CHAPTER 400 -- INVESTIGATIONS

**(400)-410** **[TIGTA Criminal Intelligence Program]{.underline}**

410.1 [Overview.]{.underline}

This section provides guidance relating to the TIGTA-Office of
Investigations (OI) Criminal Intelligence Program (CIP) as follows:

-   [Purpose of the TIGTA-OI Criminal Intelligence
    Program](#PurposeoftheTIGTAOICIP)

-   [Authority](#Authority)

-   [Constitutional and Privacy Act
    Issues](#ConstitutionalandPrivacyActIssues)

-   [Criminal Intelligence Investigation Oversight
    Guidelines](#CriminalIntelInvestigationOversightGuide)

-   [Responsibilities](#Responsibilities)

-   [Collecting, Organizing and Maintaining Criminal Intelligence
    Information](#CollectingOrganizingMaintainingCrimIntel)

-   [Participation in Joint Terrorism Task
    Forces](#ParticipationinJointTerrorismTaskForces)

-   [Coordination with the Federal Bureau of
    Investigation](#CoordinationwiththeFBI)

-   [Initiating Investigations on Individuals Identified through
    Criminal Intelligence Program
    LII](#InitiatingInvestigationsThroughCIP)

-   [Anti-Government Group Database](#AntiGovernmentGroupsDatabase)

-   [Divisional Criminal Intelligence Program Coordinator
    Activities](#DivisionCriminalIntelligenceCoordinator)

-   [Criminal Intelligence Program
    Advisories](#CriminalIntelligenceProgramAdvisories)

-   [Briefings/Presentations](#BriefingsPresentations)

-   [Terrorism Amendments to 26 U.S.C. §
    6103](#TerrorismAmendmentsto26USC6103)

    1.  [Acronyms
        Table.](../../../../../../../../imds-temp/chapter400-inv/acronyms-table/acronyms-table.doc#AcronymsTable)

    2.  []{#Definitions .anchor}[Definitions.]{.underline}

```{=html}
<!-- -->
```
-   [TIGTA-OI Counter-terrorism Investigation]{.underline} --
    investigations of individuals or groups who seek to further
    political goals wholly or in part through activities that involve
    force or violence, or non-violent actions, which have the potential
    to interfere with the administration of the internal revenue laws,
    and would be in violation of Federal or state criminal laws

-   [TIGTA-OI Criminal Intelligence Program]{.underline} -- includes all
    investigations initiated for the purpose of identifying,
    investigating, tracking, or deterring criminal activities of
    individuals or groups who seek to further political goals wholly or
    in part through activities that involve force or violence, or
    non-violent actions, which have the potential to impact the safety
    of Internal Revenue Service (IRS) employees or interfere with the
    administration of the internal revenue laws. This also includes
    investigations of persons identified through CIP proactive
    initiatives who have engaged in activities that would qualify them
    to be designated as Potentially Dangerous Taxpayers (PDT) or to have
    a caution (CAU) indicator placed on the taxpayer's account in the
    IRS Integrated Data Retrieval System (IDRS).

```{=html}
<!-- -->
```
-   [Intelligence]{.underline} -- information obtained from records and
    other sources reasonably indicating criminal activity as defined
    under the laws of the United States, particularly those under
    TIGTA-OI's jurisdiction, which is not associated with any particular
    ongoing investigation, but could potentially provide the basis for
    initiation of one or more criminal investigations.

-   [Case Specific Information]{.underline} -- information from
    investigative records and other sources reasonably indicating
    criminal activity as defined under the laws of the United States,
    and within TIGTA-OI's jurisdiction, that is associated with a
    particular open investigation.

-   [Reasonable Indication]{.underline} -- the standard of reasonable
    indication is substantially lower than probable cause. In
    determining whether there is a reasonable indication of a violation
    within TIGTA-OI's jurisdiction, the Special Agent (S/A) may take
    into account any facts and circumstances that a prudent investigator
    would consider. However, the standard does require specific facts or
    circumstances indicating a past, current, or future violation. There
    must be an objective, factual basis for initiating the
    investigation; a mere hunch is insufficient.

```{=html}
<!-- -->
```
-   [Terrorism]{.underline} -- the unlawful use of force or violence, or
    other non-violent actions, e.g., cyber attack, against persons or
    property to intimidate or coerce a government, the civilian
    population, or any segment thereof, in furtherance of political or
    social objectives.

-   [Domestic Terrorism]{.underline} -- terrorism committed by a group
    or individual based and operating entirely within the United States
    (or it territories) without foreign direction.

The statutory definition of these terms may be found in Title 18, United
States Code.

410.2 []{#PurposeoftheTIGTAOICIP .anchor}[Purpose of the TIGTA-OI
Criminal Intelligence Program.]{.underline}

The overall purpose of the TIGTA-OI CIP is to prevent individuals and
groups from threatening, assaulting, intimidating, or otherwise impeding
IRS employees in the performance of their duties, or impeding the
administration of the internal revenue laws.

The main focus of the CIP is to identify, through proactive means,
persons or groups that advocate activities against IRS employees or
facilities, or against the Federal government in general, where such
activities could reasonably threaten the safety of IRS employees or
impede the administration of the internal revenue laws. Generally, this
will involve groups or individuals involved in domestic terrorism, but,
in the current environment, could involve other trans-national terrorist
activities.

A second, but equally important, aspect of this program is to conduct
counter-terrorism investigations of such individuals identified through
proactive intelligence gathering initiatives, and of any anti-government
groups with which []{#Authority .anchor}they may be closely associated.

