## Department Of Defense Instruction

#

NUMBER 5240.04
April 1, 2016
Incorporating Change 2, Effective September 18, 2020


## Usd(I&S)

 SUBJECT: Counterintelligence (CI) Investigations

References: See Enclosure 1 1.  PURPOSE.  This instruction:
a.  Reissues DoD Instruction (DoDI) 5240.04 (Reference (a)) to implement policy, assign responsibilities, and provide procedures for conducting CI investigations in accordance with DoD Directive 5240.02 and DoD Directive 5143.01 (References (b) and (c)).

b.  Defines full-field CI investigations and preliminary CI investigations under the purview of the Under Secretary of Defense for Intelligence and Security (USD(I&S)) .

2.  APPLICABILITY.  This instruction:
a.  Applies to OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this instruction as the "DoD Components").

b.  Does not apply to the conduct of CI inquiries described in DoDI O-5240.10 (Reference
(d)). 3.  POLICY.  It is DoD policy that CI investigations be conducted in accordance with Reference (b) and only be conducted by the Military Department counterintelligence organizations (MDCOs) identified in the Memorandum of Agreement Between the Attorney General and the Secretary of Defense (Reference (e)) and the Memorandum of Understanding Between the Federal Bureau of Investigation (FBI) and the Department of Defense (Reference (f)) or their successor agreements.

4.  RESPONSIBILITIES.  See Enclosure 2. 5.  PROCEDURES.  See Enclosure 3. 6.  INFORMATION COLLECTION REQUIREMENTS a.  The incident reports for the FBI, referred to in paragraph 4d(1) of Enclosure 2 of this instruction, do not require either licensing with a report control symbol in accordance with Volume 1 of DoD Manual 8910.01 (Reference (g)) or licensing with an Office of Management and Budget control number in accordance with Volume 2 of DoD Manual 8910.01 (Reference (h)).


b.  The information on U.S. persons, referred to in paragraph 1a of Enclosure 3 of this instruction, does not require licensing with a report control symbol in accordance with Reference (g) or licensing with an Office of Management and Budget control number in accordance with Reference (h). c.  The CI investigative information and Table 1 of Enclosure 3, referred to in paragraphs 1d and 1e, do not require either licensing with a report control symbol in accordance with Reference (g) or licensing with an Office of Management and Budget control number in accordance with Reference (h).

7.  RELEASABILITY.  **Cleared for public release**.  This instruction is available on the Directives Division Website at https://www.esd.whs.mil/DD/. 8.  SUMMARY OF CHANGE 2.  This administrative change updates the title of the Under Secretary of Defense for Intelligence to the USD(I&S) in accordance with Public Law 116-92 (Reference (i)).

Marcel Lettre Under Secretary of Defense for Intelligence
9.  EFFECTIVE DATE.  This instruction is effective April 1, 2016. Enclosures
1.  References

2.  Responsibilities

3.  Procedures Glossary

## Enclosure 1 References

 (a) DoD Instruction 5240.04, "Counterintelligence Investigations," February 2, 2009, as
amended (hereby cancelled)
(b) DoD Directive 5240.02, "Counterintelligence (CI)," March 17, 2015, as amended (c) DoD Directive 5143.01, "Under Secretary of Defense for Intelligence and Security
(USD(I&S))," October 24, 2014, as amended
(d) DoD Instruction O-5240.10, "Counterintelligence (CI) in the DoD Components,"
 April 27, 2020
(e) Memorandum of Agreement Between the Attorney General and the Secretary of Defense,
"Agreement Governing the Conduct of Defense Department Counterintelligence Activities
in Conjunction with the Federal Bureau of Investigation," April 5, 19791
(f)
Memorandum of Understanding Between the Federal Bureau of Investigation and the Department of Defense, "Coordination of Counterintelligence Matters Between FBI and
DoD," June 20, 19961
(g) DoD Manual 8910.01, Volume 1, "DoD Information Collections Manual:  Procedures for
DoD Internal Information Collections," June 30, 2014, as amended
(h) DoD Manual 8910.01, Volume 2, "DoD Information Collections Manual:  Procedures for
DoD Public Information Collections," June 30, 2014, as amended
(i)
Public Law 116-92, "National Defense Authorization Act for Fiscal Year 2020," December 20, 2019
(j)
Assistant to the President for National Security Affairs Memorandum, "Early Detection of Espionage and Other Intelligence Activities Through Identification and Referral of
Anomalies," August 23, 19961
(k) Chapter 47 of Title 10, United States Code (l)
Title 50, United States Code
(m) Section 533 of Title 28, United States Code (n) DoD Instruction 5400.15, "Guidance on Obtaining Information from Financial
Institutions," December 2, 2004, as amended
(o) Section 3414 of Title 12, United States Code
(p) Section 1681v of Title 15, United States Code (q) DoD Manual 5240.01, "Procedures Governing the Conduct of DoD Intelligence
Activities," August 8, 2016

