policy and training programs in coordination with the Defense Intelligence Agency (DIA).

e.  Oversee security policy and a system to record and analyze security incidents and violations by a current DoD-affiliated person.



f.  Oversee security policy and a system allowing analytical assessments of administrative and security anomalies and threats of DoD-affiliated persons. 3.  DIRECTOR, DIA.  The Director, DIA, under the authority, direction, and control of the USD(I&S), and in addition to the responsibilities of section 7 of this enclosure, shall:
a.  Incorporate CI insider threat information requirements into other intelligence collection requirements.

b.  Implement the procedures in Enclosure 3.

c.  Serve as the functional manager for the CI Insider Threat Program.

d.  Serve as the functional manager for the DoD CI Enterprise to identify and neutralize FIEs.

e.  In coordination with the DoD CI Enterprise, establish an overall CI Insider Threat Program strategy and implementation plan.

f.  Ensure the CI Insider Threat Program is aligned with national strategies and objectives.

g. Establish CI Insider Threat Program standards.

h. Identify CI requirements and expectations from the security, IA, LE, and AT/FP
disciplines, and provide CI support to those disciplines.


i. Assist in the development of CI insider threat policy, doctrine, and identification of emerging capabilities, as well as tactics, techniques, and procedures.

j. Ensure alignment to the CI Insider Threat Program of elements defined in Enclosure 3.


k. Identify best practices and disseminate across the DoD CI Enterprise.
l. Represent the DoD CI Insider Threat Program to the IC.

m. Develop and implement, with input from the DoD Chief Information Officer (DoD CIO), tactics, techniques, and procedures for CI analysis of IA auditing and monitoring capabilities.

n. Establish and maintain the ITCIG.

o. Ensure the CI, security, IA, LE, and AT/FP communities are represented in CI insider threat working groups, meetings, and symposia.

p. Incorporate CI insider threat training into the Joint CI Training Academy curriculum.

q. Coordinate with the DoD Cyber Crime Center to implement CI insider threat training into the technical analysis curriculum.

r. Incorporate CI insider threat awareness into CI awareness and reporting training in accordance with Reference (h).

s. Review and evaluate reports that indicate a CI insider threat from an unknown DoD-
affiliated person in accordance with Enclosure 3.

t. Conduct analysis of anomalies as reported by the DoD Components in support of the CI
Insider Threat Program in accordance with Enclosure 3 and Reference (m).



u. Develop procedures for the exchange of information on insider threat activities, anomalies, and other applicable areas of interest to the DoD Components, Military Department Counterintelligence Organizations (MDCOs), and Military Departments. 4.  DIRECTOR, DEFENSE SECURITY SERVICE (DSS).  The Director, DSS, under the authority, direction, and control of the USD(I&S) and in addition to the responsibilities in section 7 of this enclosure, shall:
a.  Ensure CI insider threat awareness and counter-measures information is included within security training.

b.  Provide instruction and assistance to DoD-cleared defense contractors regarding CI
insider threat awareness and reporting procedures.

5. DoD CIO.  The DoD CIO shall:
a.  Develop IA policies to support the CI Insider Threat Program.

b.  Ensure CI insider threat education is within IA training policy and programs in coordination with DIA.

c.  Participate in CI insider threat forums.

6.  ASSISTANT SECRETARY OF DEFENSE FOR HOMELAND DEFENSE AND GLOBAL SECURITY (ASD(HD&GS)). The ASD(HD&GS), under the authority, direction, and control of the Under Secretary of Defense for Policy, shall:
a.  Develop AT policies to support the CI Insider Threat Program.

b.  Participate in CI insider threat forums. 7.  HEADS OF THE DoD COMPONENTS.  The Heads of the DoD Components shall:
a.  Conduct authorized CI activities to detect, identify, assess, exploit, and deny FIE and the insider threat in accordance with this Instruction and DoD Manual 5240.01 (Reference (s)).

b.  Share information provided by CI, security, IA, LE, and AT/FP working groups to effectively counter the CI insider threat.