410.3 [Authority.]{.underline}

The [Inspector General Act (IG
Act)](http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t05t08+1160+25++('Inspec),
5 U.S.C. app. 3 § 8D(k)(1)(C), provides that the TIGTA "shall be
responsible for protecting the Internal Revenue Service against external
attempts to corrupt or threaten employees of the Internal Revenue
Service". This responsibility is also provided for in [Treasury Order
115-01](http://www.treasury.gov/regs/to115-01.htm).

410.4 []{#ConstitutionalandPrivacyActIssues .anchor}[Constitutional and
Privacy Act Issues.]{.underline}

There are significant Constitutional issues, especially related to the
First Amendment, and privacy considerations that govern TIGTA-OI CIP
investigations. Therefore, each S/A must be fully cognizant of the
Constitutional requirements regarding First Amendment rights.

The Privacy Act (5 U.S.C. § 552a(e)(7)) prohibits Federal agencies from
maintaining a record describing how an individual exercises rights
guaranteed by the First Amendment unless:

-   Expressly authorized by statute; or

-   Authorized by the individual about whom the record is maintained; or

-   Pertinent to and within the scope of an authorized law enforcement
    activity.

Therefore, S/A's should not collect or maintain records relating to
persons exercising First Amendment rights unless the information is
inextricably intertwined with information which indicates such persons
and/or groups advocate violence toward IRS personnel or facilities, or
advocate activities intended to disrupt orderly IRS operations.

To avoid encroaching on an individual's lawful participation in
activities protected by the First Amendment, S/A's should:

-   Make sure there is a reasonable indication that a group or
    organization, or a member of a group or organization, poses a threat
    to IRS employees, operations or facilities;

-   Conduct the investigation in the manner least likely to have a
    chilling effect on members' legitimate speech and association;

-   Investigate only to the extent necessary to determine whether the
    group or individual poses a threat;

-   Terminate the investigation when it becomes clear that the group or
    individual poses no threat to IRS employees, operations or
    facilities; and

-   Immediately destroy unsolicited intelligence that may implicate
    First Amendment rights that is neither mission-related nor within
    the jurisdiction of another agency. Unsolicited complaint
    information should continue to be processed in accordance with
    Section 240 of this Chapter.

**Note:** Refer relevant threat information to other law enforcement
entities, following the procedures set forth in [Chapter 700, Chief
Counsel, Sections
50.5](../../../../../../../../I:/chapter700-counsel/700-50/700-50.doc#Authorizeddisclosures)
and
[70.5](../../../../../../../../I:/chapter700-counsel/700-70/700-70.doc#Referrals).
Coordinate with the Assistant Special Agent-in-Charge (ASAC)-Special
Inquiries and Intelligence Division (SIID), Group 813.

410.5 []{#CriminalIntelInvestigationOversightGuide .anchor} [Criminal
Intelligence Investigation Oversight Guidelines.]{.underline}

Due to the significant Constitutional and privacy requirements that
govern TIGTA-OI's CIP investigations, strict management control and
higher levels of review and oversight are required.

ASAC's are responsible for reviewing all CIP related information
gathered by TIGTA-OI personnel in their respective groups that is
incorporated into cases, proactive investigative initiatives, or
TIGTA-OI files to ensure compliance with Privacy Act guidelines.

Special Agents-in-Charge (SAC's) shall conduct semi-annual reviews of
the CIP information gathering activities to ensure compliance with the
requirements set forth in this Section.

All CIP Local Investigative Initiatives (LII) shall be initiated in
accordance with guidance in [Section
320.4](../../../../../../../../imds-temp/chapter400-inv/400-320/chapter400-320.doc#LocalInvInitiativeSIISIIP).
The authority to initiate CIP LII's may not be re-delegated.

The ASAC-Field Division may authorize preliminary information gathering
for the purpose of determining the potential of a CIP LII.

410.5.1 []{#CriminalIntelligenceInvestigationFactor .anchor} [Criminal
Intelligence Investigation Factor Test.]{.underline} The following three
factors should be considered in determining whether to initiate a CIP
related investigation:

-   Does the group or individual advocate violence against the IRS
    specifically?

-   Does the group or individual advocate violence against the Federal
    government in general that could potentially have an adverse impact
    on the safety of IRS employees or facilities?

-   Does the group or individual advocate use of non-violent activities
    against the IRS that are designed to impede IRS employees in the
    performance of their duties, or to otherwise interfere with the
    administration of the internal revenue laws (e.g., filing false
    liens or currency transaction reports (IRS Form 8300)?

If the answer to any of the above three questions is "Yes", a CIP LII on
a group is warranted or a Non-Employee investigation on an individual is
warranted.

410.5.2 [Determining Membership in a Targeted Organization.]{.underline}
One of the main objectives of the CIP is to identify individuals who
pose a threat to IRS employees and to provide the IRS with sufficient
information so that that these individuals can be considered as PDT's or
identified with a caution indicator (CAU) in IDRS. Many of the
individuals closely associated with violence prone anti-tax or
anti-government groups may meet the criteria to be designated as PDT's.
However, the mere listing of an individual on a membership list or
association with a group or organization is not sufficient reason for
the IRS to designate that person as a PDT. To meet the criteria for a
PDT designation based on group membership or association, the person
must be an "active" member.

Use one or more of the following criteria to determine active
membership:

-   Dues-paying member

-   Officer in the organization

-   Distributes literature on behalf of the organization

-   Makes statements that promote the organization\'s illegal activities

-   Engages in the planning and direction of the organization\'s illegal
    activities

-   Signs significant documents on behalf of the organization

If the individual is determined to be closely associated with or a
member of an anti-government group, consideration should be given to
initiating a counter-terrorism investigation (LII) on the group to
determine if it poses a threat to the safety of IRS employees or
facilities and to identify additional members that may meet PDT
criteria. See [Section
410.5.1](#CriminalIntelligenceInvestigationFactor) above for criteria to
initiate LII on anti-government group.