## Enclosure 2 Responsibilities

 1.  DIRECTOR FOR DEFENSE INTELLIGENCE (INTELLIGENCE AND SECURITY) (DDI(I&S)).  Under the authority, direction, and control of the USD(I&S), the DDI(I&S):
a.  Oversees DoD CI investigative activities.


b.  Develops and recommends CI investigations policy.
c.  Participates in DoD and national-level CI investigations forums.


d.  Serves as the OSD staff point of contact for CI investigations-related issues. 2.  DIRECTOR, DEFENSE INTELLIGENCE AGENCY (DIA).  Under the authority, direction, and control of the USD(I&S), the Director, DIA:
a.  Reviews CI investigations that are forwarded by the MDCOs in accordance with Reference (b).  Coordinates with the MDCOs to deconflict those CI investigations that overlap Service boundaries.

b.  Identifies, evaluates, and recommends investigative actions to be taken concerning anomalies according to the Assistant to the President for National Security Affairs Memorandum (Reference (j)).

c.  Serves as the focal point and central repository for DoD unknown subject CI leads, reports, and information.  When a DoD unknown subject lead is not specific to a DoD Component:

(1)  DIA determines DoD Component affiliation and then refers the matter to the appropriate MDCO or the FBI.


(2)  DIA provides all original documentation, results of all inquiries, files, leads, and all other relevant information to the appropriate MDCO or the FBI.

d.  Analyzes CI investigations to report trends, anomalies, and other matters of CI interest to the MDCOs and the USD(I&S).

e.  Coordinates requests for review of CI inquiries when an MDCO or the FBI declines to investigate in accordance with Reference (d).

f.  In coordination with Secretaries of the Military Departments, notifies the USD(I&S) and other senior DoD officials, as appropriate, of potential damage to DoD or national security that could result from the compromise of classified, sensitive, or proprietary information identified during a CI investigation.

g.  In coordination with the MDCOs, develops, provides, and validates advanced and other specialized CI investigative training, to include procedures for requesting customer and institution financial transaction information.

h.  Participates in DoD and national-level CI investigative forums.

i.  Notifies the appropriate MDCO when making a referral to the FBI that involves a Military Department affiliated member, or a person or activity associated with a DoD Component supported by an MDCO in accordance with Reference (d).


3.  DoD COMPONENT HEADS.  The DoD Component heads may request a USD(I&S) review when an MDCO or the FBI chooses not to conduct a CI investigation based on a referral and the DoD Component disagrees with that decision.  Such requests will be submitted in writing through the Director, DIA, and the DDI(I&S) to the USD(I&S).  CI referrals the FBI chooses not to investigate may be referred to an MDCO for investigation. 4.  SECRETARIES OF THE MILITARY DEPARTMENTS.  In addition to the responsibilities in section 3 of this enclosure, the Secretaries of the Military Departments:
a.  Conduct preliminary and full-field CI investigations within their departments in accordance with Reference (b).  This includes investigations of active and reserve military personnel, DoD civilians, and other DoD-affiliated personnel in accordance with References (e), (f), and Chapter 47 of Title 10, United States Code (U.S.C.) (Reference (k)).

b.  Designate organizations within their departments that are authorized to conduct CI
investigations consistent with References (e) and (f) or their successor agreements.

c.  Manage and oversee the use of CI resources funded for CI investigations.

d.  Through the MDCOs:


(1)  Report to the FBI those incidents meeting the criteria of section 3381 of Title 50, U.S.C. (Reference (l)) and refer CI investigative matters to the FBI in accordance with References (e), (f), and section 533 of Title 28, U.S.C. (Reference (m)).