c.  Notify the appropriate MDCO or the Federal Bureau of Investigation (FBI) when there is a reasonable belief that a clandestine relationship exists or has existed between an FIE and an unidentified current or former DoD-affiliated individual in accordance with Enclosure 3, Reference (i), and DoDI 5240.04 (Reference (t)).

d.  Incorporate CI insider threat information into CI, security, IA, LE, and AT/FP training in accordance with Reference (h) and DoDD 8140.01 (Reference (u)).

e.  Establish and maintain the capability to support CI analysis of audit and monitoring data.

f.  Consistent with authorized activities, implement CI insider threat initiatives to identify DoD-affiliated personnel suspected of or actually compromising DoD information on behalf of an FIE.

g.  Report anomalies to the Director, DIA, in accordance with Enclosure 3 and Reference
(m).

h.  Ensure notification to DSS when cleared contractor locations or personnel are involved, and that notification is coordinated with the FBI or applicable MDCO.

8.  SECRETARIES OF THE MILITARY DEPARTMENTS.  The Secretaries of the Military Departments, in addition to the responsibilities of section 7 of this enclosure, through their MDCO, shall:
a.  Integrate and validate CI insider threat information requirements into other intelligence collection requirements b.  Provide supported organizations with CI insider threat briefings as part of the existing CI
awareness program in accordance with Reference (h) and Reference (i).

c.  Establish and implement CI initiatives to identify and counter espionage, international terrorism, and the CI insider threat.


d.  Conduct information exchanges with Federal, State, local, tribal, and foreign agencies on CI insider threats in accordance with Reference (b).

e.  Conduct anomaly-based detection activities in accordance with Reference (m).

f.  Develop CI policy, programming, and resource requirements to implement a comprehensive insider threat program.

## Enclosure 3 Procedures

 1.  UNKNOWN SUBJECT LEADS.  Information based on a reasonable belief that a clandestine relationship exists or has existed between an FIE and an unidentified current or former DoD-
affiliated individual shall be immediately reported and handled as follows:
a.  DoD personnel shall immediately report such information to their organizational CI
element, supporting MDCO, the FBI, or other appropriate authority in accordance with Reference (h).


b.  Organizational CI elements that receive such information or develop the information during the course of a CI inquiry shall immediately notify DIA and the supporting MDCO or the FBI in accordance with Reference (i).

c.  MDCOs shall report such information to DIA.  This information supports the DIA
requirement to serve as the focal point and central repository for unknown subject leads, reports, and information in accordance with Reference (t).

d. DIA personnel shall review and evaluate reports that indicate a CI insider threat from an unknown DoD-affiliated person. DIA personnel shall attempt to identify the unknown individual's organizational affiliation and refer developed information to the appropriate MDCO or the FBI in accordance with Reference (t).

2.  ANOMALIES
a.  The DoD Components report anomalies to DIA in accordance with Reference (m).  This is done by memorandums within 5 working days, using the procedures established for CI inquiries and referrals in accordance with Reference (i).

b. DIA shall share CI insider threat trends within the CI enterprise.

c.  If no FIE connection is found, threat information shall be forwarded to the applicable law enforcement organizations.

d.  If DIA determines an anomaly warrants investigation, DIA shall refer the matter to the appropriate MDCO or the FBI in accordance with Reference (t).

3.  CI INSIDER THREAT PROGRAM ELEMENTS.  The CI Insider Threat Program shall include:

a.  CI Analysis of Information Technology Auditing and Monitoring.  Mitigation tools are a collection of IA tools or a single application that provides standard on-line behavioral monitoring of prohibited activities, anomalous behavior, and suspicious actions.  These automated systems shall have a standard data sharing capability to ease interoperability within DoD and the IC.  The tools shall be supported by technical and analytical resources.

b.  CI Insider Threat Awareness and Training.  Awareness and training shall consist of integrated CI, security, IA, and AT/FP education programs addressing threats to personnel within the DoD Component in accordance with Reference (h).  Education programs shall be mandatory, interactive, and address current and real threats in the work and personal environment.

c.  Foreign Travel and Contact Reporting and Analysis.  A process for DoD personnel, including contractor support, to report foreign travel and foreign contacts.  The process includes foreign national visits to DoD and contractor facilities.  The process shall be in accordance with Reference (h) and DoDD 5230.20 (Reference (v)).  The process shall be integrated into component travel systems, as appropriate, to ensure proper notifications and that pre- and posttravel briefings are conducted.



d.  Polygraph and Credibility Assessment.  Polygraph and approved credibility assessment tools shall be used in accordance with Reference (k) to identify and resolve CI insider threat issues.