410.5.3 [Information Gathering Guidelines.]{.underline} Criminal
intelligence information must only be maintained under authority of an
authorized investigation, in most instances, either a National
Investigative Initiative (NII) or LII.

S/A's should solicit only information that is within the jurisdiction of
TIGTA-OI, pursuant to the statutory authority of the TIGTA and the
authority delegated to TIGTA by the Secretary of the Treasury.

When conducting an approved CIP LII on a group or organization
(enterprise), S/A's may use any legitimate investigative technique
authorized for TIGTA-OI and collect such information as:

-   The members of the enterprise and other persons likely to be
    knowingly acting in furtherance of its criminal objectives, provided
    that the information concerns such persons' activities on behalf of
    or in furtherance of the enterprise;

-   The finances of the enterprise;

-   Geographical dimensions of the enterprise; and

-   Past and future activities and goals of the enterprise.

TIGTA-OI S/A's shall not maintain files containing information about
individuals or organizations unless such files are an integral part of a
currently assigned case.

When an S/A is assigned to and while operating under the authority of a
Joint Terrorism Task Force (JTTF), the S/A may solicit any information
that falls within the mission and jurisdiction of the JTTF. However,
such information may not be maintained in TIGTA-OI files unless that
information is to be used as the basis to initiate a TIGTA-OI
investigation.

410.6 []{#Responsibilities .anchor}[Responsibilities.]{.underline}

In order for the TIGTA-OI CIP to be effective, there must be a
systematic means by which relevant information is gathered and
disseminated, and a specific protocol by which this information is
organized and maintained. The responsibilities and activities listed
below will facilitate the effective collection and dissemination of
criminal intelligence information.

410.6.1 [SAC-SIID.]{.underline} The SAC-SIID is responsible for the
national coordination and monitoring of TIGTA-OI CIP activities.
Generally, this will include the following:

-   Liaison/coordination at the headquarters level with other Federal
    law enforcement agencies;

-   Liaison/coordination with IRS headquarters personnel and the IRS
    Office of Employee Protection (IRS-OEP);

-   Providing periodic briefings to TIGTA and IRS senior management on
    status of significant incidents and CIP related investigations;

-   Conducting ad hoc studies and analyses relating to the CIP as
    directed by TIGTA management officials;

-   Conducting research of "open sources" for information relating to
    CIP, forwarding such information to the Field Division as
    appropriate;

-   Monitoring Field Division initiatives relating to criminal
    intelligence;

-   Preparation of Criminal Intelligence Program Advisories ;

-   Conducting studies and analyses to identify emerging activities of
    violence prone anti-tax or anti-government groups;

-   Developing training and presentations relating to threats and
    assaults, in conjunction with TIGTA-OI Operations Division, National
    Training Coordinator (NTC);

-   Development and dissemination of policy and procedures regarding CIP
    activities;

-   Validation of data entered to the Performance and Results
    Information System (PARIS) relating to the CIP; and

-   Participation in National JTTF.

Whenever the SAC-SIID, or designee, liaisons with IRS or other Federal
law enforcement agencies, any exchange of information shall be
consistent with the Privacy Act and 26 U.S.C. § 6103. See [*Section
410.15*](#TerrorismAmendmentsto26USC6103) below for additional guidance
on disclosure of information relating to terrorism.

410.6.2 [SAC-Field Division.]{.underline} The SAC-Field Division is
responsible for the coordination and monitoring of TIGTA-OI CIP
activities at the Field Division level. Generally, this will include the
following:

-   Liaison/coordination at the Field Division level with Federal and
    state/local law enforcement agencies within the Division that may
    routinely have or maintain information that would be relevant to the
    TIGTA-OI CIP;

-   Liaison/coordination with local IRS management officials;

-   Participation in JTTF's or other task forces related to
    counter-terrorism;

-   Initiation of LII's to identify and investigate anti-tax or other
    anti-government groups operating within the Field Division whose
    activities would fall within the jurisdiction of TIGTA-OI; and

-   Initiation of Non-Employee investigations (in some cases, Employee
    investigations) to investigate activities of individuals suspected
    of being members of anti-government groups whose activities would
    fall within the jurisdiction of TIGTA-OI.

Whenever the SAC-Field Division, or designee, liaisons with IRS or other
Federal, state or local law enforcement agencies, any exchange of
information shall be consistent with the Privacy Act and 26 U.S.C. §
6103. See [Section 410.15](#TerrorismAmendmentsto26USC6103) below for
additional guidance on disclosure of information relating to terrorism.

410.7 []{#CollectingOrganizingMaintainingCrimIntel .anchor}[Collecting,
Organizing and Maintaining Criminal Intelligence
Information.]{.underline}

Due to the limited geographical distribution of TIGTA-OI investigative
resources, an effective method of obtaining lead information for
criminal intelligence purposes is to leverage, to the extent
practicable, the information gathering capabilities of other credible
entities. This would include Federal, state and local law enforcement
organizations, IRS personnel, open source media, etc.

Criminal intelligence information obtained from these sources that may
relate to the TIGTA-OI mission can then be evaluated to determine if
there is a basis to conduct further inquiry or investigation. Generally,
the designated Criminal Intelligence Coordinator (CIC) within the Field
Division where the activities or incident in question occurred or is
anticipated to occur will conduct or coordinate this evaluation. Refer
to [Section 410.12](#DivisionCriminalIntelligenceCoordinator) below for
CIC duties. Due to the scope of operations of some anti-government
groups, this may require coordination with other Field Divisions or the
ASAC-SIID, Group 813.