(2)  Ensure all personnel assigned to CI investigative duties have successfully completed formal CI training in accordance with Reference (b).


(3)  Brief appropriate command officials on CI investigations that require determinations on continuing access to classified information and other personnel security actions.



(4)  Within 14 calendar days after receiving a CI referral from a DoD Component, respond to the referring component with a determination to either accept or decline the CI referral for investigation.



(5)  Keep the Combatant Commanders and the DoD Component heads informed of CI
investigations taking place within their respective areas of responsibility or affecting their interests and assist in periodic command briefings concerning these investigations in accordance with Reference (d).


(6)  Submit requests for financial information to support CI investigations in accordance with DoDI 5400.15 (Reference (n)); section 3414 of Title 12, U.S.C. (Reference (o)); section 1681v of Title 15, U.S.C. (Reference (p)); and section 3162 of Reference (l).



(7)  Obtain legal reviews of requests for financial information before submission to financial institutions and obtain legal reviews of financial institution responses to ensure they are within the scope of the request.


(8)  Maintain an annual tabulation of the occasions in which access procedures for financial records were used in accordance with References (l), (n), (o), and (p).  Use the Table 2 format in Enclosure 3 of this instruction.


(9)  Provide the Director, DIA:



(a)  Copies of all DoD unknown subject leads received from non-DoD agencies.


(b)  CI investigative reporting in accordance with Reference (b).


(10)  Return to DIA all original documentation, results of all inquiries, files, leads, and all other relevant information provided by DIA to the department if a DoD unknown subject investigation is unable to identify the subject.


ENCLOSURE 3

PROCEDURES 1.  CI INVESTIGATIONS
a.  Information on U.S. persons will be collected, retained, and disseminated in accordance with DoD Manual 5240.01 (Reference (q)).

b.  CI investigations are managed and reported in the USD(I&S)-approved information systems in accordance with Reference (b).


c.  When a DoD Component objects to a CI investigation due to operational or other reasons, the MDCO element leading the investigation will attempt to resolve the objection at the local level.  If the objection cannot be resolved at a local level, the objection will be addressed through the appropriate Military Department channels.  Outside of the investigating MDCO, only the Secretary of a Military Department may suspend or terminate a CI investigation.


(1)  When the MDCO receives a request to suspend or terminate an investigation, the Secretary of the Military Department concerned will decide promptly whether the investigation will be suspended or terminated.  The investigation will not be suspended while awaiting the Secretary's decision, except as directed by the Secretary.


(2)  The Secretaries of the Military Departments will promptly notify the USD(I&S) of the facts and their decision in each instance.

d.  The DoD Components will report, in a timely manner, to DIA, the opening of each new CI investigation and continue reporting until the investigation is closed.

e.  When an MDCO opens a CI investigation as defined in the Glossary, the MDCO will provide DIA with the CI investigative information identified in Table 1 of this enclosure.


Number
Entry
Description
1
Organization or Agency
Enter the organization or agency's name or identifier.  Include the names of the points-of contact at the organization to include telephone numbers and email addresses.
2
File Number:
Use the organization or agency identifying number such as a file or case control number.
3
Agency/FBI Project Code
Use when applicable.
4
Date Opened:
The date the case was opened written as MM/DD/YYYY.