(1)  Favorable CI scope polygraph (CSP) and expanded-scope screening exams shall be entered into the Joint Personnel Adjudication System and Scattered Castle system, to allow information to be shared with components and the IC, unless inputting the data will compromise the status or affiliation of the concerned individual.


(2)  DoD Polygraph Program personnel shall report the results of unfavorable CSP
examinations to the responsible authority for determination of access suitability, CI analysis, and further investigation, as appropriate.


e.  Personnel Security, Evaluation, Analysis, and Reporting.  In accordance with DoD
Manual 5200.01-V-3 (Reference (w)), both personnel security and CI professionals shall coordinate within their authorities when CI concerns are developed through the adjudicative process.

f.  Security Incident Reporting and Evaluation.  CI and security professionals shall coordinate to obtain records of security incidents, violations, suspicious incidents, and anomalies by DoD- affiliated persons in accordance with Reference (s).

g.  Proactive CI Initiatives.  The implementation of innovative activities to identify CI insider threats is a shared responsibility and mission for CI, security, IA, and AT/FP, while working in concert with the MDCOs and, as appropriate, the FBI, in accordance with existing policies and laws.  Components shall coordinate innovative activities with their respective legal advisors before implementing.



## Glossary

PART I.  ABBREVIATIONS AND ACRONYMS

ASD(HD&GS) Assistant Secretary of Defense for Homeland Defense and Global
Security
AT/FP
antiterrorism and force protection


CI
counterintelligence
CSP
CI scope polygraph


DIA
Defense Intelligence Agency
DoD CIO
DoD Chief Information Officer
DoDD
DoD directive
DoDI
DoD instruction
DSS
Defense Security Service


FBI
Federal Bureau of Investigation
FIE
foreign intelligence entity


HUMINT
human intelligence


IA
information assurance
IC
Intelligence Community
ITCIG
Insider Threat Counterintelligence Group


LE
law enforcement


MDCO
Military Department CI Organization


USD(I&S)
Under Secretary of Defense for Intelligence and Security
PART II.  DEFINITIONS


These terms and their definitions are for the purposes of this Instruction.


anomaly-based detection.  The process of comparing CI, security, IA, LE, and AT/FP behaviors and activities that are deemed normal against other observed events to identify significant deviations and or anomalous behavior. anomaly.  Defined in Reference (b). CI insider threat.  A person, known or suspected, who uses their authorized access to DoD facilities, personnel, systems, equipment, information, or infrastructure to damage and disrupt operations, compromise DoD information, or commit espionage on behalf of an FIE. DoD personnel.  Active and reserve military personnel, as well as DoD civilian employees. DoD-affiliated personnel.  DoD active and reserve personnel, DoD civilian employees, retired military and DoD civilian employees, contractors and their employees, inactive reservists, National Guard members, family members of active duty and civilian personnel, persons residing on or having access to DoD facilities, persons under consideration for DoD employment, and former DoD employees and contractors.


FIE.  Any known or suspected foreign organization, person, or group (public, private, or governmental) that conducts intelligence activities to acquire U.S. information, blocks or impairs U.S. intelligence collection, influences U.S. policy, or disrupts U.S. systems and programs.  This term includes a foreign intelligence and security service and international terrorists.

insider.  Anyone who has authorized access to DoD resources by virtue of employment, volunteer activities, or contractual relationship with DoD. insider threat.  A person with authorized access, who uses that access, wittingly or unwittingly, to harm national security interests or national security through unauthorized disclosure, data modification, espionage, terrorism, or kinetic actions resulting in loss or degradation of resources or capabilities.