410.7.1 [Reliability of Criminal Intelligence Information.]{.underline}
Criminal intelligence information, as defined in [Section
410.1.2](#Definitions) above, should be documented on a Memorandum of
Interview or Activity (TIGTA Form OI 2028M) and associated with the CIP
LII under which it was obtained. The S/A initially receiving the
information should also document the level of reliability of the
information. This should be done on the TIGTA Form OI 2028M in a
one-sentence statement, which will be the first paragraph of the
narrative. The reliability of the information will be reported using the
following three classifications:

-   Extremely Reliable -- examples:

    -   previously proven reliable source with corroboration

    -   information obtained through TIGTA-OI surveillance

    -   information from official records

    -   agrees with other information on individual or group

-   Reliable -- examples:

    -   information provided by upstanding citizen who has no personal
        agenda for providing the information

    -   previously proven reliable source, but information has not been
        corroborated

    -   agrees somewhat with other information on individual or group

-   Unknown -- examples:

    -   reliability of information and source is unknown

    -   information is from unreliable source, but, considering other
        known facts, is possibly true

Documenting the reliability of information pertains only to intelligence
information, not to case specific information as defined in [Section
410.1.2](#Definitions) above.

410.7.2 [Annual Investigative Initiatives.]{.underline} Criminal
intelligence information obtained from the sources cited in [Section
410.7](#CollectingOrganizingMaintainingCrimIntel) above, or other
sources as appropriate, should be organized and maintained in a manner
that permits accurate search capabilities, efficient retrieval, and the
ability to conduct thorough analyses.

The following protocol should be followed for identifying and collecting
criminal intelligence information.

410.7.2.1 [National Investigative Initiative.]{.underline} At the
beginning of each Fiscal Year, the SAC-SIID will initiate a National
Investigative Initiative (CIP NII) from which TIGTA-OI proactive CIP
initiatives will be derived.

410.7.2.2 [Field Division Annual Criminal Intelligence Program Local
Investigative Initiative.]{.underline} At the beginning of each Fiscal
Year, each SAC-Field Division will initiate its primary CIP LII to cover
[routine or on-going]{.underline} CIP activities conducted within the
Division by the designated CIC or other S/As in the Division. This will
include such activities as described in [Section
410.12](#DivisionCriminalIntelligenceCoordinator) below.

These Divisional CIP LII's will be spin-off cases of the CIP NII
initiated by the SAC-SIID.

The Division's CIP LII will be documented in PARIS as follows:

-   Title shall be Division Name and the phrase "Criminal Intelligence
    Program Initiative" -- for example, "Washington Field Division
    Criminal Intelligence Program Initiative"

```{=html}
<!-- -->
```
-   Source of Complaint Code shall be \"14 -- TIGTA Investigations --
    Spin off from National Investigative Initiative\"

-   Sensitivity Code shall be \"8 - Counter Terrorism\"

-   Violation Code shall be "152 -- Intelligence Gathering Initiative"

410.7.2.3 [Reports of Investigation for Criminal Intelligence Program
Annual Investigative Initiatives.]{.underline} At end of each fiscal
year, the SAC-Field Division shall close the primary CIP LII and prepare
a Report of Investigation (ROI) documenting the results of the
Division's activities. The ROI shall include:

-   A statistical summary of all investigations that may have been
    initiated as a result of information developed under the umbrella of
    the annual CIP LII; and

-   A summary of significant actions resulting from the Division's CIP
    activities.

The SAC-SIID will likewise close the CIP NII and prepare an ROI
containing statistical summaries of the Field Division activities as
described in the two items above, as well as summaries of any
significant activities relating to the CIP program that occurred during
the fiscal year.

410.7.3 [Other Criminal Intelligence Initiatives.]{.underline} When the
SAC-Field Division or SAC-SIID has a need to conduct a more narrowly
focused inquiry or activity relating to the CIP, he/she should initiate
additional LII's as necessary. This would include activities such as:

-   Investigations of specific anti-tax or other anti-government or
    terrorist groups operating within the Division whose activities come
    within TIGTA-OI's jurisdiction;

-   Participation in task forces, other than JTTF; and

-   Participation in other proactive CIP initiatives that are narrow in
    scope and specific in nature.

Additional LII's initiated relating to the CIP shall be documented in
PARIS using:

-   Sensitivity Code "8 -- Counter Terrorism"

-   Violation Code "152 -- Intelligence Gathering Initiative"

When initiating these CIP LII's, the SAC must follow the case initiation
procedures set forth in [Section
320.4](../../../../../../../../imds-temp/chapter400-inv/400-320/chapter400-320.doc#LocalInvInitiativeSIISIIP)
of this Chapter. The authority to initiate CIP LII's may not be
re-delegated

**Note:** CIP LII's are not to be initiated on specific, named
individuals. At such time as an investigation of a specific individual
is warranted, then a Non-Employee or Employee investigation must be
initiated as set forth in [Section
410.10](#InitiatingInvestigationsThroughCIP) below.

8.  []{#ParticipationinJointTerrorismTaskForces .anchor}[Participation
    in Joint Terrorism Task Forces.]{.underline}

At the beginning of each Fiscal Year, the SAC-SIID shall initiate a
National Investigative Initiative (NJTTF -- LII) from which TIGTA-OI
proactive JTTF initiatives will be derived. The SAC-SIID shall also
ensure that a Group 813 S/A is assigned to the National JTTF.