Number
Entry
Description
5
Investigative Status
Is the case open or closed?
6
Event or Incident Date
The date written as MM/DD/YYYY.  If no exact date, write any part known or inclusive period MM/YYYY to MM/YYYY.
7
Incident Location
Provide as much detail as available. Provide the name and location of the affected DoD facility or
installation.
8
Affected DoD Facility or Installation
9
Affected DoD
Contractor
As appropriate, provide the name and location of the affected
DoD contractor.
10
Subject
As applicable and if known.  Provide the individual's full
identification to include name, home address, and citizenship. Provide their relation to DoD to include service, rank/rate/grade, job title, and assigned duties.  Include the
individual's DoD status e.g., active-duty military, reserve, DoD
civilian, DoD contractor, family member, etc.
11
Clearance and access
Subject's security clearance level and access.  The actual level
of subject's access to classified information and a description of
the program, weapons system, technology involved.  Identify
the classified computer systems to which the individual had access.
12
Special Access Program (SAP)
A statement as to whether subject is or is not briefed into or has had access to a SAP.  Provide a generic description or unclassified pseudonym of the SAP.  If subject is not identified, provide a statement as to whether a SAP is involved. The name of the known or suspected foreign intelligence entity
involved or associated with the case.
13
Foreign Intelligence Entity
14
Allegation
This is the summary of the event, incident, or offense.
15
Details
Detailed narrative of the facts.
16
Update
As necessary, a narrative of information developed since the
last report.  Little or no change should be reported as "nothing significant to report."  The result of the investigation will be included in the final report.

 2.  INVESTIGATIVE REQUESTS FOR FINANCIAL INFORMATION.  By February 15 of each year, the Secretaries of the Military Departments will compile and maintain the number of requests for financial information submitted pursuant to section 3162 of Reference (l), Reference (o), and Reference (p) for the previous calendar year.  As shown in Table 2 of this enclosure, each request will be classified as a "CI request" and/or "terrorism-related request".  The information will made available to the USD(I&S) upon request.


1
2
3
4
5
6
7
8
12
U.S.C.
3414
15
U.S.C.
1681u
50
U.S.C.
3162
CI
requests
Terrorism related requests
Number of people on whom requests were issued
Number of investigations in which requests were issued
Number of people on whom requests were issued who were not DoD- affiliated

Explanation: Column 1:  Total number of requests issued pursuant to Reference (o). Column 2:  Total number of requests issued pursuant to Reference (p). Column 3:  Total number of requests issued pursuant to section 3162 of Reference (l).
Column 4:  Total number of CI requests from columns 1-3. Column 5:  Total number of terrorism requests from columns 1-3. Column 6:  Self-explanatory. Column 7:  Self-explanatory. Column 8:  Explain in footnotes as necessary.


## Glossary


PART I.  ABBREVIATIONS AND ACRONYMS

CI
counterintelligence


DIA
Defense Intelligence Agency
DDI(I&S)
Director for Defense Intelligence (Intelligence and Security)
DoDI
DoD instruction


FBI
Federal Bureau of Investigation


MDCO
Military Department counterintelligence organization


SAP
Special Access Program


U.S.C.
United States Code
USD(I&S) Under Secretary of Defense for Intelligence and Security


PART II.  DEFINITIONS

Unless otherwise noted, these terms and their definitions are for the purpose of this instruction.


anomalies.  Foreign power activities or knowledge, inconsistent with the expected norms, that suggest prior foreign knowledge of U.S. national security information, processed, or capabilities. CI investigations.  Formal investigative activities undertaken to determine whether a particular person is acting for or on behalf of, or an event is related to, a foreign power engaged in spying or committing espionage, sabotage, treason, sedition, subversion, assassinations, or international terrorist activities, and to determine actions required to neutralize such acts.

full-field CI investigation.  An investigation in which there is a reasonable belief a member of the U.S. military; a civilian employee or contractor of DoD; or an individual having access to DoD installations, personnel or information, is engaged in spying or has committed or attempted to commit espionage, sabotage, treason, sedition, subversion, assassination, or international terrorist activity or otherwise poses a threat to national security.

preliminary CI investigation.  An investigation that does not meet the reasonable belief standard of a full-field CI investigation but requires an examination of the facts to determine if a full-field CI investigation is required.  A preliminary CI investigation must be completed within 6 months of its initiation. DoD unknown subject.  The subject of a CI investigation whose identity has not been determined. U.S. person.  Defined in Reference (q).