The SAC-Field Divisions are encouraged to participate in the Department
of Justice (DOJ) JTTF's. Participation in a JTTF not only enhances the
United States' capability to deter, defeat, and respond vigorously to
terrorism, it provides TIGTA-OI with a means to effectively and
efficiently obtain information relating to groups and individuals that
pose a threat to the safety of IRS employees and facilities.

The SAC-Field Division may designate, with his/her respective AIGI
concurrence, one TIGTA S/A to participate in each of the JTTF's
operating within the Division. If a Field Division has three JTTF's
operating within the Division, the SAC may designate three S/A's to
participate, one for each JTTF. The SAC-Field Division, with concurrence
of the Federal Bureau of Investigation (FBI) Supervisory Special Agent
supervising the daily activities of the JTTF, will determine the level
of participation that each of the designated TIGTA-OI S/A's will have in
their respective JTTF assignments.

In accordance with the provisions of the [Memorandum of Understanding
Between the Federal Bureau of Investigation and the Treasury Inspector
General for Tax
Administration](../../../../../../../../I:/mous/JTTF%20MOU%202001%2009%2005.pdf),
signed by the TIGTA on September 5, 2001, when participating in a JTTF,
the TIGTA-OI S/A is authorized to investigate and gather information
relating to any matter coming under the JTTF jurisdiction. Because the
JTTF's operate under the Attorney General authority, assigned TIGTA-OI
S/A's must adhere to Attorney General Guidelines while conducting
investigations coming under the authority of the JTTF. The FBI issues
all guidance on investigative matters handled by the JTTF, including all
applicable guidelines and policies.

However, while participating in the JTTF, the TIGTA-OI S/A shall
endeavor to focus on matters that may be specifically related to the
TIGTA-OI mission.

At the beginning of each Fiscal Year, each SAC-Field Division shall
initiate a JTTF LII to monitor JTTF activities and to spin-off proactive
investigations derived from JTTF participation.

These Divisional JTTF LII's shall be spin-off cases of the NJTTF LII
initiated by the SAC-SIID.

The Divisional JTTF LII shall be documented in PARIS as follows:

-   Title shall be Division Name and the phrase "JTTF Initiative" -- for
    example, "Washington Field Division JTTF Initiative"

```{=html}
<!-- -->
```
-   Source of Complaint Code shall be \"14 -- TIGTA Investigations --
    Spin off from National Investigative Initiative\"

-   Sensitivity Code shall be \"8 - Counter Terrorism\"

-   Violation Code shall be "152 -- Intelligence Gathering Initiative"

```{=html}
<!-- -->
```
-   Activity Code shall be "36 -- Participation in JTTF"

**Note:** Activity Code 36 must be used by all S/A's participating in a
JTTF as this is the only means to identify a JTTF LII in PARIS.

In accordance with the MOU between TIGTA-OI and the FBI relating to
participation in JTTFs, TIGTA-OI will not knowingly act unilaterally on
any matter affecting the JTTF without first coordinating with the FBI.
The SAC-Field Division will make all reasonable efforts to refer matters
to the JTTF that are logically relevant to the JTTF mission. See
[Section 410.15](#TerrorismAmendmentsto26USC6103) below for additional
guidance on disclosure of information relating to terrorism.

The SAC-Field Divisions are encouraged to participate in other
counter-terrorism related task forces. However, while participating in
such task forces, TIGTA-OI S/As generally may only participate in or
conduct investigations that fall within TIGTA's jurisdiction unless the
TIGTA has agreed to a Memorandum of Understanding regarding TIGTA-OI's
participation in such task forces. In such cases, the SAC-Field Division
shall contact the ASAC, Group 813, who shall coordinate with
TIGTA-Counsel.

410.8.1 [Report of Investigation for JTTF Participation.]{.underline} At
the end of each fiscal year, or at such time as TIGTA-OI is no longer
participating in a particular JTTF, whichever comes first, the JTTF LII
shall be closed and a Report of Investigation (ROI) completed
documenting the results of the S/A's participation. This will include:

-   Significant contributions or information the Division provided to
    the JTTF; and

-   A brief summary of all TIGTA-OI investigations that may have been
    initiated as a result of information developed in the JTTF.

410.9 []{#CoordinationwiththeFBI .anchor}[Coordination with the Federal
Bureau of Investigation (FBI).]{.underline}

The Code of Federal Regulations (CFR), Title 28, Section 0.85 (l),
states that the Director of the FBI shall, "...Exercise Lead Agency
responsibility in investigating all crimes for which it has primary or
concurrent jurisdiction and which involve terrorist activities or acts
in preparation of terrorist activities within the statutory jurisdiction
of the United States. ...If another Federal agency identifies an
individual who is engaged in terrorist activities or in acts in
preparation of terrorist activities, that agency is requested to
promptly notify the FBI. Terrorism includes the unlawful use of force
and violence against persons or property to intimidate or coerce a
government, the civilian population, or any segment thereof, in
furtherance of political or social objectives."

In accordance with the above, the SAC-Field Division, or his/her
designee, shall promptly notify the appropriate JTTF of non-Section 6103
information developed within his/her respective Field Division that
relates directly to a terrorist incident, threat, or activity.

If tax returns or return information are to be disclosed, then the
SAC-Field Division shall contact the ASAC, Group 813, who will
coordinate with TIGTA-Counsel.

Refer to [Section 410.15](#TerrorismAmendmentsto26USC6103) of this
Chapter and [Section
50.5.2.6](../../../../../../../../I:/chapter700-counsel/700-50/700-50.doc#Nontaxcriminal)
of Chapter 700 for additional guidance.

410.10 []{#InitiatingInvestigationsThroughCIP .anchor}[Initiating
Investigations on Individuals Identified Through Criminal Intelligence
Program LII.]{.underline}

When an S/A develops information through CIP activities which indicates
there is a [potential]{.underline} that an individual may meet one of
the criteria to be designated a PDT, as set forth in [Section
260.4.3](../../../../../../../../I:/chapter400-inv/400-260/chapter400-260.doc#PDTCriteria)
of this Chapter, or Taxpayer Caution (CAU), as set forth in [Section
260.6](../../../../../../../../I:/chapter400-inv/400-260/chapter400-260.doc#IRSCautionIndicator)
of this Chapter, or the individual may have in the past, is currently,
or is likely in the future to violate a criminal statute coming under
TIGTA-OI's jurisdiction, the individual will be cross-indexed in PARIS,
referencing the CIP LII case number under which the information was
initially developed.

When cross-indexing an individual to the CIP LII:

-   Use RELATIONSHIP TO SUBJECT code 10 -- Other; and

-   Document the REMARKS block of the Cross-Index Section to adequately
    identify the activities of the suspect individual that are the basis
    for the cross-indexing.

Appropriate preliminary inquiries should then be made under the LII case
number to determine if there is a [reasonable indication]{.underline}
that the subject would meet the criteria to be designated a PDT/CAU or
that the subject has committed a criminal violation coming under
TIGTA-OI jurisdiction. In determining the above, the S/A must take into
account specific facts or circumstances that a prudent investigator
would consider.

These preliminary inquiries should generally be limited to the
following:

-   Law enforcement records checks;

-   Interviews of law enforcement personnel;

-   Inquiries of other public agencies;

-   Obtaining Department of Motor Vehicle photographs of potential
    subjects for purpose of obtaining or verifying description;

-   Interviews of confidential sources;

-   TIGTA indices checks;

-   Examination of records available to the public and other public
    sources of information;

-   Weapons checks;

-   Public statements or writings made by individual;

-   Surveillance;

-   Use of informants or undercover agents who passively receive
    information; and

-   IRS records checks may only be conducted on persons that advocate
    activities specifically against IRS employees or facilities, or
    against the Federal government in general, where such activities
    could reasonably threaten the safety of IRS employees or facilities,
    or impede the administration of the internal revenue laws. See 26
    U.S.C. § 6103(h)(1).

Once these preliminary inquiries have been completed, and a
determination is made that there is a reasonable indication the
individual would meet the criteria to be designated a PDT/CAU, or has
violated a criminal statute coming under TIGTA-OI's jurisdiction, then a
spin-off case shall be initiated, and an investigation of the
individual's activities conducted, as appropriate.

**Note:** Do not initiate a CIP LII on a specific, named individual.
[Only a Non-Employee or Employee investigation should be initiated on
specific, named individuals]{.underline}.

Once the investigation is completed, the ROI should be forwarded to the
IRS-Office of Employee Protection (OEP), where the PDT/CAU determination
is made, in accordance with [Section
250.7](../../../../../../../../I:/chapter400-inv/400-250/chapter400-250.doc#ROI)
of this Chapter and/or the U.S. Attorney's Office (USAO) in accordance
with [Section
250.13](../../../../../../../../I:/chapter400-inv/400-250/chapter400-250.doc#ReferringCasesCrimAction)
of this Chapter. In addition, the [TIGTA Form-OI
8273](../../../../../../../../I:/tigta-templates/investigations-forms/form-oi8273-assault-threat-harass-incident-rpt.dot),
Assault, Threat, Harassment Incident Report, must be fully documented.

**Note:** In accordance with [Section
150.6.5](../../../../../../../../I:/chapter400-inv/400-150/chapter400-150.doc#SensitivityofTECSNCIC)
of this Chapter, on cases referred for PDT/CAU determination, do not
provide the IRS-OEP with information obtained only from the Treasury
Enforcement Communication System (TECS) or National Crime Information
Center (NCIC). Raw TECS or NCIC results may not be provided outside of
TIGTA-OI without verification by the originating agency before such a
disclosure.

When the spin-off Non-Employee case is closed, the SAC-Field Division
determines if a review of the ROI by the ASAC-SIID, Group 813, is
warranted to make further distribution of the case (e.g. Director of
AWSS, TIGTA management officials, etc.). If so, then the SAC-Field
Division shall advise the ASAC-SIID, Group 813, regarding the closing of
the case.

410.11 []{#AntiGovernmentGroupsDatabase .anchor}[Anti-Government Groups
Database.]{.underline} (Reserved)

410.12 []{#DivisionCriminalIntelligenceCoordinator .anchor}[Divisional
Criminal Intelligence Coordinator Activities.]{.underline}

Each SAC-Field Division will designate an S/A who will serve as the
Divisional Criminal Intelligence Coordinator (CIC) for all CIP
activities. Generally, this will be a collateral duty for the assigned
S/A, but the SAC may designate it as a full time assignment if the
amount of work involved in a particular Field Division so warrants.
Except in unusual situations, the CIC should be an S/A that is assigned
to an ASAC located at the Field Division headquarters. The SAC may use
his/her discretion in making this determination.

CIC activities will include, but not be limited to, the following:

-   Coordinating intelligence gathering activities on anti-tax, or other
    anti-government or terrorist groups operating within the Field
    Division that may pose a threat to the safety of IRS employees or
    whose goal is to impede IRS operations through criminal activities;

-   Analyzing incident and threat investigation information within the
    Field Division to identify emerging trends or significant activities
    of groups or individuals;

-   Liaison and coordination with the ASAC-SIID Criminal Intelligence
    Section, Group 813;

-   Maintaining liaison with other TIGTA Field Division designated CICs;

-   Conducting routine, periodic liaison with other Federal or
    state/local law enforcement agencies (especially FBI, Bureau of
    Alcohol, Tobacco, Firearms and Explosives (ATF) and U.S. Marshals
    Service) to identify individuals or groups that may pose a potential
    threat to the safety of IRS employees;\*

-   Conducting routine, periodic liaison with IRS offices within the
    Division to identify individuals or groups that may pose a threat to
    the safety of IRS employees;\* and

-   Participation in JTTF.\*

\* These activities may be done by other designated S/A's within the
Division.

410.13 []{#CriminalIntelligenceProgramAdvisories .anchor}[Criminal
Intelligence Program Advisories.]{.underline}

The ASAC-SIID, Group 813, is responsible for developing and
dissemination of all CIP Advisories, with approval from the SAC-SIID.
CIP Advisories are developed to advise:

-   TIGTA and IRS management officials of significant activities of
    anti-government groups or individuals that may affect the safety of
    IRS personnel and facilities;

-   TIGTA-OI personnel and IRS management officials of current
    terrorism-related information and alerts; and

-   TIGTA-OI personnel or officer safety issues.

TIGTA-OI S/A's may share the information contained in CIP advisories
with other law enforcement entities, however, a SAC or higher- level
TIGTA-OI executive must authorize the release an actual CIP Advisory
outside of TIGTA.

410.14 []{#BriefingsPresentations
.anchor}[Briefings/Presentations.]{.underline}

The ASAC-SIID, Group 813, in conjunction with the Operations Division,
with input from the Field Divisions, will develop and update as
appropriate the following presentations:

-   Suspicious mailings, to include hazardous materials (HAZMAT)
    procedures;

-   General TIGTA mission statement, as it relates to criminal
    intelligence, for other Law Enforcement Officers;

-   Anti-Tax/Anti-Government/Militia Groups;

-   Telephonic/bomb threats; and

-   Tax filing season awareness for IRS employees (Threat presentation).

All CIP related briefings/presentations will be tracked in PARIS using
Activity Code 38 -- Counter-terrorism -- Speech, Presentation.

410.15 []{#TerrorismAmendmentsto26USC6103 .anchor}[Terrorism Amendments
to 26 U.S.C. § 6103.]{.underline}

Congress amended 26 U.S.C. § 6103 to address specifically the disclosure
of returns and return information in the context of terrorism. These
amendments applied to disclosures through December 31, 2003; however,
subsequent amendments extended this authorization to December 31, 2005.

Section 6103(i)(3)(B) permits TIGTA, \"\[u\]nder circumstances involving
imminent danger of death or physical injury to any individual,
\...\[to\] disclose return information to the extent necessary to
apprise appropriate officers or employees of any Federal or State law
enforcement agency of such circumstances.\" While TIGTA S/As may
continue to invoke 26 U.S.C. § 6103(i)(3)(B) in terrorism-related
situations involving imminent danger of death or physical injury, as
counter-terrorism investigations become more routine law enforcement
activities, S/A's may encounter terrorism-related returns or return
information in which there is no imminent danger of death or physical
injury.

The new amendments to § 6103, which address terrorism-related returns or
return information in which there is no imminent danger of death or
physical injury are summarized below.

**Note:** The definitions below apply to the following guidance:

-   \"Taxpayer return information\" is return information submitted by
    or on behalf of the taxpayer to whom the information relates, as
    distinguished from, for example, information obtained from other
    sources (e.g., witnesses) during an examination or investigation.

-   \"Taxpayer identity\" means the name of a person with respect to
    whom a return is filed, the person\'s mailing address, taxpayer
    identifying number, or a combination of those items. For purposes of
    26 U.S.C. §§ 6103(i)(3)(C), (i)(7)(A), and (i)(7)(B), a taxpayer\'s
    identity does not constitute \"taxpayer return information.\"

-   \"The term \'person\' shall be construed to mean and include an
    individual, a trust, estate, partnership, association, company, or
    corporation.\"

410.15.1 [TIGTA Initiates Disclosure.]{.underline} TIGTA may initiate a
disclosure when it has return information (but not returns or taxpayer
return information) related to a terrorist incident, threat, or activity
(26 U.S.C. § 6103(i)(3)(C)(i)). The disclosure may be made only to the
extent necessary to apprise the head of a Federal law enforcement agency
responsible for investigating or responding to the terrorist incident,
threat, or activity. The head of the agency may, in turn, disclose that
return information to agency employees to the extent necessary to
investigate or respond to the terrorist incident, threat, or activity.

TIGTA may disclose to the Attorney General returns or return information
(including taxpayer return information) to the extent necessary for, and
solely for use in, preparing a request for an ex parte order under 26
U.S.C. § 6103(i)(7)(D). Subsection 6103(i)(7)(D) permits TIGTA to
authorize an application for an ex parte order to allow for the
disclosure of returns or return information to the head of the
appropriate Federal law enforcement agency responsible for investigating
or responding to a terrorist incident, threat, or activity. Upon such an
ex parte disclosure, the head of the agency, in turn, may disclose the
material to agency employees to the extent necessary for them to
investigate or respond to the terrorist incident, threat, or activity.

The judge or magistrate may issue an ex parte order if there is
reasonable cause to believe, based on information believed to be
reliable, that the return or return information may be relevant to a
matter relating to a terrorist incident, threat, or activity. If an ex
parte order is granted, the designated material shall be solely for use
in a Federal investigation, analysis, or proceeding concerning any
terrorist incident, threat, or activity.

The following summarizes the above guidance:

TIGTA Initiates Disclosure (§ 6103(i)(3)(C))

Elements (i):

> 1\. TIGTA
>
> 2\. may disclose in writing
>
> 3\. return information (not taxpayer return information)
>
> 4\. related to terrorism
>
> 5\. to the extent necessary
>
> 6\. to apprise the head of an authorized Federal law enforcement
> agency.
>
> Elements (ii):
>
> 1\. TIGTA
>
> 2\. may disclose in writing
>
> 3\. returns and taxpayer return information
>
> 4\. to the Attorney General
>
> 5\. to the extent necessary
>
> 6\. and solely for use in preparing an ex parte order.

410.15.2 [Another Federal Agency Requests Disclosure.]{.underline} TIGTA
may disclose return information (but not returns or taxpayer return
information) upon receipt of a written request from the head of any
Federal law enforcement agency (or his/her delegate) involved in the
response to or investigation of any terrorist incident, threat, or
activity. The written request must set forth the specific reason/reasons
why the disclosure may be relevant to a terrorist incident, threat, or
activity. TIGTA may disclose the material to employees of any Federal
law enforcement agency who are personally and directly engaged in the
response to or investigation of any terrorist incident, threat, or
activity. They, in turn, may only use the return information for the
terrorist response or investigation.

The head of the Federal law enforcement agency receiving the disclosure
may, in turn, disclose that material to employees of any State or local
law enforcement agency if that agency is part of a team with the Federal
law enforcement agency in responding to or investigating a terrorist
incident, threat, or activity. The return information may only be
disclosed to State or local law enforcement agency employees who are
personally and directly engaged in that response or investigation.

TIGTA may also disclose return information (but not returns or taxpayer
return information) upon receipt of a written request from an employee
of either DOJ or the Treasury Department who was appointed by the
President with the advice and consent of the Senate, or from the
Director of the U.S. Secret Service (USSS), provided that the employee
is responsible for the collection and analysis of intelligence and
counterintelligence information concerning any terrorist incident,
threat, or activity. The written request must set forth the specific
reason(s) why the disclosure may be relevant to a terrorist incident,
threat, or activity. The material may be disclosed to employees of DOJ,
the Treasury Department and other Federal intelligence agencies who are
personally and directly engaged in the collection or analysis of
intelligence and counterintelligence information or an investigation
concerning any terrorist incident, threat, or activity. They, in turn,
may use the return information only for the terrorism-related
collection, analysis, or investigation.

The following summarizes the above guidance:

Federal Agency Requests Disclosure (§ 6103(i)(7))

> Elements (A)(i):
>
> 1\. If an authorized law enforcement officer
>
> 2\. makes a written request specifying why a disclosure may be
> relevant to
>
> Terrorism
>
> 3\. TIGTA
>
> 4\. may disclose
>
> 5\. return information (not taxpayer return information)
>
> 6\. to employees of a Federal law enforcement agency
>
> 7\. personally and directly engaged in the response to or
> investigation of
>
> terrorism.
>
> Elements (A)(ii):
>
> 1\. The head of a federal law enforcement agency
>
> 2\. who obtains return information under (A)(i)
>
> 3\. may disclose that return info
>
> 4\. to state or local law enforcement officers
>
> 5\. personally and directly engaged as part of a team with the federal
> law
>
> enforcement agency in a terrorism response or investigation.

**NOTE:** Information disclosed under (A) may only be used for the
particular response/investigation for which disclosed.

> Elements (B):
>
> 1\. If an authorized DOJ or Treasury official, or the USSS director
>
> 2\. responsible for collecting and analyzing terrorism intelligence
> and
>
> counterintelligence information
>
> 3\. makes a written request specifying why a disclosure may be
> relevant to
>
> Terrorism
>
> 5\. TIGTA
>
> 6\. may disclose
>
> 7\. return information (not taxpayer return information)
>
> 8\. to the requestor, and to Federal intelligence agency employees
> personally
>
> and directly engaged in collecting or analyzing terrorism intelligence
> and
>
> counterintelligence information or investigating terrorism.

9\. The information disclosed may only be used for that terrorism work.

410.15.3 [Expansion of Provisions Concerning Ex Parte
Orders.]{.underline} The legislation expands the circumstances in which
an ex parte order may be granted. Under 26 U.S.C. § 6103(i)(7)(C), the
Attorney General, the Deputy Attorney General, the Associate Attorney
General, any Assistant Attorney General, or any United States Attorney
(USA) may authorize an application to a Federal district court judge or
magistrate for an ex parte order. The judge or magistrate may grant an
ex parte order if there is reasonable cause to believe, based on
information believed to be reliable, that the return or return
information may be relevant to a matter relating to a terrorist
incident, threat, or activity, and if the return or return information
is sought exclusively for use in a Federal investigation, analysis, or
proceeding concerning any terrorist incident, threat, or activity. The
ex parte order may provide that returns or return information be open to
inspection by, or disclosure to, any Federal law enforcement or
intelligence agency employees who are personally and directly engaged in
any investigation, response to, or analysis of, intelligence and
counterintelligence information concerning any terrorist incident,
threat, or activity. Those employees may use the returns or return
information solely in the investigation, response, or analysis, and in
any judicial, administrative, or grand jury proceedings, pertaining to
the terrorist incident, threat, or activity.

The following summarizes the above guidance:

> Subsection 6103(i)(7)(C) expands the availability of ex parte orders
> to disclose returns/return information to Federal law enforcement
> agency and Federal intelligence agency employees personally and
> directly engaged in terrorism intelligence and counterintelligence
> work.
>
> Application for the ex parte order must give reasonable cause to
> believe that the disclosure may be relevant to a matter relating to
> terrorism. The material must be sought exclusively for use in Federal
> terrorism work.